# Phase 3 — R-357 against a real full disk. VERDICT: **PASS**

**Owed since 2026-08-25. Until tonight the destructive restore's free-space gate had only ever been
proven by seam tests.** It has now met a genuinely full filesystem.

## Method

`calibre-web` lives on `hdd_1` — a **separate 1 TB NVMe device that does not back Docker**, chosen so
filling it could not take the box down. `fallocate` reduced free space to **1 900 544 B** against a
measured need of **5 878 421 B**.

## The non-effects, which are what matter

| assertion | result |
|---|---|
| refused **before** `StopStack` — the app never went down | **`Up 6 minutes (healthy)` before and after**, unchanged; 0 stop-related log lines |
| no safety dump written | **0** files |
| live data byte-identical | 22 files, tree fingerprint **`5a9b2db75dfd4ba4131adb3255670472`**, unchanged |
| the message names the need and the free space, in Hungarian, not raw rsync | `Nincs eleg szabad hely a visszaallitashoz (5.6 MB szukseges, 1.8 MB szabad).` |
| the log names both numbers and the non-effect | `REFUSING the destructive restore — need 5878421 B, free 1900544 B on /mnt/felhom-drives/hdd_1; the app was NOT stopped` |

## And it works when there IS space — the other half, without which the above proves nothing

Ballast removed → the **same** restore ran:
`reconstituted calibre-web from snapshot ece64c87: 0 file(s) placed, 1 volume(s) replayed`, app back
in 37 s, and the userdata tree fingerprint is **`5a9b2db75dfd4ba4131adb3255670472`** — identical to
before the whole drill.

## The other three guards on the same full disk — none failed open

| job | behaviour | verdict |
|---|---|---|
| **Tier-2 run** | copied 3 apps successfully — its destination is on the *other* filesystem (`/var/lib/felhom`, 55 GB free), so a full `hdd_1` correctly did not stop it. Events `crossdrive_completed (info)` — mails nobody | correct |
| **R-87 proof** | **`refused before any download`**: `Nincs eleg szabad hely (2.0 GB szukseges, 1.8 MB szabad)`. Reached **no verdict**, did **not** alarm, and said so: *"A visszaallitas nem futott le — a mentesrol semmi nem derult ki"* | correct — and this is the **shared `unitOnlyHeadroom` gate**, extracted today so the proof and the customer restore refuse at one floor with one sentence, now live-validated |
| **integrity check** | **PASSED in 53.8 s** at 100 % depth — restic's cache lives on the container filesystem, not `hdd_1` | correct |

**No customer alarm fired from any of them.** The only events pushed were three `crossdrive_completed`
at severity `info`, which `severityNotifies` drops.