diff --git a/internal/evidence/evidence.go b/internal/evidence/evidence.go
new file mode 100644
index 0000000..50c98cf
--- /dev/null
+++ b/internal/evidence/evidence.go
@@ -0,0 +1,39 @@
+// Package evidence is the activity port: a dumb active-window sensor behind a
+// Source interface, plus the value types it emits. It makes no judgment about
+// whether a window is on-task — that is the advisor's job in a later milestone.
+package evidence
+
+import (
+	"context"
+	"regexp"
+)
+
+// EvidenceHealth records whether the sensor could observe the active window.
+type EvidenceHealth struct {
+	Available bool   // true when a window was observed
+	Reason    string // empty when Available; populated when not
+}
+
+// WindowSnapshot is one observation of the active window.
+type WindowSnapshot struct {
+	Title  string // full _NET_WM_NAME (raw; used in live view + raw log)
+	Class  string // WM_CLASS
+	Health EvidenceHealth
+}
+
+// Source is the activity port. Watch runs until ctx is cancelled, invoking
+// onChange on every active-window change, and once immediately with the
+// current window.
+type Source interface {
+	Watch(ctx context.Context, onChange func(WindowSnapshot))
+}
+
+// titleNoise matches the legacy clock/ratio/percent runs that pollute bucket
+// keys (e.g. "1:23", "50.5%", "-3.0"). Ported verbatim from the Rust impl.
+var titleNoise = regexp.MustCompile(`-?\d+([:.]\d+)+%?`)
+
+// ScrubTitle removes volatile numeric runs so window titles bucket stably.
+// The raw event log keeps the unscrubbed title; only bucket keys are scrubbed.
+func ScrubTitle(title string) string {
+	return titleNoise.ReplaceAllString(title, "")
+}
diff --git a/internal/evidence/evidence_test.go b/internal/evidence/evidence_test.go
new file mode 100644
index 0000000..7e271c5
--- /dev/null
+++ b/internal/evidence/evidence_test.go
@@ -0,0 +1,46 @@
+package evidence
+
+import (
+	"context"
+	"testing"
+)
+
+func TestScrubTitle(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"Plain title", "Plain title"},                    // no digits-with-separator: untouched
+		{"Buy 2 eggs", "Buy 2 eggs"},                      // bare integer: untouched (group is mandatory)
+		{"12.5%", ""},                                     // percent decimal: stripped whole
+		{"1:23:45 remaining", " remaining"},               // clock ratio: stripped
+		{"-3.0 delta", " delta"},                          // leading sign + decimal: stripped
+		{"Download 50.5% complete", "Download  complete"}, // embedded percent decimal
+	}
+	for _, c := range cases {
+		if got := ScrubTitle(c.in); got != c.want {
+			t.Errorf("ScrubTitle(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+// fakeSource satisfies Source for downstream tests and proves the interface shape.
+type fakeSource struct{ snaps []WindowSnapshot }
+
+func (f fakeSource) Watch(ctx context.Context, onChange func(WindowSnapshot)) {
+	for _, s := range f.snaps {
+		onChange(s)
+	}
+	<-ctx.Done()
+}
+
+func TestFakeSourceEmits(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	var got []WindowSnapshot
+	src := fakeSource{snaps: []WindowSnapshot{
+		{Title: "a", Class: "code", Health: EvidenceHealth{Available: true}},
+	}}
+	go src.Watch(ctx, func(s WindowSnapshot) { got = append(got, s) })
+	// Give the goroutine a chance, then cancel.
+	cancel()
+	// We can't assert timing deterministically here; this test only confirms the
+	// types and signature compile and Watch accepts the callback.
+	_ = got
+}