# Phase 5 — `demo-hp`'s own nightly cycle, mutated. **PASS**

Every scheduled job ran, on time, with a light load (a unit restore every 20 min) contending for the
single-writer flag across the whole window.

| job | CEST | duration | outcome |
|---|---|---|---|
| db-dump | 02:30 | 1 m 24.7 s | completed — **and it re-made the volume tars**, healing the injected fault |
| tier2-backup | 03:30 | 5.9 s | completed, 9 apps |
| fill-watch | 03:30 | 0 s | completed |
| metrics-prune | 04:00 | 0 s | completed |
| offbox-backup | 04:15 | 2 m 57.7 s | completed — **its own pre-push dump leg repaired a hollow unit** |
| offsite-abandon-sweep | 05:10 | 0 s | completed, clean beside the rest |
| **offsite-proof** | **05:30** | **5.0 s** | **completed — `bentopdf` PASSED on `9d002b38` in 2.315 s** |
| offsite-integrity | 06:00 | 0 s | **not due** — my own manual runs had advanced due-ness |

## The headline: the nightly proof fired unattended, for the first time

Yesterday's report listed *"the unattended nightly firing"* as **not yet live-validated**. It is now:
the job fired on its own schedule at 05:30, picked one app, proved it in 2.315 s, and scheduled the
next run for `2026-09-02 05:30 CEST`. **One app per night held.**

## The R-403 guard: PASS, forced after the natural test evaporated

`privatebin` was injected hollow at 23:34 to meet the 03:30 mirror. **The 02:30 db-dump re-made its
tar**, so by 03:30 the primary was sound and the guard had nothing to refuse. Forced instead on
`calibre-web` through the real Tier-2 path — and the guard fired and named itself:

```
Tier 2 calibre-web: unit leg SKIPPED — the recovery unit on the source drive lists no database dumps
and no volume tars, while the existing copy ... does. The copy was PRESERVED rather than replaced
with an empty one (R-403). The other legs continue.
```

Secondary byte-identical: 23 files, 5 808 704 B, tar sha `d7e7f422…`. **Negative control** at
teardown: with every unit sound, the same job skipped **0** unit legs.

## Alarms across the whole mutated night

**One WARN** — the R-403 skip above. **Zero ERRORs.** Every event pushed was `info`
(`db_dump_completed`, `crossdrive_completed` ×12), all dropped by `severityNotifies`. **No customer
was mailed anything.**

## Half-marks, stated

- The runbook wanted *"the run does not report a plain success"* when a leg is skipped. **The log does
  not** — it states the skip and the reason. **The event does**: `crossdrive_completed (info) —
  Másodlagos mentés elkészült: calibre-web`, no mention of the skipped leg. It is not delivered
  (`info`), so nobody is misled by mail, but an event list would read as a clean completion.
- Two of four injections were not performed; reasons in `03-injections-not-performed.md`.