diff --git a/documentation/audits/evidence-chaos-night-2026-09-17/round-3.txt b/documentation/audits/evidence-chaos-night-2026-09-17/round-3.txt
index 12db4dcf..76daeb2c 100644
--- a/documentation/audits/evidence-chaos-night-2026-09-17/round-3.txt
+++ b/documentation/audits/evidence-chaos-night-2026-09-17/round-3.txt
@@ -54,3 +54,18 @@ monitor — but it is the honest answer to „would the household be told?" for
 
 Re-checked at the END of the ten-minute window before this is called final (below), because an alarm
 arriving late is a different finding from an alarm never arriving.
+
+## INTERIM reading at 21:34:23Z — five minutes into the full disk (NOT the end-of-window check)
+I nearly mislabelled this one. The fill began at **21:29:49Z**, so the ten-minute hold runs to
+**~21:39:49Z**; at 21:34:23Z the window was only half over. Recorded as interim, and the
+end-of-window check remains owed rather than quietly satisfied by this reading.
+
+    guest /        32G, **29G used, 1.5G free, 96%**   — still full, fill file still present (28G)
+    thin pool      **39.69%**                          — unchanged, as expected for fallocate
+    writable?      **WRITE OK**
+    containers     **26 running**
+    alarms         newest event still `controller_started` 21:28 — **nothing new fired**
+
+**What that already establishes, independent of how the window ends:** the household's twelve apps
+keep running and serving with the system disk at 96 % full, and after five minutes nobody has been
+told anything. The apps do not fall over; the silence is the finding.