Campaign 2 — evidence snapshot (2026-07-07)

Raw evidence for ../CAMPAIGN-2-2026-07-07.md (read that first — it triages everything here). Collected from the throwaway harness on DooPlex (~/campaign2-nomercy/); session cookie jars were deleted before commit (no secrets). Times are CEST.

Layout

state/ — run-level artifacts:
- overnight.out — the full run log (every phase, every JOURNAL line, all agent errors).
- journal.tsv — per-test verdicts (incl. the 170 T-SOAK-BREAK-* — all one artifact, H2).
- flightrec.log — 351 samples (~7 h): pct/docker/cc-latency/load/free + the leak sampler (c_rss/c_fd/c_sock controller, a_rss/a_fd/a_sock agent). The leak headline lives here.
- r0_snapshot.txt, p9_restore_snap.txt, d1_gate_ok.
evidence/<TEST-ID>/ — per-test evidence (61 dirs).

The pointers that matter

R1 (headline finding — bind-mount restore needs root): evidence/T-SELFRESTORE/restore-test.out (pass:false, mp8 … only possible for root), evidence/T-DR-BRINGUP/bringup.out (same on the DR path).
R2 (agent VM.Audit/VM.Allocate gaps): same two files (the 403 VM.Audit config-read + the 403 VM.Allocate scratch-teardown lines).
H1 (dominant harness bug — auth-session expiry): evidence/T-STG-ENROLL/init1.txt (CSRF token missing or invalid), evidence/T-RST-VW/{restore_resp.txt,canary_check.txt} (302→login, empty canary).
H3 (D1 not delivered): overnight.out around the [D1] block (sqlite3: … not found).
Positives: evidence/T-PBS-VERIFY/, evidence/T-RESTORE-TEST-CRASH/, evidence/T-FLT-{KILL9,AGENT,CF}/, evidence/T-BAK-FULL/, evidence/T-AUTH-1/, evidence/T-CSRF/.

Verdict in one line

One genuine pilot-critical product finding (R1/R2 — non-root can't restore a bind-mount guest); the rest of the FAIL count is a single dominant harness bug (H1) plus a few calibration issues; the product, where actually exercised, was healthy with zero resource leaks.