diff --git a/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json b/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json
index e48de6d6..63483736 100644
--- a/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json
+++ b/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json
@@ -76,13 +76,24 @@
       "command": "shellcheck on all nine changed shell files",
       "result": "pass",
       "evidence": "ALL CLEAN, no severity filter."
+    },
+    {
+      "command": "source vendor/common.sh in a subshell and inspect stderr (post-push audit)",
+      "result": "fail",
+      "evidence": "Three 'No such file or directory' errors: common.sh sources common_packages.sh, common_services.sh and common_datetime.sh unconditionally, and only common.sh had been vendored. Every suite still passed -- the four functions used are defined above that block, and a failed source of a sibling is non-fatal -- so nothing caught it. Fixed in digital-wellbeing c5eb028 by vendoring all four and adding tests/test_vendor_closure.sh, verified to fail when any sibling is removed."
+    },
+    {
+      "command": "sudo grep -rl 'testsAndMisc/linux_configuration/(scripts|periodic_background)' /etc /usr/local /usr/bin",
+      "result": "pass",
+      "evidence": "Broader than report_live_state.sh, which greps only /usr/local/{bin,lib} plus units and symlinks. Three hits, none from this work: pw_guard.sh names a path that still exists, and /usr/local/bin/dwm-session carries two pre-existing single_use/ paths from the flatten. dwm is dormant (lightdm user-session=i3, no dwm process) and one of its targets no longer exists anywhere -- reported, not changed, since dwm was deliberately abandoned."
     }
   ],
   "risks": [
     "vendor/common.sh duplicates 163 lines of the monorepo lib. The two copies may drift; that is accepted, and the README says so, so a future session does not 're-fix' it by re-coupling the repos.",
     "The pacman wrapper's drift manifest is regenerated by the checker's own fix path. A machine that clones digital-wellbeing to a non-default location must re-run install_pacman_wrapper.sh or the manifest will name the wrong paths.",
     "install_core_system.sh on a fresh machine now hard-stops at three modules until both extracted repos are cloned. Deliberate and loud; INSTALLER_FIX_TASK.md tracks fresh-machine installer defects.",
-    "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning."
+    "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning.",
+    "digital_wellbeing/data/ (2 untracked files) went with the rm -rf. Verified safe to lose: it was never tracked on any historical path, and no script in the unit -- blocker, seeders or libs -- references data/ at all."
   ],
   "rollback": [
     "git revert this commit to restore the unit, the six suites, the two test libs and every rewired caller, and to put --warn back on the depth hook.",