Record the vendor-closure and broad-scan findings in the evidence

Two post-push audits, both worth keeping.

vendor/common.sh sources three sibling libs unconditionally and only common.sh
had been vendored, so every entry point printed three "No such file or
directory" errors. Every suite passed anyway -- the functions in use are
defined above that block and a failed sibling source is non-fatal -- which is
exactly why it needed its own test. Fixed in digital-wellbeing c5eb028.

A grep across /etc, /usr/local and /usr/bin, broader than report_live_state.sh
(which reads only /usr/local/{bin,lib}, units and symlinks), found three
references. None from this work: pw_guard.sh's target still exists, and
dwm-session carries two pre-existing single_use/ paths. dwm is dormant and was
deliberately abandoned, so that one is reported rather than changed.

Also records that digital_wellbeing/data/ was safe to delete: never tracked on
any historical path, and no script in the unit references data/ at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp

docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json

@@ -76,13 +76,24 @@
       "command": "shellcheck on all nine changed shell files",
       "result": "pass",
       "evidence": "ALL CLEAN, no severity filter."
+    },
+    {
+      "command": "source vendor/common.sh in a subshell and inspect stderr (post-push audit)",
+      "result": "fail",
+      "evidence": "Three 'No such file or directory' errors: common.sh sources common_packages.sh, common_services.sh and common_datetime.sh unconditionally, and only common.sh had been vendored. Every suite still passed -- the four functions used are defined above that block, and a failed source of a sibling is non-fatal -- so nothing caught it. Fixed in digital-wellbeing c5eb028 by vendoring all four and adding tests/test_vendor_closure.sh, verified to fail when any sibling is removed."
+    },
+    {
+      "command": "sudo grep -rl 'testsAndMisc/linux_configuration/(scripts|periodic_background)' /etc /usr/local /usr/bin",
+      "result": "pass",
+      "evidence": "Broader than report_live_state.sh, which greps only /usr/local/{bin,lib} plus units and symlinks. Three hits, none from this work: pw_guard.sh names a path that still exists, and /usr/local/bin/dwm-session carries two pre-existing single_use/ paths from the flatten. dwm is dormant (lightdm user-session=i3, no dwm process) and one of its targets no longer exists anywhere -- reported, not changed, since dwm was deliberately abandoned."
     }
   ],
   "risks": [
     "vendor/common.sh duplicates 163 lines of the monorepo lib. The two copies may drift; that is accepted, and the README says so, so a future session does not 're-fix' it by re-coupling the repos.",
     "The pacman wrapper's drift manifest is regenerated by the checker's own fix path. A machine that clones digital-wellbeing to a non-default location must re-run install_pacman_wrapper.sh or the manifest will name the wrong paths.",
     "install_core_system.sh on a fresh machine now hard-stops at three modules until both extracted repos are cloned. Deliberate and loud; INSTALLER_FIX_TASK.md tracks fresh-machine installer defects.",
-    "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning."
+    "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning.",
+    "digital_wellbeing/data/ (2 untracked files) went with the rm -rf. Verified safe to lose: it was never tracked on any historical path, and no script in the unit -- blocker, seeders or libs -- references data/ at all."
   ],
   "rollback": [
     "git revert this commit to restore the unit, the six suites, the two test libs and every rewired caller, and to put --warn back on the depth hook.",