diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 8f7fced..9cb6162 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -26,24 +26,24 @@ When generating code for this repository:
 ## Project Structure
 
 ```
-evidence/                  # Repository root (install to plugins/evidence/ in Cacti)
+evidence/               # Repository root (install to plugins/evidence/ in Cacti)
 ├── include/
-│   ├── functions.php       # Core polling, display and hook logic
-│   ├── database.php        # Table creation and upgrade logic
-│   ├── settings.php        # Plugin config_settings hook
-│   ├── arrays.php          # Configuration arrays (entities, datatypes)
-│   └── index.php           # Access protection
-├── data/                   # SQL seed data (enterprise-numbers.sql) and prep scripts
-├── images/                 # Tab icons and UI images
-├── evidence.php             # Main standalone/console page
-├── evidence_tab.php         # Device tab integration page
+│   ├── functions.php   # Core polling, display and hook logic
+│   ├── database.php    # Table creation and upgrade logic
+│   ├── settings.php    # Plugin config_settings hook
+│   ├── arrays.php      # Configuration arrays (entities, datatypes)
+│   └── index.php       # Access protection
+├── data/               # SQL seed data (enterprise-numbers.sql) and prep scripts
+├── images/             # Tab icons and UI images
+├── evidence.php        # Main standalone/console page
+├── evidence_tab.php    # Device tab integration page
 ├── js/
-│   └── evidence.js           # Client-side JS for device edit page
-├── poller_evidence.php       # Background poller entry point (CLI)
-├── setup.php                 # Plugin install/uninstall/upgrade hooks
-├── INFO                      # Plugin metadata (name, version, compat)
-├── README.md                  # Feature overview, installation and usage
-└── CHANGELOG.md               # Version history
+│   └── evidence.js     # Client-side JS for device edit page
+├── poller_evidence.php # Background poller entry point (CLI)
+├── setup.php           # Plugin install/uninstall/upgrade hooks
+├── INFO                # Plugin metadata (name, version, compat)
+├── README.md           # Feature overview, installation and usage
+└── CHANGELOG.md        # Version history
 ```
 
 ## Naming Conventions
@@ -427,3 +427,7 @@ existing code or adding new code, not just in dedicated cleanup passes:
   line, `@param` lines, a blank comment line, then `@return`. Infer parameter/return types from
   actual usage; don't change the function's real type-hints in the same pass (let static analysis
   flag mismatches separately). Skip vendored third-party library files.
+
+## File manifest & upgrade pruning
+
+The plugin ships a root `manifest.json` with three arrays: `tombstones` (files/directories older versions shipped that have since moved or been removed), `expected` (the top-level files and directories that ship today, directories written with a trailing `/`), and `whitelist` (paths holding user data that must never be touched). Keep `expected` current: CI runs `tests/bin/validate-manifest.php`, which fails on any drift between `expected` and the real top-level tree (it ignores `tests/`, `phpunit.xml`, `.git*`, `.md*`, and whitelisted paths). Custom customer CSS/theme files belong in `expected`, and stylesheets live in `css/` (not `themes/`). On upgrade, `evidence_prune_files()` deletes the tombstoned paths, the dev-only `tests/` tree, and the `phpunit.xml` test config, leaves `whitelist`, `.git*`, and `.md*` alone, and logs (without removing) any top-level entry the manifest does not account for. As a safety measure it refuses any tombstone that resolves outside the plugin directory (a tampered manifest.json) and logs a warning for any file or directory it cannot remove. When you move or delete a shipped file, add its old path to `tombstones` and update `expected` in the same change.
diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 41a3ad9..200d7c1 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -88,6 +88,9 @@ jobs:
     - name: Check PHP version
       run: php -v
 
+    - name: Validate plugin manifest (expected-file drift)
+      run: php cacti/plugins/evidence/tests/bin/validate-manifest.php
+
     - name: Run apt-get update
       run: sudo apt-get update
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d20474..67d569e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Changelog
 
 --- develop ---
+* dev: Move the plugin's library directory from `include/` to `includes/` and re-register the affected hooks on upgrade (via a `plugin_hooks` file repoint in `plugin_evidence_upgrade_database()`) so existing installations load them from the new path
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
 * security: Add a version-safe CSP nonce (`plugin_evidence_csp_nonce()`) to every inline `<script>` tag so pages stay compatible with Cacti's Content-Security-Policy nonce enforcement, while falling back cleanly on older Cacti releases that lack the `CactiSecureHeaders` class
diff --git a/evidence.php b/evidence.php
index ef6177c..15299f1 100644
--- a/evidence.php
+++ b/evidence.php
@@ -25,9 +25,9 @@
 */
 
 chdir('../../');
-include_once('./include/auth.php');
-include_once('./lib/snmp.php');
-include_once('./plugins/evidence/include/functions.php');
+require_once('./include/auth.php');
+require_once('./lib/snmp.php');
+require_once('./plugins/evidence/includes/functions.php');
 
 $evidence_records = read_config_option('evidence_records');
 
diff --git a/evidence_tab.php b/evidence_tab.php
index a6a77cd..57d7b80 100644
--- a/evidence_tab.php
+++ b/evidence_tab.php
@@ -25,10 +25,10 @@
 */
 
 chdir('../../');
-include_once('./include/auth.php');
-include_once('./lib/snmp.php');
-include_once('./plugins/evidence/include/functions.php');
-include_once('./plugins/evidence/include/arrays.php');
+require_once('./include/auth.php');
+require_once('./lib/snmp.php');
+require_once('./plugins/evidence/includes/functions.php');
+require_once('./plugins/evidence/includes/arrays.php');
 
 set_default_action();
 
diff --git a/include/arrays.php b/includes/arrays.php
similarity index 100%
rename from include/arrays.php
rename to includes/arrays.php
diff --git a/include/database.php b/includes/database.php
similarity index 97%
rename from include/database.php
rename to includes/database.php
index e3e0b26..04e580b 100644
--- a/include/database.php
+++ b/includes/database.php
@@ -39,7 +39,7 @@ function plugin_evidence_initialize_database() {
 	$data              = [];
 	$data['columns'][] = ['name' => 'id', 'type' => 'int(11)', 'NULL' => false];
 	$data['columns'][] = ['name' => 'organization', 'type' => 'varchar(200)', 'NULL' => false];
-	$data['primary']   = 'id';
+	$data['primary']   = ['id'];
 	$data['type']      = 'InnoDB';
 	$data['comment']   = 'evidence organizations';
 	api_plugin_db_table_create('evidence', 'plugin_evidence_organization', $data);
@@ -65,7 +65,7 @@ function plugin_evidence_initialize_database() {
 	$data['columns'][] = ['name' => 'method', 'type' => 'enum("get", "walk", "info", "table")', 'default' => 'get', 'NULL' => false];
 	$data['columns'][] = ['name' => 'table_items', 'type' => 'varchar(100)', 'default' => null, 'NULL' => true];
 	$data['columns'][] = ['name' => 'mandatory', 'type' => 'enum("yes","no")', 'default' => 'yes', 'NULL' => false];
-	$data['primary']   = 'id';
+	$data['primary']   = ['id'];
 	$data['type']      = 'InnoDB';
 	$data['comment']   = 'evidence specific';
 	api_plugin_db_table_create('evidence', 'plugin_evidence_specific_query', $data);
@@ -313,6 +313,12 @@ function plugin_evidence_upgrade_database() {
 			api_plugin_db_table_create('evidence', 'plugin_evidence_snmp_info', $data);
 		}
 
+		// The plugin's library directory moved from include/ to includes/; repoint
+		// any hook still registered against the old path so existing installs load
+		// them from the new location after upgrade.
+		db_execute("UPDATE plugin_hooks SET file = REPLACE(file, 'include/', 'includes/') WHERE name = 'evidence' AND file LIKE 'include/%'");
+			// Remove files tombstoned in manifest.json (the old include/ tree).
+			evidence_prune_files();
 		// Set the new version
 		db_execute_prepared("UPDATE plugin_config
 			SET version = ?, author = ?, webpage = ?
diff --git a/include/functions.php b/includes/functions.php
similarity index 99%
rename from include/functions.php
rename to includes/functions.php
index d9d4dd5..d4be44d 100644
--- a/include/functions.php
+++ b/includes/functions.php
@@ -127,7 +127,7 @@ function plugin_evidence_host_edit_bottom() {
 	print get_md5_include_js($config['base_path'] . '/plugins/evidence/js/evidence.js');
 
 	if (read_config_option('evidence_show_host_data')) {
-		include_once('./plugins/evidence/include/functions.php');
+		include_once('./plugins/evidence/includes/functions.php');
 		print '<br/><br/>';
 
 		$host = db_fetch_row_prepared('SELECT host.*, host_template.name as `template_name`
@@ -1671,7 +1671,7 @@ function evidence_show_host_data($host_id, $scan_date) {
 function evidence_show_host_info($data, $host_id) {
 	global $config, $datatypes;
 
-	include_once($config['base_path'] . '/plugins/evidence/include/arrays.php');
+	include_once($config['base_path'] . '/plugins/evidence/includes/arrays.php');
 
 	$short = false;
 
@@ -1817,7 +1817,7 @@ function evidence_show_host_info($data, $host_id) {
 function evidence_show_actual_data($data) {
 	global $config, $datatypes;
 
-	include_once($config['base_path'] . '/plugins/evidence/include/arrays.php');
+	include_once($config['base_path'] . '/plugins/evidence/includes/arrays.php');
 
 	if (isset($data['org_name'])) {
 		print $data['org_name'];
diff --git a/include/settings.php b/includes/settings.php
similarity index 100%
rename from include/settings.php
rename to includes/settings.php
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 7752411..7b47254 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti \n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-09-28 16:05-0400\n"
+"POT-Creation-Date: 2026-09-30 11:26-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -25,7 +25,7 @@ msgstr ""
 msgid "Show older records"
 msgstr ""
 
-#: evidence.php include/functions.php
+#: evidence.php includes/functions.php
 msgid "History data store disabled"
 msgstr ""
 
@@ -33,7 +33,7 @@ msgstr ""
 msgid "Permission issue"
 msgstr ""
 
-#: evidence_tab.php include/functions.php
+#: evidence_tab.php includes/functions.php
 msgid "Evidence"
 msgstr ""
 
@@ -163,221 +163,221 @@ msgstr ""
 msgid "Expand latest date"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Description"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Name"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Hardware revision"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Firmware revision"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Software revision"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Serial number"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Manufacturer name"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Model name"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Alias"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Asset ID"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Manufacturing date"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "UUID"
 msgstr ""
 
-#: include/arrays.php include/functions.php
+#: includes/arrays.php includes/functions.php
 msgid "SNMP info"
 msgstr ""
 
-#: include/arrays.php include/functions.php
+#: includes/arrays.php includes/functions.php
 msgid "Entity MIB"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Mac addresses"
 msgstr ""
 
-#: include/arrays.php include/functions.php
+#: includes/arrays.php includes/functions.php
 msgid "IP addresses"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Vendor specific data"
 msgstr ""
 
-#: include/arrays.php
+#: includes/arrays.php
 msgid "Vendor optional data"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Data"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Store history is not allowed. Nothing to do."
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Not found"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Also show actual data"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "ID ORG"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "No older data yet"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Entity"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "MAC addresses"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Vendor specific"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Actual data"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Changed"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "SNMP information"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Vendor specific information"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Vendor optional information"
 msgstr ""
 
-#: include/functions.php
+#: includes/functions.php
 msgid "Show only first 3 items, for the full listing click here"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "How often gather data"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "If enabled, Evidence will gather data periodically. If disabled, you can only view data for specific host"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Disabled"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 #, php-format
 msgid "Every %d hours"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Every day"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Every week"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "When evidence will be started"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "The Base Time for gather data to occur.  For example, if you use '12:00am' and you choose once per day, the action would begin at approximately midnight every day."
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "How many changes store in database"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "If data gathering is enabled,  you can specify how many history (changed) records keep for each device"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Without history"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 #, php-format
 msgid "%d record"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 #, php-format
 msgid "%d records"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Display information on device edit page"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "If enabled, flowview will display evidence data on device edit page"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Send email on evidence information change"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "If evidence find change, send email"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Excluded notification Host IDs"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Some devices report hw changes too often. You can exclude these host from email notification. Insert Host IDs, comma separator"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Excluded notification device templates"
 msgstr ""
 
-#: include/settings.php
+#: includes/settings.php
 msgid "Some devices types report hw changes too often. You can exclude these templates from email notification. Insert device templates IDs, comma separator"
 msgstr ""
diff --git a/manifest.json b/manifest.json
new file mode 100644
index 0000000..9b5816d
--- /dev/null
+++ b/manifest.json
@@ -0,0 +1,23 @@
+{
+    "tombstones": [
+        "include/"
+    ],
+    "expected": [
+        "CHANGELOG.md",
+        "INFO",
+        "LICENSE",
+        "README.md",
+        "data/",
+        "evidence.php",
+        "evidence_tab.php",
+        "images/",
+        "includes/",
+        "index.php",
+        "js/",
+        "locales/",
+        "manifest.json",
+        "poller_evidence.php",
+        "setup.php"
+    ],
+    "whitelist": []
+}
diff --git a/phpunit.xml b/phpunit.xml
index 1fa9487..9cb8e1e 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -28,8 +28,8 @@
     <source>
         <include>
             <file>setup.php</file>
-            <file>include/database.php</file>
-            <file>include/functions.php</file>
+            <file>includes/database.php</file>
+            <file>includes/functions.php</file>
         </include>
     </source>
 </phpunit>
diff --git a/poller_evidence.php b/poller_evidence.php
index 22e9ec9..dd024c4 100644
--- a/poller_evidence.php
+++ b/poller_evidence.php
@@ -27,9 +27,9 @@
 $dir = __DIR__;
 chdir($dir);
 
-include('../../include/cli_check.php');
-include_once($config['library_path'] . '/snmp.php');
-include_once($config['base_path'] . '/plugins/evidence/include/functions.php');
+require('../../include/cli_check.php');
+require_once($config['library_path'] . '/snmp.php');
+require_once($config['base_path'] . '/plugins/evidence/includes/functions.php');
 
 // let PHP run just as long as it has to
 ini_set('max_execution_time', '0');
@@ -636,7 +636,7 @@ function display_version() {
 	global $config;
 
 	if (!function_exists('plugin_evidence_version')) {
-		include_once($config['base_path'] . '/plugins/evidence/setup.php');
+		require_once($config['base_path'] . '/plugins/evidence/setup.php');
 	}
 
 	$info = plugin_evidence_version();
diff --git a/setup.php b/setup.php
index 587c937..9838a57 100644
--- a/setup.php
+++ b/setup.php
@@ -50,13 +50,13 @@ function plugin_evidence_csp_nonce(): string {
  * @return void
  */
 function plugin_evidence_install() {
-	api_plugin_register_hook('evidence', 'device_edit_top_links', 'plugin_evidence_device_edit_top_links', 'include/functions.php');
-	api_plugin_register_hook('evidence', 'top_header_tabs', 'evidence_show_tab', 'include/functions.php');
-	api_plugin_register_hook('evidence', 'top_graph_header_tabs', 'evidence_show_tab', 'include/functions.php');
-	api_plugin_register_hook('evidence', 'device_remove', 'plugin_evidence_device_remove', 'include/functions.php');
-	api_plugin_register_hook('evidence', 'config_settings', 'plugin_evidence_config_settings', 'include/settings.php');
-	api_plugin_register_hook('evidence', 'poller_bottom', 'plugin_evidence_poller_bottom', 'include/functions.php');
-	api_plugin_register_hook('evidence', 'host_edit_bottom', 'plugin_evidence_host_edit_bottom', 'include/functions.php');
+	api_plugin_register_hook('evidence', 'device_edit_top_links', 'plugin_evidence_device_edit_top_links', 'includes/functions.php');
+	api_plugin_register_hook('evidence', 'top_header_tabs', 'evidence_show_tab', 'includes/functions.php');
+	api_plugin_register_hook('evidence', 'top_graph_header_tabs', 'evidence_show_tab', 'includes/functions.php');
+	api_plugin_register_hook('evidence', 'device_remove', 'plugin_evidence_device_remove', 'includes/functions.php');
+	api_plugin_register_hook('evidence', 'config_settings', 'plugin_evidence_config_settings', 'includes/settings.php');
+	api_plugin_register_hook('evidence', 'poller_bottom', 'plugin_evidence_poller_bottom', 'includes/functions.php');
+	api_plugin_register_hook('evidence', 'host_edit_bottom', 'plugin_evidence_host_edit_bottom', 'includes/functions.php');
 
 	api_plugin_register_realm('evidence', 'evidence.php,evidence_tab.php,', 'Plugin evidence - view', 1);
 
@@ -103,7 +103,7 @@ function plugin_evidence_version() {
 function plugin_evidence_check_config() {
 	global $config;
 
-	include_once($config['base_path'] . '/plugins/evidence/include/database.php');
+	require_once($config['base_path'] . '/plugins/evidence/includes/database.php');
 	plugin_evidence_upgrade_database();
 
 	return true;
@@ -122,7 +122,7 @@ function plugin_evidence_check_config() {
 function plugin_evidence_setup_database() {
 	global $config;
 
-	include_once($config['base_path'] . '/plugins/evidence/include/database.php');
+	require_once($config['base_path'] . '/plugins/evidence/includes/database.php');
 	plugin_evidence_initialize_database();
 }
 
@@ -155,3 +155,173 @@ function plugin_evidence_remove_data() {
 
 	return true;
 }
+
+/**
+ * Removes files and directories that a previous version of this plugin
+ * shipped but that have since moved or been deleted, using the tombstone
+ * and whitelist lists in manifest.json. Whitelisted (user-data) paths and
+ * any VCS metadata (.git*) are never touched; the dev-only tests/ tree is
+ * removed. Any path that resolves outside the plugin directory (a tampered
+ * manifest.json) is refused, and any file/directory that cannot be removed
+ * (e.g. read-only) is reported to the Cacti log. Any top-level entry that is
+ * neither expected nor a tombstone nor whitelisted is logged to the Cacti
+ * log and left in place. Called on a plugin version change.
+ *
+ * @return void
+ *
+ * @global array $config Cacti global configuration array; used to resolve
+ *                       the plugin directory.
+ */
+function evidence_prune_files(): void {
+	global $config;
+
+	$plugin_dir    = $config['base_path'] . '/plugins/evidence';
+	$manifest_path = $plugin_dir . '/manifest.json';
+
+	if (!is_readable($manifest_path)) {
+		return;
+	}
+
+	$manifest = json_decode((string) file_get_contents($manifest_path), true);
+
+	if (!is_array($manifest)) {
+		cacti_log('WARNING: evidence manifest.json could not be parsed; skipping file prune', false, 'EVIDENCE');
+
+		return;
+	}
+
+	$tombstones = isset($manifest['tombstones']) && is_array($manifest['tombstones']) ? $manifest['tombstones'] : [];
+	$expected   = isset($manifest['expected'])   && is_array($manifest['expected'])   ? $manifest['expected']   : [];
+	$whitelist  = isset($manifest['whitelist'])  && is_array($manifest['whitelist'])  ? $manifest['whitelist']  : [];
+
+	$protected = function (string $rel) use ($whitelist): bool {
+		if (strncmp($rel, '.git', 4) === 0 || strncmp($rel, '.md', 3) === 0) {
+			return true;
+		}
+
+		foreach ($whitelist as $entry) {
+			$entry = trim((string) $entry, '/');
+
+			if ($entry !== '' && ($rel === $entry
+				|| strncmp($rel, $entry . '/', strlen($entry) + 1) === 0
+				|| strncmp($entry, $rel . '/', strlen($rel) + 1) === 0)) {
+				return true;
+			}
+		}
+
+		return false;
+	};
+
+	// Security: resolve the plugin directory so a tampered manifest.json
+	// cannot steer the prune outside of it.
+	$plugin_real = realpath($plugin_dir);
+
+	// Remove tombstoned (moved/deleted) paths plus the dev-only tests/
+	// tree and the phpunit.xml test configuration.
+	$remove   = $tombstones;
+	$remove[] = 'tests/';
+	$remove[] = 'phpunit.xml';
+
+	foreach ($remove as $rel) {
+		$rel = trim((string) $rel, '/');
+
+		if ($rel === '' || $protected($rel)) {
+			continue;
+		}
+
+		// A tombstone must never contain '.'/'..' segments; a tampered manifest
+		// could use them to escape the plugin directory or target its root.
+		$segments = explode('/', $rel);
+
+		if (in_array('.', $segments, true) || in_array('..', $segments, true)) {
+			cacti_log(sprintf('WARNING: evidence prune refused to remove %s: path contains a traversal segment (tampered manifest.json?)', $rel), false, 'EVIDENCE');
+
+			continue;
+		}
+
+		$path = $plugin_dir . '/' . $rel;
+
+		if (!is_link($path) && !file_exists($path)) {
+			continue;
+		}
+
+		// Refuse any path that, after resolving symlinks and ../ segments,
+		// escapes the plugin directory (protects user data from a tampered
+		// manifest.json).
+		$anchor = is_link($path) ? dirname($path) : $path;
+		$real   = realpath($anchor);
+
+		if ($real === false || ($real !== $plugin_real && strncmp($real, $plugin_real . DIRECTORY_SEPARATOR, strlen((string) $plugin_real) + 1) !== 0)) {
+			cacti_log(sprintf('WARNING: evidence prune refused to remove %s: path resolves outside the plugin directory (tampered manifest.json?)', $rel), false, 'EVIDENCE');
+
+			continue;
+		}
+
+		if (is_dir($path) && !is_link($path)) {
+			$removed = evidence_rmtree($path);
+		} else {
+			$removed = @unlink($path);
+		}
+
+		if (!$removed) {
+			cacti_log(sprintf('WARNING: evidence upgrade could not remove %s (check file/directory permissions)', $rel), false, 'EVIDENCE');
+		}
+	}
+
+	// Surface any top-level entry the manifest does not account for.
+	$known = [];
+
+	foreach (array_merge($expected, $tombstones) as $entry) {
+		$top = explode('/', trim((string) $entry, '/'))[0];
+
+		if ($top !== '') {
+			$known[$top] = true;
+		}
+	}
+
+	$entries = scandir($plugin_dir);
+
+	foreach (($entries !== false ? $entries : []) as $entry) {
+		if ($entry === '.' || $entry === '..' || $entry === 'tests' || $entry === 'phpunit.xml' || $protected($entry) || isset($known[$entry])) {
+			continue;
+		}
+
+		cacti_log(sprintf('WARNING: evidence upgrade found a file/directory not described in manifest.json: %s (left in place)', $entry), false, 'EVIDENCE');
+	}
+}
+
+/**
+ * Recursively deletes a directory and its contents. Symlinks are removed
+ * without being followed. Helper for evidence_prune_files().
+ *
+ * @param string $dir Absolute path to the directory to remove.
+ *
+ * @return bool True if the directory and everything under it was removed;
+ *              false if any entry could not be deleted.
+ */
+function evidence_rmtree(string $dir): bool {
+	$entries = scandir($dir);
+	$ok      = true;
+
+	foreach (($entries !== false ? $entries : []) as $entry) {
+		if ($entry === '.' || $entry === '..') {
+			continue;
+		}
+
+		$path = $dir . '/' . $entry;
+
+		if (is_dir($path) && !is_link($path)) {
+			if (!evidence_rmtree($path)) {
+				$ok = false;
+			}
+		} elseif (!@unlink($path)) {
+			$ok = false;
+		}
+	}
+
+	if (!@rmdir($dir)) {
+		$ok = false;
+	}
+
+	return $ok;
+}
diff --git a/tests/Security/PhpCompatibilityTest.php b/tests/Security/PhpCompatibilityTest.php
index 7237066..8396848 100644
--- a/tests/Security/PhpCompatibilityTest.php
+++ b/tests/Security/PhpCompatibilityTest.php
@@ -49,7 +49,7 @@
         $relativeFile = ltrim(str_replace($pluginRoot, '', $file->getPathname()), DIRECTORY_SEPARATOR);
         $relativeFile = str_replace(DIRECTORY_SEPARATOR, '/', $relativeFile);
 
-        if (strpos($relativeFile, 'tests/') === 0 || strpos($relativeFile, 'vendor/') === 0 || strpos($relativeFile, 'include/vendor/') === 0) {
+        if (strpos($relativeFile, 'tests/') === 0 || strpos($relativeFile, 'vendor/') === 0 || strpos($relativeFile, 'includes/vendor/') === 0) {
                 continue;
         }
 
diff --git a/tests/Unit/EvidenceDatabaseTest.php b/tests/Unit/EvidenceDatabaseTest.php
index 9f597ab..233ce50 100644
--- a/tests/Unit/EvidenceDatabaseTest.php
+++ b/tests/Unit/EvidenceDatabaseTest.php
@@ -9,7 +9,7 @@
 
 /*
  * Unit coverage for plugin_evidence_setup_database() in setup.php, which
- * drives include/database.php's plugin_evidence_initialize_database().
+ * drives includes/database.php's plugin_evidence_initialize_database().
  */
 
 beforeAll(function () {
diff --git a/tests/Unit/EvidenceLifecycleTest.php b/tests/Unit/EvidenceLifecycleTest.php
index 3de4481..488af1d 100644
--- a/tests/Unit/EvidenceLifecycleTest.php
+++ b/tests/Unit/EvidenceLifecycleTest.php
@@ -11,7 +11,7 @@
  * Unit coverage for the plugin lifecycle contract functions in setup.php:
  * plugin_evidence_uninstall(), plugin_evidence_has_data(),
  * plugin_evidence_remove_data(), and plugin_evidence_check_config()
- * (which drives include/database.php's plugin_evidence_upgrade_database()).
+ * (which drives includes/database.php's plugin_evidence_upgrade_database()).
  */
 
 beforeAll(function () {
@@ -51,9 +51,25 @@
 });
 
 it('updates the stored plugin_config version when it drifts', function () {
+	// Load the schema library from the real checkout, then sandbox base_path so
+	// the upgrade-time prune (evidence_prune_files) runs against a temp
+	// tree, never the real checkout. A minimal INFO drives the version-drift
+	// path; no manifest.json there means the prune no-ops.
+	require_once $GLOBALS['config']['base_path'] . '/plugins/evidence/includes/database.php';
+
 	evidence_test_mock_db('db_fetch_cell', 'plugin_config', '0.0.0');
 
-	expect(plugin_evidence_check_config())->toBeTrue();
+	$restore = $GLOBALS['config']['base_path'];
+	$base    = sys_get_temp_dir() . '/evidence-upg-' . uniqid();
+	mkdir($base . '/plugins/evidence', 0777, true);
+	file_put_contents($base . '/plugins/evidence/INFO', "[info]\nversion = 9.9.9\nauthor = x\nhomepage = x\n");
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		plugin_evidence_upgrade_database();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
 
 	$updates = array_values(array_filter($GLOBALS['__test_db_calls'], function ($call) {
 		return $call['fn'] === 'db_execute_prepared' && stripos($call['sql'], 'UPDATE plugin_config') !== false;
diff --git a/tests/Unit/PruneFilesTest.php b/tests/Unit/PruneFilesTest.php
new file mode 100644
index 0000000..8469087
--- /dev/null
+++ b/tests/Unit/PruneFilesTest.php
@@ -0,0 +1,257 @@
+<?php
+/* vim: ts=4
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Inc.                           |
+ | Copyright (C) 2004-2024 Petr Macek                                      |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | https://github.com/xmacan/                                              |
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for evidence_prune_files(): tombstone/tests removal,
+ * whitelist and .git protection, and logging of unaccounted-for entries.
+ */
+
+require_once __DIR__ . '/../../setup.php';
+
+function evidence_prune_fixture(array $manifest): string {
+	$base   = sys_get_temp_dir() . '/evidence-prune-' . uniqid();
+	$plugin = $base . '/plugins/evidence';
+
+	mkdir($plugin . '/include', 0777, true);
+	file_put_contents($plugin . '/include/old.php', "<?php\n");
+	mkdir($plugin . '/tests/Unit', 0777, true);
+	file_put_contents($plugin . '/tests/Unit/SomeTest.php', "<?php\n");
+	mkdir($plugin . '/userdata', 0777, true);
+	file_put_contents($plugin . '/userdata/keep.dat', 'keep');
+	mkdir($plugin . '/includes', 0777, true);
+	file_put_contents($plugin . '/INFO', "[info]\n");
+	file_put_contents($plugin . '/setup.php', "<?php\n");
+	file_put_contents($plugin . '/oldfile.php', "<?php\n");
+	file_put_contents($plugin . '/stray.php', "<?php\n");
+	file_put_contents($plugin . '/phpunit.xml', '');
+	file_put_contents($plugin . '/.mdlrc', '');
+	file_put_contents($plugin . '/.md_style.rb', '');
+	mkdir($plugin . '/.git', 0777, true);
+	file_put_contents($plugin . '/.git/config', '');
+	file_put_contents($plugin . '/manifest.json', json_encode($manifest));
+
+	return $base;
+}
+
+beforeEach(function () {
+	$GLOBALS['__test_cacti_log'] = [];
+});
+
+it('removes tombstoned paths and the tests/ tree, keeps whitelist/.git/expected, logs strays', function () {
+	$manifest = [
+		'tombstones' => ['include/', 'oldfile.php', 'userdata/', 'gone.png'],
+		'expected'   => ['INFO', 'setup.php', 'includes/', 'manifest.json'],
+		'whitelist'  => ['userdata/'],
+	];
+
+	$base    = evidence_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/evidence';
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// Tombstone and the dev-only tests/ tree are gone.
+	expect(is_dir($plugin . '/include'))->toBeFalse();
+	expect(is_dir($plugin . '/tests'))->toBeFalse();
+	expect(is_file($plugin . '/oldfile.php'))->toBeFalse();
+	expect(is_file($plugin . '/phpunit.xml'))->toBeFalse();
+
+	// Whitelisted user data, VCS metadata, and expected files are untouched.
+	// (userdata/ is even listed as a tombstone, but the whitelist wins.)
+	expect(is_file($plugin . '/userdata/keep.dat'))->toBeTrue();
+	expect(is_dir($plugin . '/.git'))->toBeTrue();
+	expect(is_file($plugin . '/INFO'))->toBeTrue();
+	expect(is_dir($plugin . '/includes'))->toBeTrue();
+	expect(is_file($plugin . '/.mdlrc'))->toBeTrue();
+	expect(is_file($plugin . '/.md_style.rb'))->toBeTrue();
+
+	// An unexpected, non-whitelisted stray is left in place but logged.
+	expect(is_file($plugin . '/stray.php'))->toBeTrue();
+
+	$logged = implode("\n", $GLOBALS['__test_cacti_log']);
+	expect($logged)->toContain('stray.php');
+	expect($logged)->not->toContain('userdata');
+	expect($logged)->not->toContain('.git');
+	expect($logged)->not->toContain('.mdlrc');
+	expect($logged)->not->toContain('.md_style.rb');
+});
+
+it('is a safe no-op when the manifest is missing', function () {
+	$base    = sys_get_temp_dir() . '/evidence-prune-missing-' . uniqid();
+	mkdir($base . '/plugins/evidence', 0777, true);
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	expect($GLOBALS['__test_cacti_log'])->toBe([]);
+});
+
+it('logs and skips pruning when the manifest is malformed', function () {
+	$base   = sys_get_temp_dir() . '/evidence-prune-bad-' . uniqid();
+	$plugin = $base . '/plugins/evidence';
+	mkdir($plugin, 0777, true);
+	file_put_contents($plugin . '/manifest.json', 'not json');
+	mkdir($plugin . '/tests', 0777, true);
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// A malformed manifest must not delete anything.
+	expect(is_dir($plugin . '/tests'))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('could not be parsed');
+});
+
+it('refuses to remove a tombstone that resolves outside the plugin directory', function () {
+	$manifest = [
+		'tombstones' => ['../escapee.txt'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base    = evidence_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/evidence';
+	$outside = $base . '/plugins/escapee.txt';
+	file_put_contents($outside, 'precious user data');
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// The out-of-tree file is untouched and the refusal is logged.
+	expect(is_file($outside))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('a traversal segment');
+});
+
+it('warns when a tombstoned path cannot be removed', function () {
+	$manifest = [
+		'tombstones' => ['locked/'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base   = evidence_prune_fixture($manifest);
+	$plugin = $base . '/plugins/evidence';
+	mkdir($plugin . '/locked/sub', 0777, true);
+	file_put_contents($plugin . '/locked/sub/data', 'x');
+	chmod($plugin . '/locked/sub', 0500); // read-only dir: its child cannot be unlinked
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	set_error_handler(static fn () => true); // swallow the expected unlink warning
+
+	try {
+		evidence_prune_files();
+	} finally {
+		restore_error_handler();
+		$GLOBALS['config']['base_path'] = $restore;
+		@chmod($plugin . '/locked/sub', 0700);
+	}
+
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('could not remove');
+})->skip(function () {
+	return function_exists('posix_getuid') && posix_getuid() === 0;
+}, 'permission checks are bypassed for the root user');
+
+it('refuses a tombstone that escapes through a symlinked directory', function () {
+	$manifest = [
+		'tombstones' => ['escdir/secret.txt'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base    = evidence_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/evidence';
+	$outside = $base . '/outside';
+	mkdir($outside, 0777, true);
+	file_put_contents($outside . '/secret.txt', 'precious user data');
+	@symlink($outside, $plugin . '/escdir');
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// The out-of-tree file reached through the symlink is untouched and logged.
+	expect(is_file($outside . '/secret.txt'))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('outside the plugin directory');
+})->skip(function () {
+	$probe = sys_get_temp_dir() . '/.prune-symlink-probe-' . uniqid();
+	$ok = @symlink(__FILE__, $probe);
+	@unlink($probe);
+
+	return $ok === false;
+}, 'symlinks are not supported on this filesystem');
+
+it('protects a whitelisted file from a tombstone on its parent directory', function () {
+	$manifest = [
+		'tombstones' => ['userdata/'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => ['userdata/keep.dat'],
+	];
+
+	$base    = evidence_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/evidence';
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		evidence_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// A whitelisted file shields its parent directory from a tombstone.
+	expect(is_file($plugin . '/userdata/keep.dat'))->toBeTrue();
+});
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index e65b53d..3ad1099 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -160,6 +160,9 @@ function changed_lines($base_ref) {
  * Empty by default; add entries per repository as the need arises.
  */
 $unmeasured_allowlist = [
+	'evidence.php',        // web UI entry point (chdir + require auth.php); not loadable in the isolated unit process
+	'evidence_tab.php',    // web UI tab entry point (chdir + require auth.php); not loadable in the isolated unit process
+	'poller_evidence.php', // CLI poller entry point (require cli_check.php); not loadable in the isolated unit process
 ];
 $unmeasured            = array_values(array_diff(array_keys($changed), array_keys($measured)));
 $unexpected_unmeasured = array_values(array_diff($unmeasured, $unmeasured_allowlist));
diff --git a/tests/bin/validate-manifest.php b/tests/bin/validate-manifest.php
new file mode 100644
index 0000000..c54fab5
--- /dev/null
+++ b/tests/bin/validate-manifest.php
@@ -0,0 +1,73 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Validates that manifest.json's "expected" array matches the plugin's    |
+ | actual top-level tree, so the manifest that drives upgrade-time pruning  |
+ | cannot silently drift. tests/, phpunit.xml, .git* and .md* are          |
+ | excluded, as are whitelisted (user-data) paths. Non-zero exit on drift. |
+ +-------------------------------------------------------------------------+
+*/
+
+$root         = dirname(__DIR__, 2);
+$manifestPath = $root . '/manifest.json';
+
+if (!is_readable($manifestPath)) {
+	fwrite(STDERR, "manifest.json not found at plugin root\n");
+	exit(1);
+}
+
+$manifest = json_decode((string) file_get_contents($manifestPath), true);
+
+if (!is_array($manifest) || !isset($manifest['expected']) || !is_array($manifest['expected'])) {
+	fwrite(STDERR, "manifest.json is missing a valid 'expected' array\n");
+	exit(1);
+}
+
+$whitelist    = isset($manifest['whitelist']) && is_array($manifest['whitelist']) ? $manifest['whitelist'] : [];
+$whitelistTop = [];
+
+foreach ($whitelist as $entry) {
+	$entry = trim((string) $entry, '/');
+
+	if ($entry !== '') {
+		$whitelistTop[explode('/', $entry)[0]] = true;
+	}
+}
+
+$actual = [];
+
+foreach (scandir($root) as $entry) {
+	if ($entry === '.' || $entry === '..' || $entry === 'tests' || $entry === 'phpunit.xml') {
+		continue;
+	}
+
+	if (strncmp($entry, '.git', 4) === 0 || strncmp($entry, '.md', 3) === 0 || isset($whitelistTop[$entry])) {
+		continue;
+	}
+
+	$actual[] = is_dir($root . '/' . $entry) ? $entry . '/' : $entry;
+}
+
+$expected = $manifest['expected'];
+sort($actual);
+sort($expected);
+
+$missing = array_values(array_diff($expected, $actual));
+$extra   = array_values(array_diff($actual, $expected));
+
+if ($missing === [] && $extra === []) {
+	echo "manifest.json 'expected' matches the plugin tree.\n";
+	exit(0);
+}
+
+if ($missing !== []) {
+	fwrite(STDERR, "manifest.json lists 'expected' entries that are missing on disk:\n  " . implode("\n  ", $missing) . "\n");
+}
+
+if ($extra !== []) {
+	fwrite(STDERR, "Plugin tree has top-level entries not in manifest.json 'expected'\n(add them to 'expected', or record them under 'tombstones'/'whitelist'):\n  " . implode("\n  ", $extra) . "\n");
+}
+
+exit(1);
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 86cd6b9..3eedd86 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -262,6 +262,8 @@ function __esc($text, $domain = '') {
 
 if (!function_exists('cacti_log')) {
 	function cacti_log($message, $also_print = false, $log_type = '', $level = 0) {
+		$args = func_get_args();
+		$GLOBALS["__test_cacti_log"][] = isset($args[0]) ? (string) $args[0] : "";
 	}
 }