# R-156 evidence ��� papra persists OUTSIDE the volume the compose mounts
## 1. compose mounts papra_data at /app/data
volume papra_papra_data -> /app/data

## 2. the container runs as nonroot and CANNOT write there
uid=999(nonroot) gid=999(nonroot) groups=999(nonroot)
drwxr-xr-x 2 root root 4096 Jul 31 23:18 /app/data
touch: cannot touch '/app/data/.w': Permission denied
## 3. the volume is empty apart from the canary this campaign wrote AS ROOT
total 12
drwxr-xr-x 2 root    root    4096 Jul 31 23:18 .
drwxr-xr-x 1 nonroot nonroot 4096 Jul 31 23:12 ..
-rw-r--r-- 1 root    root      19 Jul 31 23:18 cc_proof.txt
## 4. the REAL database is in the container writable layer, not in any volume
total 472
drwxr-xr-x 1 nonroot nonroot   4096 Jul 31 23:12 .
drwxr-xr-x 1 nonroot nonroot   4096 Jul  4 22:19 ..
-rw-r--r-- 1 nonroot nonroot 475136 Jul 31 23:12 db.sqlite
## 5. healthcheck only probes the HTTP port, so this reads healthy
"healthy"