Campaign 10: Phase A complete + gated; Phase B not run; R-156 filed

Phase A passed every gate on a fresh box built from the PUBLISHED ISO 1.26.1:
install, claim, two drives enrolled through the real endpoints with the backup
target healthy, four apps spanning both sides of D5's secret split, and a
working discriminator across all four.

Isolation gate: both denials captured, each with a positive control. The PBS
control FAILED first — four clean-looking 403s were worthless because the token
was denied on its own datastore too (PBS token privilege separation). Fixed and
re-run; the denials stand.

R-156 (new, register grepped): papra's data is neither persisted nor backed up,
and it reports healthy. The template mounts papra_data:/app/data; the app writes
/app/app-data/db/db.sqlite. Volume empty and root-owned against a -rootless
image, real DB in the container writable layer, healthcheck only probes the HTTP
port. Its Tier-1/2 backup is real, verifiable and contains nothing. Not fixed.

Tier 3 could not be isolated so it was not run: offsite hard-requires the DR
tier (configs.go:1300) and the DR tier only provisions on ep0 (per-endpoint
allocation deferred, hub/README.md:260). Both are recorded deliberate positions,
so no R-n minted. The campaign touched neither ep0 nor the Storage Box.

Phase B did not start. Phase A was budgeted at ~1h and took ~5.5h (1.26.1 is a
public release image with no auto-install path, so the install was a blind
screendump+sendkey walk). That left the runner — which judges eleven invariants
and fires destructive atoms unattended — to be written at 04:00 with ~3h of
night left. Stopped on the brief's own fence: a rig producing false negatives is
worse than no rig. The rig is built and idle; teardown is OWED and itemised,
including hub customer c10-soak (disposition: DELETE).

documentation/tests/campaign10-evidence-2026-07-31/isolation/restic-denial.txt

@@ -0,0 +1,53 @@
+# restic/Storage-Box isolation proof — subaccount u629488-sub4 (home felhom-campaign10)
+# box 611714 storage-box-pool-1 · server u629488.your-storagebox.de · 2026-07-31T20:15:55Z
+# Production subaccounts on the SAME box: sub1=felhom-demo-felhom sub2=felhom-peti-felhom sub3=felhom-demo-hp
+# Password never echoed; supplied to sshpass via env.
+
+## POSITIVE CONTROL — sub4 in its OWN home (must SUCCEED)
+$ sftp> pwd ; ls -a ; put canary ; ls
+Warning: Permanently added '[u629488.your-storagebox.de]:23' (ED25519) to the list of known hosts.
+Connected to u629488.your-storagebox.de.
+sftp> pwd
+Remote working directory: /home
+sftp> ls -a
+.   ..  
+
+## DENIAL 1 — reach Peti's REAL customer repo path from sub4
+$ sftp> cd /home/felhom-peti-felhom  /  cd ../felhom-peti-felhom  /  ls /felhom-peti-felhom
+Connected to u629488.your-storagebox.de.
+sftp> cd /home/felhom-peti-felhom
+stat remote: No such file or directory
+sftp> cd ../felhom-peti-felhom
+stat remote: No such file or directory
+sftp> ls /felhom-peti-felhom
+Can't ls: "/felhom-peti-felhom" not found
+sftp> ls ..
+remote readdir("/home/../"): Permission denied
+
+## DENIAL 2 — reach demo-felhom's and demo-hp's production repo paths
+Connected to u629488.your-storagebox.de.
+sftp> cd /home/felhom-demo-felhom
+stat remote: No such file or directory
+sftp> ls /felhom-demo-felhom
+Can't ls: "/felhom-demo-felhom" not found
+sftp> cd /home/felhom-demo-hp
+stat remote: No such file or directory
+sftp> ls /felhom-demo-hp
+Can't ls: "/felhom-demo-hp" not found
+
+## POSITIVE CONTROL (STRENGTHENED) — sub4 must be able to WRITE and READ BACK in its own home,
+## proving the credential is fully functional and the denials above are AUTHORIZATION, not a dud login.
+Connected to u629488.your-storagebox.de.
+sftp> put /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt c10-canary.txt
+Uploading /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt to /home/c10-canary.txt
+sftp> ls -l
+-rw-rw-r--    ? u629488-sub4 1059           56 Jul 31 22:16 c10-canary.txt
+sftp> get c10-canary.txt /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
+Fetching /home/c10-canary.txt to /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
+sftp> rm c10-canary.txt
+Removing /home/c10-canary.txt
+sftp> ls -l
+readback content: campaign10 write-capability canary 2026-07-31T20:16:23Z
+
+## VERDICT: write+read succeed in own home; every production path is outside the chroot
+## ('No such file or directory') and the parent directory is an explicit 'Permission denied'.