CAMPAIGN-11 Phase 4: the soak passed, with two absences answered honestly

All five daily jobs fired exactly once and completed on time. The 04:15 offsite
run produced snapshot_count 1 -> 2, last_status ok, 24.9s — unprompted, on a box
rebuilt twice and set aside four hours earlier. Nothing on the must-not list
fired, including offsiteheal: that is R-218's NEGATIVE control passing (a box
with a target must not declare), which does not substitute for its positive
half, still owed.

Investigated and DISPROVED: tier2-backup completing in 118ms looked like a
silent no-op; the copy is real and on the backup drive (818.5 KB verified).

Correction to my own pre-registration: backup_run_digest is a TEST FILENAME, not
an event type. The real one is backup_run_failures, a failures digest whose
silence on a clean night is correct — reporting it as a miss would have been a
finding I invented. What survives: the offsite run emits no hub event while both
lesser tiers announce success; failures and staleness are covered elsewhere, so
it is a consistency wrinkle, recorded not filed.

Two absences answered rather than assumed: the restore-test's silence was
PRE-REGISTERED as correct (6h eval, 24h settle); the agent's whole-guest tier is
left explicitly UNRESOLVED because routine local-api calls are not logged at INFO
— a 5h search returns 0 on a box that demonstrably served such calls, so the
instrument cannot answer.

No product code changed.

documentation/audits/CAMPAIGN-11-recovery-journey-2026-08-05.md

@@ -434,6 +434,67 @@ because two of them nearly produced false findings.
 
 ---
 
+## 8b. Phase 4 — the unattended soak
+
+**23:56 → 04:35, venue untouched.** 30 five-minute samples plus a full log census. **Expectations were
+pre-registered in the journal BEFORE the window**, in both directions, so nothing here is fitted
+afterwards.
+
+### Everything scheduled fired, exactly once, on time
+
+| job | due | result |
+|---|---|---|
+| `db-dump` | 02:30 | ✅ 5.237 s |
+| `tier2-backup` | 03:30 | ✅ 118 ms — **and the copy is real** (below) |
+| `fill-watch` | 03:30 | ✅ |
+| `metrics-prune` | 04:00 | ✅ |
+| **`offbox-backup`** | **04:15** | ✅ **24.884 s — `snapshot_count` 1 → 2, `last_status: ok`** |
+
+**The off-site tier runs itself, unprompted, on a box that was rebuilt twice and had its repository set
+aside four hours earlier.** That is the strongest positive of the whole campaign for the backup
+promise, as distinct from the recovery journey.
+
+### Nothing fired that should not have
+
+`needs_credential` 0 · `offsiteheal` 0 · `offbox_repo_orphaned` 0 in-window · `offsite_repo_key_changed`
+0 · `escrow blob SERVED` 0 · `host_stale`/`host_recovered` 0 · self-update 0 · operator emails 0.
+
+> **§4.2's negative control passes.** A box that HAS a target did not declare `needs_credential` once
+> in five hours. R-218's fix is not over-firing in the other direction — which does **not** substitute
+> for its positive half, still owed.
+
+### Investigated and DISPROVED — `tier2-backup` in 118 ms
+
+It looked like a scheduled backup that silently no-ops. It is not: `Tier 2 copied calibre-web →
+/mnt/felhom-drives/mentes/backups/secondary/calibre-web (818.5 KB, 1 leg(s), 0s)`, and the copy is on
+the backup drive. 388 KB on local NVMe in 118 ms is honest. **No finding.**
+
+### A correction to my own pre-registration
+
+I pre-registered a `backup_run_digest` event. **No such event type exists** — that is a *test
+filename*, and the real one is **`backup_run_failures`**, a failures digest whose silence on a clean
+night is correct. Reporting it as a miss would have been a finding invented by a bad reading.
+
+**What survives the correction:** the off-site run emitted **no hub event at all**, while both lesser
+tiers announced success (`db_dump_completed`, `crossdrive_completed`). Failures are covered by
+`backup_run_failures` and staleness by the hub's tier deadline monitor
+(`offsiteBackupStaleAfter = 8 days`), so this is **a consistency wrinkle, not a blind spot** —
+recorded, not filed.
+
+### What should have fired and did not — answered in both directions
+
+- **The restore-test did not run, and that is CORRECT** — `eval_interval=6h` (armed 23:29:43, first
+  evaluation ~05:29) with a **24 h settle** on archives hours old. **Pre-registered as "expected not to
+  run"**; without that, its silence would have read as a gap.
+- **The agent's whole-guest tier did not run, and whether it should have is NOT RESOLVABLE.** The box
+  reports `0 backups` all night; the agent is emphatically alive (**2 091 of its own lines** since
+  00:00, polling the guest at 04:17:57); **but routine local-api requests are not logged at INFO** — a
+  five-hour search for `local-api` returns **0** on a box that demonstrably served such calls earlier —
+  so "no `/backup/due` poll" is **not evidence**. The hub's deadline monitor is equally invisible at
+  INFO. **Recorded as an open question, not scored as a pass.**
+
+---
+
 ## 9. Invariants at every phase boundary
 
 | | | verdict |