diff --git a/docs/audit/env-snapshot-20260718.md b/docs/audit/env-snapshot-20260718.md
index 2063cfc..0060cc9 100644
--- a/docs/audit/env-snapshot-20260718.md
+++ b/docs/audit/env-snapshot-20260718.md
@@ -56,7 +56,10 @@
 - `bash scripts/run-tests-all.sh` -> GAUNTLET ALL GREEN (69 harnesses,
   including the new `tests/record-audit/`).
 - `bash scripts/ledger-scan.sh` -> PROPOSED/OPEN: D-068, D-071, D-129; OPEN
-  SEC rows: SEC-001, -003..-008, -010 (9 rows); next-free D-130 / DOCFIX-197 /
-  BUNDLEFIX-052. `--fences` -> 1 fence, 0 errors, 0 warnings, OK.
+  SEC rows: SEC-001, -003..-008, -010 (9 rows); next-free numbers D=130,
+  DOCFIX=197, BUNDLEFIX=052 (written token-free on purpose -- the scanner's
+  mention-derived counters count any hyphenated token on a line lacking
+  "next-free"; this line's first wrapped draft inflated two counters, see
+  GA-F15). `--fences` -> 1 fence, 0 errors, 0 warnings, OK.
 - Auto-memory: DISABLED this session by design; the memory directory was read
   as on-disk evidence only (5 files; see findings GA-F05..GA-F08).
diff --git a/docs/audit/grounding-audit-20260718.md b/docs/audit/grounding-audit-20260718.md
index 72e8709..7e6fa67 100644
--- a/docs/audit/grounding-audit-20260718.md
+++ b/docs/audit/grounding-audit-20260718.md
@@ -206,6 +206,36 @@
 authority".
 **Traces to:** GA-R2, GA-R1, GA-F01.
 
+## GA-F15 -- MED -- ledger-scan mention-derived counters are inflatable by quoting them (demonstrated twice, by the audit itself)
+
+**Evidence:** `scripts/ledger-scan.sh:121-129` derives DOCFIX/BUNDLEFIX
+next-free from the highest TOKEN MENTION in docs/ + runbooks/, excluding
+lines containing "next-free" (:124). A quoted next-free value whose token
+wraps onto the next line defeats the exclusion and permanently raises the
+counter. Demonstrated 2026-07-18 by the audit's own outputs: the Phase-1 env
+snapshot (first draft of line 59-60) raised the BUNDLEFIX counter by one, and
+CURRENT-STATE.md's first draft of its section 9 raised the DOCFIX counter by
+one -- inside the sentence asserting DOCFIX was unaffected. Both surfaces
+were reworded token-free the same day; re-run confirms true values D=130,
+DOCFIX=197, BUNDLEFIX=052. The script's own CAUTION comment (:112-120)
+documents the failure class (DOCFIX-173's changelog once pushed a counter to
+1005). The D counter is header-authoritative and immune.
+**Proposed fix (Phase 5):** harden the scanner -- e.g. count only assignment
+sites (headers / register rows), or apply the exclusion over a joined
+paragraph rather than per-line; plus a standing rule: next-free values are
+quoted token-free everywhere.
+**Traces to:** GA-R1 (derived numbers must come from one authority), GA-R6.
+
+## GA-F14 addendum (Phase-2 sharpening)
+
+CURRENT-STATE.md section 2.3-ii, backed by
+`docs/finding-20260718-voffice1-cloudinit-seed-replace.md:140-184`: live
+autostart is `enable` on both guests but the attribute is ABSENT from tofu
+state (provider v0.9.8 never reads it back), so the changelog's "2 in-place
+collapse to 0 post-bookend" claim was STRUCTURALLY impossible -- the diff is
+driven by state, not live, and an autostart-only apply bounces the guest.
+The false claim was not just stale; it was unverifiable at write time.
+
 ---
 
 ## Phase-1 disposition notes