# Campaign 2 — evidence snapshot (2026-07-07)

Raw evidence for `../CAMPAIGN-2-2026-07-07.md` (read that first — it triages everything here).
Collected from the throwaway harness on DooPlex (`~/campaign2-nomercy/`); session cookie jars were
deleted before commit (no secrets). Times are CEST.

## Layout
- `state/` — run-level artifacts:
  - `overnight.out` — the full run log (every phase, every JOURNAL line, all agent errors).
  - `journal.tsv` — per-test verdicts (incl. the 170 `T-SOAK-BREAK-*` — all one artifact, H2).
  - `flightrec.log` — 351 samples (~7 h): pct/docker/cc-latency/load/free + the leak sampler
    (`c_rss/c_fd/c_sock` controller, `a_rss/a_fd/a_sock` agent). The leak headline lives here.
  - `r0_snapshot.txt`, `p9_restore_snap.txt`, `d1_gate_ok`.
- `evidence/<TEST-ID>/` — per-test evidence (61 dirs).

## The pointers that matter
- **R1 (headline finding — bind-mount restore needs root):**
  `evidence/T-SELFRESTORE/restore-test.out` (`pass:false`, `mp8 … only possible for root`),
  `evidence/T-DR-BRINGUP/bringup.out` (same on the DR path).
- **R2 (agent VM.Audit/VM.Allocate gaps):** same two files (the `403 VM.Audit` config-read + the
  `403 VM.Allocate` scratch-teardown lines).
- **H1 (dominant harness bug — auth-session expiry):** `evidence/T-STG-ENROLL/init1.txt`
  (`CSRF token missing or invalid`), `evidence/T-RST-VW/{restore_resp.txt,canary_check.txt}`
  (302→login, empty canary).
- **H3 (D1 not delivered):** `overnight.out` around the `[D1]` block (`sqlite3: … not found`).
- **Positives:** `evidence/T-PBS-VERIFY/`, `evidence/T-RESTORE-TEST-CRASH/`,
  `evidence/T-FLT-{KILL9,AGENT,CF}/`, `evidence/T-BAK-FULL/`, `evidence/T-AUTH-1/`, `evidence/T-CSRF/`.

## Verdict in one line
One genuine pilot-critical product finding (R1/R2 — non-root can't restore a bind-mount guest);
the rest of the FAIL count is a single dominant harness bug (H1) plus a few calibration issues; the
product, where actually exercised, was healthy with zero resource leaks.