=== EDGE 3: a CORRUPT MANIFEST reaches the store, then the proof judges it ===
  primary manifest now: {this is not json
  --- back it up so the CORRUPT manifest is what the proof restores ---
  pushed after ~10s
  --- rotate the proof to bentopdf ---
  "reason":"" "stack":"bentopdf" "verdict":"pass" 

  RUNBOOK EXPECTED: cannot judge.  IMPLEMENTED: fail-closed (R-403's rule: a unit whose
  manifest cannot be read cannot be vouched for). Reporting what actually happened.
proof: bentopdf PASSED on snapshot 5dcee6e3 in 2.194s — the backup holds what this app should have

=== restore the manifest ===
  restored: {
  "schema_version": 2,
  "app_name": "
