diff --git a/tools-sync/scripts/gitea_triage.sh b/tools-sync/scripts/gitea_triage.sh
index 7f2f639..a24bc22 100644
--- a/tools-sync/scripts/gitea_triage.sh
+++ b/tools-sync/scripts/gitea_triage.sh
@@ -145,7 +145,18 @@ if [ -n "$PAYLOAD" ]; then
     echo "$PAYLOAD" | sed 's/^/    /'
     [ "$FIX" = 1 ] && { dex "rm -f /tmp/giteahook* /tmp/col_*" >/dev/null 2>&1; fixed payload "removed"; }
 else
-    note payload "none"
+    note payload "none (known names)"
+fi
+# The names change every round (2026-10-01: /data/gitea/home/.pwn + /tmp/.k<pid> binaries,
+# RootHawk-* in /tmp) and the name list above said "none" through all of it. So also look
+# by shape, name-independent. Report only: these are evidence of a compromise, and what to
+# do with a compromised container (rebuild, rotate credentials) is the user's decision.
+DROPS=$(dex "find /tmp -maxdepth 1 -type f -perm -u+x 2>/dev/null | head -20; \
+             ls -A /data/gitea/home 2>/dev/null | grep -Ev '^(\.cache|\.local|\.ssh|\.gitconfig(\..*)?)$' | sed 's|^|/data/gitea/home/|'" \
+        | tr -d '\r' | sed '/^$/d' | grep -v '\.quarantine\.')
+if [ -n "$DROPS" ]; then
+    bad payload "unexpected files (executables in /tmp, strays in gitea HOME) - treat the container as compromised:"
+    echo "$DROPS" | sed 's/^/    /'
 fi
 
 # ---------- F. git binary not shimmed ----------