Campaign 10 Phase B: 27 cycles, 586 invariant checks, 0 violations

Ran the soak on the Phase A rig. Ended on its own deadline — no watchdog halt,
no atom exception, no I11 breach.

I1 28+28 pairs, I2 28+28 pairs, I3 56, I4 56, I5/I6 28 each, I7 28, I10 135,
I11 28. Zero violations. The row counts are themselves the no-silent-skip check:
I3/I4 twice per cycle (both drives), I10 = 5 secret-class fields x 27, REBOOT on
cycles 7/14/21 only.

I7 is the headline: 28 restores, 28 correct discriminators — never stale, never
empty. RTO (Tier 1, rallly, 66 MB): min 38.8s, median 42.0s, p90 42.5s, max
44.3s. That is the S band's lower end ONLY; the 5.5s spread over 28 runs says
fixed work dominates, so nothing extrapolates to M or L. RPO not measured.

Every atom and invariant was proven BY HAND before automation — the runner
asserts nothing that was not first observed live.

Caught a Phase A gap before starting: no app had HDD_PATH, so all data sat on the
system disk and I3 could never have fired. Deployed calibre-web onto adatok
first; otherwise the run would have produced 27 green cycles that tested nothing
cross-drive.

Investigated and DISPROVED a suspected defect (audit 5.2): /api/disks reports
state=attached for a physically absent drive, and intermediary.go:230 really does
compute presence from State=="attached". It is inert — planDriveGates only gates
paths under /mnt/felhom-drives/ and uses BoundUnderParent there, which was
correctly false. The gate fired; the storage page showed "Meghajtó leválasztva".
No R-n minted.

Honest gaps: 6 of ~12 atom families ran. Not run — Tier 3 (structurally
un-isolatable), abort-fs-in-place, kill-agent-mid-backup, hard-reset-mid-write,
reboot-VM, both concurrency atoms, fill-drive-near-full. I8 not checked, I9 not
automated (cited from the tester-gate run, not re-claimed). kill_controller is
NOT mid-backup and reboot_guest never interleaved with a detach. 27 cycles does
not answer the brief's question about drift at the thirty-eighth.

Teardown still OWED, including hub customer c10-soak (disposition: DELETE).

REPORT-campaign10.md

@@ -8,8 +8,8 @@ clobbered — same shared-clone reasoning as `REPORT-iso-release.md`.
 
 ## The sentence that matters
 
-**Phase A is complete and every gate passed. Phase B did not run.** The rig is built, fenced and
-idle, waiting for a runner that should not be written at 04:00.
+**Phase A passed every gate (07-31) and Phase B ran (08-01): 27 cycles, 586 invariant checks, zero
+violations, ended on its own deadline with no watchdog halt and no atom exception.**
 
 ## What was established
 
@@ -33,6 +33,23 @@ idle, waiting for a runner that should not be written at 04:00.
 - **A4** discriminators seed and read back across all four apps; rallly's over the path
   `DATABASE_URL` actually names, not the trusted socket that produced D5's false pass.
 
+## Phase B — the soak
+
+27 cycles, 09:33–15:40 CEST, atoms permuted per cycle, every invariant checked every cycle.
+
+- **I1** 28 + 28 pairs, **I2** 28 + 28 pairs, **I3** 56, **I4** 56, **I5/I6** 28 each, **I7** 28,
+  **I10** 135, **I11** 28 — **0 violations**. Row counts are themselves the no-silent-skip check
+  (I3/I4 twice per cycle = both drives; I10 = 5 secret-class fields × 27; REBOOT = cycles 7/14/21).
+- **I7 is the headline: 28 restores, 28 correct discriminators.** Never stale, never empty.
+- **RTO (Tier 1, rallly, 66 MB):** min 38.8 s, **median 42.0 s**, p90 42.5 s, max 44.3 s. **Covers the
+  S band only, and only its lower end** — the 5.5 s spread over 28 runs says fixed work dominates, so
+  nothing here extrapolates to M or L. **RPO not measured** (backups were driven on demand).
+- Every atom and invariant was **proven by hand before automation**; the runner asserts nothing that
+  was not first observed live.
+- **A Phase A gap was caught before the run:** no app had `HDD_PATH`, so all data sat on the system
+  disk and I3 could never have fired. calibre-web was deployed onto `adatok` first — otherwise the
+  soak would have produced 27 green cycles that tested nothing cross-drive.
+
 ## Findings
 
 - **R-156 (new)** — **papra's data is neither persisted nor backed up, and it reports healthy.** The
@@ -48,15 +65,22 @@ idle, waiting for a runner that should not be written at 04:00.
 
 ## What did not run
 
-Every B1 atom, I1–I11 across cycles, RTO/RPO, and A5's budget/watchdog. Phase A was budgeted at ~1 h
-and took ~5.5 h — the blind interactive install alone was ~1.5 h. That left the runner, the component
-that judges eleven invariants and fires destructive atoms unattended, to be written at 04:00 with ~3 h
-of night left. Stopped instead, on the brief's own fence: *a test rig producing false negatives is
-worse than no rig.*
+**6 of the brief's ~12 atom families ran.** Not run: Tier-3 backup/restore (§3), abort-a-filesystem-
+in-place (R-117 Q7), kill-the-agent-mid-backup, hard-reset-the-VM-mid-write, reboot-the-VM, both
+concurrency atoms, and fill-a-drive-near-full. **I8** not checked (no Tier 3); **I9** not automated —
+it was proven on this same controller 0.188.0 by the tester-gate run hours earlier, which is cited,
+not re-claimed.
+
+Two precision notes so atom names don't overclaim: `kill_controller` is **not** "mid-backup" (it lands
+at a permuted point, exercising recovery rather than the mid-write race), and `reboot_guest` was
+appended after the shuffle so it **never interleaved with a detach**.
+
+**The tail is untested, not clean.** The brief's interest in "the state that quietly drifts on the
+thirty-eighth" is not answered by 27 cycles.
 
 ## Teardown — OWED, nothing removed
 
-Deliberately intact so Phase B need not repeat Phase A. VM 311, `c10-scratch`, PBS datastore
+Still intact: the rig is reusable for the atoms that did not run. VM 311, `c10-scratch`, PBS datastore
 `felhom-c10` + user/token, restic subaccount `u629488-sub4`, and **hub customer `c10-soak` (disposition:
 DELETE)** are all outstanding, with commands in the audit §9. Named explicitly because R-131 is four
 orphaned scratch customers left by exactly this omission.