# AMD ASUS XFCE Live USB Hardware Findings **Date:** 25.maj.2026 **Image under test:** Clawdie XFCE operator USB, FreeBSD 15.0-RELEASE amd64 live image **Hardware:** ASUS ZenBook UX325UA_UM325UA, AMD Ryzen 7 5700U **Collection mode:** hardware evidence collection only; no remediation changes were made during collection **Status:** CLOSED as the baseline AMD ASUS evidence record; remediation now continues through tracked commits and `TESTING.md` **Public probe:** `https://bsd-hardware.info/?probe=ca4a7a9032` **Primary purpose:** document the real-hardware state that drove the follow-up fixes ## Scope This report records the findings from the AMD ASUS live-USB validation session. It focuses on the XFCE operator USB runtime experience: boot, graphics, desktop session, input, network, DNS, audio, panel usability, package tooling, and hardware compatibility. The report intentionally separates: - **Confirmed working areas** — hardware paths that are proven functional on the test machine. - **Confirmed defects** — problems observed directly by the operator or supported by logs/config. - **Likely causes / next diagnostics** — hypotheses only, not fixes. No source changes are proposed here. This file is the canonical evidence baseline. Do not append routine retest logs here; use `hw-report`, `TESTING.md`, and commit messages for follow-up validation. ## Test machine summary ```text Vendor/model: ASUS ZenBook UX325UA_UM325UA BIOS: UX325UA.306, 02/19/2025 CPU: AMD Ryzen 7 5700U, 8 cores / 16 threads RAM: 16 GiB GPU: AMD/ATI Lucienne 1002:164c Wi-Fi: Intel Wireless 8265/8275 8086:24fd USB Ethernet: Realtek RTL8153 0bda:8153 USB media: Patriot/Phison 13fe:5500, serial 070167D53739AE32 ``` ## Executive summary The live image boots successfully and reaches a working SDDM/XFCE session on real AMD hardware. AMD KMS, Xorg acceleration, Vulkan hardware enumeration, USB Ethernet, webcam detection, and the no-blank power policy are all confirmed working. The main defects found during this pass are: 1. **Critical DNS bug:** `/etc/resolv.conf` points to a missing temporary installer path, breaking resolver-dependent tools until manually repaired. 2. **Touchpad functional bug:** the ASUE140A touchpad is detected by kernel, evdev, libinput, and Xorg, but the operator reports it does not function in the desktop. 3. **XFCE panel visual regressions:** missing launcher/start icons, language switcher shows text instead of a flag/icon and is too large, network tray icon is barely visible, and the panel remains too large. 4. **Audio default is wrong:** HDMI audio is selected as default while the internal Realtek speaker exists; the panel mixer is also pinned to the HDMI sound card. 5. **Boot branding is wrong:** loader text still says installer instead of operator/live USB. 6. **Package tooling has live-image issues:** pkg DB/libpkg version mismatch, missing vuln DB for `pkg audit`, and repo URL behavior warning. 7. **ASUS ACPI/WMI failures/noise:** firmware and `acpi_asus_wmi` errors appear in logs. 8. **Minor Xorg warnings:** missing standard font directories and an AMDGPU page-flip warning were observed. ## Severity classification | Severity | Area | Finding | Impact | | ---------- | --------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------- | | Critical | DNS | `/etc/resolv.conf` symlink targets missing `/tmp/bsdinstall_etc/resolv.conf` | Network has IP/route but name resolution fails | | High | Input | Touchpad detected but not usable | Laptop requires USB mouse | | High | Desktop UX | Panel icons/start/language/network visuals broken | First-run GUI looks incomplete and harder to operate | | Medium | Audio | HDMI selected instead of internal speaker | Sound likely absent/wrong by default | | Medium | Boot UX | Loader labels say Installer | Product polish/regression | | Medium | Package tooling | `pkg audit`/repo/version warnings | Operator diagnostics and updates are confusing | | Low/Medium | Firmware | ASUS ACPI/WMI errors | Noise; may affect hotkeys/power/platform features | | Low | Xorg | font path warnings, page flip warning | Needs watch, not currently blocking desktop | ## Confirmed working areas ### Boot and session startup SDDM starts and authenticates the live `clawdie` user. ```text sddm is running as pid 4537 Authentication for user "clawdie" successful Session started true ``` ### Live USB storage layout The USB layout matches the intended live media structure, including the fixed 64 MiB seed partition. ```text da0 MBR 30G da0s1 msdosfs/EFISYS 64M da0s2 ufs/FreeBSD_Install mounted / da0s3 msdosfs/CLAWDIESEED 64M 1.5G free tail ``` Root and temporary filesystem policy are also confirmed: ```text /dev/ufs/FreeBSD_Install on / (ufs, local, noatime, soft-updates) tmpfs on /tmp tmpfs on /var/log ``` This matches the intended policy: no USB swap, temporary logs on tmpfs, and persistent `/var/tmp` outside the transient tmpfs log path. ### AMD graphics: kernel, Xorg, and Vulkan Kernel/DRM evidence confirms `amdgpu` is active and replaced EFI framebuffer with DRM framebuffer. ```text amdgpu loaded drmfb replaced efifb framebuffer 1920x1080x32 /dev/dri/card0 -> ../drm/0 /dev/dri/renderD128 -> ../drm/128 hw.dri.0.name: amdgpu hw.dri.0.modesetting: 1 ``` Xorg selects the AMDGPU driver and enables acceleration: ```text X.Org X Server 1.21.1.22 Current Operating System: FreeBSD clawdie-live 15.0-RELEASE FreeBSD 15.0-RELEASE releng/15.0-n280995-7aedc8de6446 GENERIC amd64 ``` ```text (II) Applying OutputClass "AMDgpu" to /dev/dri/card0 loading driver: amdgpu (==) Matched amdgpu as autoconfigured driver 0 (II) LoadModule: "amdgpu" (II) Loading /usr/local/lib/xorg/modules/drivers/amdgpu_drv.so ``` ```text (--) AMDGPU(0): Chipset: "AMD Radeon Graphics" (ChipID = 0x164c) (II) AMDGPU(0): glamor: Using OpenGL 4.6 context. (II) AMDGPU(0): glamor X acceleration enabled on AMD Radeon Graphics (radeonsi, renoir, LLVM 19.1.7, DRM 3.54, 15.0-RELEASE) (II) AMDGPU(0): [DRI2] Setup complete (==) AMDGPU(0): DRI3 enabled (II) AMDGPU(0): Direct rendering enabled (II) AMDGPU(0): Acceleration enabled ``` Vulkan hardware enumeration also works: ```text AMD Radeon Graphics (RADV RENOIR) vendorID 0x1002 deviceID 0x164c driverName radv Mesa 24.1.7 ``` ### Display layout during test The test environment had both external HDMI and internal eDP connected. Xorg used a spanning desktop. ```text (II) AMDGPU(0): Output HDMI-A-0 connected (II) AMDGPU(0): Output eDP connected (II) AMDGPU(0): Output DisplayPort-0 disconnected (II) AMDGPU(0): Output DisplayPort-1 disconnected (II) AMDGPU(0): Using spanning desktop for initial modes (II) AMDGPU(0): Output HDMI-A-0 using initial mode 1920x1080 +0+0 (II) AMDGPU(0): Output eDP using initial mode 1920x1080 +1920+0 ``` This matters for panel debugging because the panel position is configured at `p=10;x=0;y=0`, which likely places it on the leftmost HDMI output during this test. ### USB Ethernet USB Ethernet works at link, IP, and routing level. ```text ue0 192.168.1.7/24 default route 192.168.1.1 via ue0 media 1000baseT full-duplex ``` This proves the main network path can come up; the DNS failure is separate from link/IP/routing. ### Webcam The internal webcam is exposed as video devices. ```text /dev/video0 /dev/video1 USB2.0 HD UVC WebCam ``` ### Power/no-blank policy The live desktop no-blank policy is active at Xorg and session level. Xorg config present: ```text Section "ServerFlags" Option "BlankTime" "0" Option "StandbyTime" "0" Option "SuspendTime" "0" Option "OffTime" "0" EndSection ``` Session state from `xset q`: ```text Screen Saver: prefer blanking: no allow exposures: yes timeout: 0 cycle: 600 DPMS (Display Power Management Signaling): Standby: 0 Suspend: 0 Off: 0 DPMS is Disabled ``` Power service evidence: ```text hw.acpi.acline: 1 hw.acpi.cpu.cx_lowest: C3 powerdxx is running as pid 4402 ``` ## Detailed defects and evidence ## Finding 1: DNS resolver file is broken **Severity:** Critical The live image receives a working IP address and default route, but DNS fails because `/etc/resolv.conf` points to a missing temporary installer path. Evidence: ```text /etc/resolv.conf -> /tmp/bsdinstall_etc/resolv.conf avahi-daemon[4436]: Failed to open /etc/resolv.conf: No such file or directory ``` Operator workaround: ```text rm /etc/resolv.conf cat > /etc/resolv.conf nameserver 192.168.1.1 ``` Impact: - Network link appears up, but name resolution fails. - Browser, package tools, diagnostics, and any network setup relying on DNS can fail or appear flaky. - This is likely a live-image construction/runtime cleanup issue, not an Ethernet driver issue. Important distinction: ```text ue0 192.168.1.7/24 default route 192.168.1.1 via ue0 ``` The route and interface are correct; resolver file handling is the bug. ## Finding 2: Touchpad is detected but not functional in XFCE **Severity:** High The operator reports the built-in touchpad does not work in the desktop and a USB mouse is required. Kernel/device evidence: ```text hmt0: ASUE140A:08 04F3:3134 TouchPad /dev/input/event8 ``` Xorg sees and attaches the device through libinput: ```text (II) config/udev: Adding input device ASUE140A:08 04F3:3134 TouchPad (/dev/input/event8) (**) ASUE140A:08 04F3:3134 TouchPad: Applying InputClass "libinput pointer catchall" (**) ASUE140A:08 04F3:3134 TouchPad: Applying InputClass "libinput touchpad catchall" (II) Using input driver 'libinput' for 'ASUE140A:08 04F3:3134 TouchPad' (**) ASUE140A:08 04F3:3134 TouchPad: always reports core events (**) Option "Device" "/dev/input/event8" (II) event8 - ASUE140A:08 04F3:3134 TouchPad: is tagged by udev as: Mouse Touchpad (II) event8 - ASUE140A:08 04F3:3134 TouchPad: device is a touchpad (II) XINPUT: Adding extended input device "ASUE140A:08 04F3:3134 TouchPad" (type: TOUCHPAD, id 13) ``` The related ASUE140A mouse interface is also attached: ```text (II) config/udev: Adding input device ASUE140A:08 04F3:3134 Mouse (/dev/input/event7) (II) XINPUT: Adding extended input device "ASUE140A:08 04F3:3134 Mouse" (type: MOUSE, id 12) ``` No custom touchpad override was present in the Xorg snippets: ```text /usr/local/share/X11/xorg.conf.d/40-libinput.conf libinput touchpad catchall ``` Relevant config: ```text Section "InputClass" Identifier "libinput touchpad catchall" MatchIsTouchpad "on" MatchDevicePath "/dev/input/event*" Driver "libinput" EndSection ``` Interpretation: - This is not a simple “Xorg did not see the touchpad” problem. - The touchpad is detected by kernel/evdev/libinput/Xorg and assigned an XInput device. - The failure is likely in one of these areas: - XFCE pointer settings disabled the device after Xorg attached it. - XInput device property `Device Enabled` is off. - The touchpad emits no events despite being registered. - The ASUE140A mouse/touchpad split causes event routing confusion. - Palm/disable-while-typing state is stuck. Next diagnostics for the fix pass: ```text xinput list xinput list-props 13 xinput test 13 xfconf-query -c pointers -lv libinput debug-events --device /dev/input/event8 ``` ## Finding 3: XFCE panel visual regressions **Severity:** High Operator-observed issues: ```text - Panel has missing icons. - Some launchers/items show only dots instead of icons. - Start button / Whisker menu is missing its icon. - Language switcher displays text "si" / "en" instead of a flag/icon. - Language switcher is still too large. - Network icon is barely visible. - Panel is still too large. ``` Live panel config: ```xml ``` Plugin order: ```xml ``` Mapped plugin list: ```text 1 whiskermenu 2 firefox launcher 3 pcmanfm launcher 4 xfce4-terminal launcher 5 separator 6 tasklist 7 expanding separator 8 systray 9 cpugraph 11 mixer 10 xkb 12 clock ``` ### Start/Whisker menu icon Config says the start button should show both title and icon: ```xml ``` Observed result: the start icon is missing. Likely checks for the fix pass: ```text ls -l /usr/local/share/clawdie-iso/icons/clawdie-start.png file /usr/local/share/clawdie-iso/icons/clawdie-start.png pngcheck /usr/local/share/clawdie-iso/icons/clawdie-start.png xfconf-query -c xfce4-panel -p /plugins/plugin-1 -lv ``` A likely design question is whether Whisker reliably accepts an absolute PNG path in this property on the FreeBSD/XFCE version in the image, or whether it expects an icon theme name. ### Launcher icons Launcher config: ```xml ``` Observed result: some panel items show as dots/missing icons. Relevant theme config: ```xml ``` Likely checks for the fix pass: ```text find ~/.config/xfce4/panel -maxdepth 3 -type f -print -exec cat {} \; grep -R '^Icon=' ~/.config/xfce4/panel /usr/local/share/applications /usr/share/applications ls /usr/local/share/icons /usr/share/icons gtk-update-icon-cache status for Papirus/hicolor ``` ### Language switcher Keyboard layout is correctly configured as Slovenian + US: ```text Section "InputClass" Identifier "keyboard-all" MatchIsKeyboard "on" Option "XkbLayout" "si,us" Option "XkbVariant" "," Option "XkbOptions" "grp:alt_shift_toggle,grp_led:scroll" EndSection ``` Xorg applies it: ```text (**) Option "xkb_layout" "si,us" (**) Option "xkb_variant" "," (**) Option "xkb_options" "grp:alt_shift_toggle,grp_led:scroll" ``` Panel XKB plugin config: ```xml ``` Observed result: language switcher displays text `si` / `en`, is too large, and does not show the desired flag/icon. Interpretation: - The layout stack works enough to expose `si,us` and XKB group state. - The problem is likely the XKB plugin display mode, flags availability, or panel sizing/icon theme interaction. `xset q` shows the group indicator exists: ```text XKB indicators: 12: Group 2: off ``` ### Network tray icon Systray config: ```xml ``` Observed result: network icon is barely visible. Likely causes to inspect later: - tray icon contrast against translucent dark panel background, - icon theme mismatch, - legacy tray item rendering, - panel icon size interaction, - NetworkMgr icon asset selection. ### Panel size and clock size Panel size is currently 48 px: ```xml ``` Clock font is large: ```xml ``` Observed result: panel remains too large. Likely fix-pass areas: - panel `size`, - panel `icon-size`, - XKB plugin display mode, - clock font/layout, - CPU graph size, - Whisker title/icon behavior. ## Finding 4: Default audio device is HDMI, not internal speaker **Severity:** Medium Audio device summary from collection: ```text pcm0: ATI R6xx (HDMI) default pcm3: Realtek ALC294 Internal Analog Speaker hw.snd.default_unit: 0 ``` Panel mixer config also targets HDMI: ```xml ``` Impact: - On a laptop, the expected default is internal speaker/headphone output, not HDMI. - The panel mixer may control the wrong card. - If no HDMI audio sink is active or desired, users may think sound is broken. Important context: - During this test an external HDMI display was connected. - FreeBSD chose HDMI as default unit 0. - The internal speaker exists as `pcm3`. Likely fix-pass areas: ```text sysctl hw.snd.default_unit /etc/sysctl.conf or live-session runtime selection mixer/virtual_oss strategy if used later XFCE mixer plugin card binding ``` ## Finding 5: Boot branding still says Installer **Severity:** Medium Evidence: ```text loader_brand="install" loader_menu_multi_user_prompt="Installer" ``` Impact: - The USB is now an operator live image, not only an installer. - Installer branding at boot makes the artifact look unfinished or wrong. This is a boot UX/polish issue, not a boot blocker. ## Finding 6: Package tooling issues in live image **Severity:** Medium Evidence: ```text pkg: warning: database version 38 is newer than libpkg(3) version 37, but still compatible pkg audit: vulnxml file vuln.xml does not exist. Try running 'pkg audit -F' first pkg version: pkg+https://... -- pkg+:// implies SRV mirror type ``` Impact: - Operator diagnostics are noisy or fail. - `pkg audit` is not useful until vuln DB is fetched. - pkg DB/libpkg mismatch suggests package manager/runtime library version skew in the image. - Repo URL syntax may confuse `pkg version`/repository behavior. Likely fix-pass areas: ```text pkg bootstrap/version alignment in build image repo config URL syntax whether vuln.xml should be preseeded in live image whether pkg audit should be documented as requiring network + pkg audit -F ``` ## Finding 7: ASUS ACPI/WMI errors **Severity:** Low/Medium Evidence: ```text Firmware Error (ACPI): Could not resolve symbol [\_SB.PCI0.GPP1.WLAN], AE_NOT_FOUND Firmware Error (ACPI): AE_AML_BUFFER_LIMIT acpi_asus_wmi0: Can not detect DSTS method ID device_attach: acpi_asus_wmi0 attach returned 22 ``` Impact: - These errors did not prevent boot, Xorg, GPU acceleration, or USB Ethernet. - They may affect ASUS-specific WMI features such as hotkeys, platform controls, or wireless toggles. - They add noise to logs and may confuse hardware report readers. Current status: document and monitor; do not treat as primary blocker unless tied to a real user-visible failure. ## Finding 8: Xorg warnings and page-flip warning **Severity:** Low for now Missing font path directories: ```text (WW) The directory "/usr/local/share/fonts/misc/" does not exist. (WW) The directory "/usr/local/share/fonts/TTF/" does not exist. (WW) The directory "/usr/local/share/fonts/OTF/" does not exist. (WW) The directory "/usr/local/share/fonts/Type1/" does not exist. (WW) The directory "/usr/local/share/fonts/100dpi/" does not exist. (WW) The directory "/usr/local/share/fonts/75dpi/" does not exist. (==) FontPath set to: catalogue:/usr/local/etc/X11/fontpath.d ``` AMDGPU page flip warning: ```text (WW) AMDGPU(0): flip queue failed: Invalid argument (WW) AMDGPU(0): Page flip failed: Invalid argument ``` Interpretation: - The font warnings are common when legacy font dirs are absent and may not cause the panel icon issue, because icon rendering uses icon themes rather than these X font dirs. - The page-flip warning occurred after the desktop was already running. It should be tracked, especially in dual-display mode, but it is not currently a hard graphics failure. ## Full XFCE config snapshot highlights ### Desktop background ```xml ``` ### Desktop menus ```xml ``` ### Window manager ```xml ``` ### GTK/icon/cursor theme ```xml ``` ### Power manager ```xml ``` ## Xorg configuration snapshot ### Keyboard config ```text /usr/local/etc/X11/xorg.conf.d/30-keyboard.conf ``` ```text Section "InputClass" Identifier "keyboard-all" MatchIsKeyboard "on" Option "XkbLayout" "si,us" Option "XkbVariant" "," Option "XkbOptions" "grp:alt_shift_toggle,grp_led:scroll" EndSection ``` ### No-blank config ```text /usr/local/etc/X11/xorg.conf.d/40-clawdie-noblank.conf ``` ```text Section "ServerFlags" Option "BlankTime" "0" Option "StandbyTime" "0" Option "SuspendTime" "0" Option "OffTime" "0" EndSection ``` ### AMDGPU config ```text /usr/local/share/X11/xorg.conf.d/10-amdgpu.conf ``` ```text Section "OutputClass" Identifier "AMDgpu" MatchDriver "amdgpu" Driver "amdgpu" EndSection ``` ### Libinput config ```text /usr/local/share/X11/xorg.conf.d/40-libinput.conf ``` ```text Section "InputClass" Identifier "libinput pointer catchall" MatchIsPointer "on" MatchDevicePath "/dev/input/event*" Driver "libinput" EndSection Section "InputClass" Identifier "libinput touchpad catchall" MatchIsTouchpad "on" MatchDevicePath "/dev/input/event*" Driver "libinput" EndSection ``` ## Additional observations ### No per-user Xorg logs No logs were found under the user-local Xorg path: ```text /home/clawdie/.local/share/xorg/Xorg.*.log* ``` The useful Xorg evidence came from: ```text /var/log/Xorg.0.log ``` Because `/var/log` is tmpfs in the live image, hardware reports should copy these logs before shutdown. ### Dual-display context may affect panel perception The test used HDMI plus the internal panel: ```text Output HDMI-A-0 using initial mode 1920x1080 +0+0 Output eDP using initial mode 1920x1080 +1920+0 ``` Panel config: ```xml ``` This means panel placement and visual size should be validated on: - internal-only boot, - HDMI-only/external-primary scenario, - dual-display spanning scenario. ## Recommended next diagnostic commands before fixes These are not remediation commands; they are evidence commands for the next pass. ### DNS ```sh ls -l /etc/resolv.conf readlink /etc/resolv.conf ls -ld /tmp/bsdinstall_etc cat /etc/resolv.conf service netif status service routing status ``` ### Touchpad ```sh xinput list xinput list-props 13 xinput test 13 xfconf-query -c pointers -lv libinput debug-events --device /dev/input/event8 ``` ### Panel icons/theme ```sh ls -l /usr/local/share/clawdie-iso/icons/clawdie-start.png file /usr/local/share/clawdie-iso/icons/clawdie-start.png find /home/clawdie/.config/xfce4/panel -maxdepth 4 -type f -print -exec cat {} \; grep -R '^Icon=' /home/clawdie/.config/xfce4/panel /usr/local/share/applications /usr/share/applications ls /usr/local/share/icons ls /usr/share/icons ``` ### XKB/language switcher ```sh xfconf-query -c xfce4-panel -p /plugins/plugin-10 -lv setxkbmap -query xkbcomp -xkb "$DISPLAY" - ``` ### Audio ```sh cat /dev/sndstat sysctl hw.snd.default_unit mixer -f /dev/mixer0 mixer -f /dev/mixer3 xfconf-query -c xfce4-panel -p /plugins/plugin-11 -lv ``` ### Display/panel placement ```sh xrandr --query xfconf-query -c xfce4-panel -p /panels/panel-1 -lv ``` ## Follow-up live XFCE command evidence — 01.jun.2026 After the report archive was collected, the operator ran direct `xfconf-query` checks in the live XFCE session before rebooting. Confirmed good state: - `xsettings` had `Greybird`, `Papirus`, `DMZ-White`, `Noto Sans 11`, and `Hack 11`; global GTK/icon/cursor/font configuration is loading. - `xfce4-desktop` had `image-show=true`, `image-style=5`, and `last-image=/usr/local/share/clawdie-iso/wallpapers/clawdie-operator-bg.png`; the wallpaper config and image file exist. - `xfce4-panel` had the intended panel size, opacity, plugin order, and launcher entries; the panel seed is loading. Confirmed problem state: - The shipped live image only had `clawdie-start` under `/usr/local/share/clawdie-iso/icons/`; `find /usr/local/share/icons -name 'clawdie-start*'` returned nothing until the operator manually copied the icon into `hicolor` and rebuilt the cache. - The Whisker button still did not visibly change during that live-session test, so the next build should stage the icon in the theme at build time and verify real first-login behavior rather than relying on hot panel reloads. - `xfce4-mixer` auto-selected `ATIR6xxHDMI`/`Vol` even though FreeBSD selected the internal Realtek speaker as the default device. The default panel should not ship a mixer plugin that controls HDMI on AMD laptops. ## Fix-planning backlog derived from this report This is a backlog only; solutions should be discussed separately. 1. Repair live `/etc/resolv.conf` handling so DNS works after boot. 2. Determine why XInput/libinput touchpad is detected but ineffective. 3. Restore reliable XFCE panel icon rendering. 4. Restore Whisker/start icon. 5. Make XKB/language switcher use compact flag/icon display or another compact visual mode. 6. Reduce panel footprint. 7. Improve network tray icon visibility. 8. Select internal audio by default when present, or avoid pinning the panel mixer to HDMI. 9. Update boot loader branding from installer to operator/live USB wording. 10. Resolve or document pkg DB/libpkg, repo URL, and vuln DB behavior. 11. Decide whether ASUS ACPI/WMI errors need mitigation or only documentation. 12. Track AMDGPU page-flip warning in dual-display testing. ## Conclusion The AMD ASUS validation pass is successful for the major hardware-enablement goal: the image boots to XFCE on real AMD hardware with accelerated graphics, working USB Ethernet, detected webcam, functional SDDM login, and no-blank power behavior. The image is not yet polished enough for release-quality operator use. The most urgent issues are resolver setup, touchpad usability, and XFCE panel/icon regressions. These are now documented with enough evidence to plan a targeted remediation pass without guessing from static image inspection alone.