CAMPAIGN-11 Phase 4: pre-registered expectations, both directions, before the window

Written BEFORE the soak so the comparison cannot be fitted afterwards. Sources
are the box's own [scheduler] Registered lines and the agent's backup tier armed
lines, read at 23:56.

MUST happen: db-dump 02:30, tier2-backup + fill-watch 03:30, metrics-prune
04:00, offbox-backup 04:15 (snapshot_count 1 -> 2), a backup_run_digest event,
reports every ~15m.
MUST NOT happen: host_stale/host_recovered, offsite_selfheal_restaged (this is
also R-218's negative control — a box WITH a target must not declare),
offbox_repo_orphaned, offsite_repo_key_changed, escrow blob SERVED, any
controller self-update.
Genuinely uncertain and recorded as such: the restore-test has a 24h settle and
every archive here is hours old, so NOT running is correct, not a gap.

documentation/tests/campaign11-evidence-2026-08-05/journal-phase24.md

@@ -641,3 +641,67 @@ its edge.
 | Recovery screen | retired (correct — the set-aside declared it would be) |
 | Deviations left in place | the raw `/mnt/adatok` and `/mnt/mentes` mounts remain **unmounted** (R-220's workaround); the stable `/mnt/felhom-drives/*` mounts are what everything uses |
 
+
+---
+
+# Phase 4 — leave it alone and watch
+
+**Window: 2026-08-05 23:56 CEST → 2026-08-06 ~04:45 CEST.** The venue is not touched: no endpoint is
+driven, no service restarted, nothing configured. Only logs and the hub are read.
+
+## Pre-registered expectations — written BEFORE the window, so the comparison is not fitted afterwards
+
+**A soak that reports only "nothing broke" has measured nothing.** Both directions are named here in
+advance. Sources: the box's own `[scheduler] Registered …` lines and the agent's own `backup tier
+armed` lines, read at 23:56.
+
+### The box's own schedule (controller, restarted 23:29:53 CEST after F11)
+
+| when | job |
+|---|---|
+| **02:30** | `db-dump` |
+| **03:30** | `tier2-backup` · `fill-watch` |
+| **04:00** | `metrics-prune` |
+| **04:15** | `offbox-backup` ← **the one this campaign cares about** |
+| every 15 m | `hub-report` |
+| every 1 m / 5 m / 2 m | `agent-channel-health` · `system-health` · `stack-scan` |
+| every 10 s / 30 s | `status-refresh`, `health-probes` · `deadapp-check`, `ring-spill` |
+| every 6 h | `selfupdate-check` · `disk-health-check` |
+
+### The agent's schedule (host domain)
+
+```
+backup tier armed  target=felhom-backup  cadence=24h    keep_last=3  primary=true
+backup tier armed  target=felhom-pbs     cadence=168h   keep_last=0  primary=false
+backup: restore-test scheduler starting (per-archive due-check)  eval_interval=6h  settle=24h
+```
+
+### MUST happen (an absence here is a finding)
+
+1. Reports keep arriving every ~15 min; the host stays **ONLINE** all night.
+2. **`db-dump` at 02:30**, **`tier2-backup` + `fill-watch` at 03:30**, **`metrics-prune` at 04:00**.
+3. **`offbox-backup` at 04:15** runs unprompted and succeeds — `snapshot_count` **1 → 2**,
+   `last_status: ok`, `last_success` stamped in the 04:15 window.
+4. A **`backup_run_digest`** event reaches the hub after a backup run (this is the "operator digest";
+   it is event-driven per run, **not** a nightly cron — checked in the hub source rather than assumed).
+5. The agent's **`felhom-backup`** tier (24 h cadence) takes a whole-guest archive when it comes due.
+
+### MUST NOT happen (firing here is equally a finding)
+
+1. **No `host_stale` / `host_recovered`** — the box is up and staying up.
+2. **No `offsite_selfheal_restaged`** — the box has a target, so `needsOffsiteCredential` returns
+   false and it must not declare. *(This is also §4.2's negative control: if the box DOES declare
+   tonight with a target present, R-218's fix is wrong in the other direction.)*
+3. **No `offbox_repo_orphaned`** — the repo is fresh and written under the key the box holds.
+4. **No `offsite_repo_key_changed`** — nothing re-escrows tonight.
+5. **No `escrow blob SERVED`** — nobody is driving a recovery.
+6. **No controller self-update** — `auto-update: false`, and the box is at 0.201.0 with floor 0.200.0.
+
+### Genuinely uncertain, recorded as open questions rather than predictions
+
+- **The restore-test** evaluates every 6 h with a **24 h settle**, and every archive on this box is
+  hours old. **Expected NOT to run** — and if it does not, that is correct behaviour, not a gap. The
+  distinction matters because "no restore-test fired" would otherwise read as a failure.
+- Whether the agent's local tier fires tonight depends on when its 24 h cadence last elapsed on a box
+  built today.
+