diff --git a/docs/plans/2026-05-31-folder-repo-rename-scadabridge-design.md b/docs/plans/2026-05-31-folder-repo-rename-scadabridge-design.md
index 4bffa1cf..023cad7b 100644
--- a/docs/plans/2026-05-31-folder-repo-rename-scadabridge-design.md
+++ b/docs/plans/2026-05-31-folder-repo-rename-scadabridge-design.md
@@ -83,6 +83,12 @@ git grep -niE "scadalink" -- . \
 
 The existing `~/Desktop/ScadaBridge` (non-git, older project containing `akka.md`, `netstd.md`, `CommentChecker`, its own `src/`/`tests/`/`tsdb/`) is renamed to `~/Desktop/ScadaBridge-old`. Nothing is deleted. If the user later confirms it is dead, they delete it themselves.
 
+## Section 3a — Git-ignored `deploy/` tree (added during implementation)
+
+`/deploy/` is git-ignored, so the `git grep`-based scrub script (and its completeness gate) structurally could not reach it — a gap surfaced by code review. The `deploy/wonder-app-vd03/` production artifacts (`install.ps1`, `appsettings.Central.json`, `appsettings.Site.json`, `RUNBOOK.md`, `ldap/glauth.cfg`) still held old references that would break against the renamed binary: `SCADALINK_*` env vars, `ScadaLink__*` config keys, the `"ScadaLink"` config-section root, `ScadaLink.Host.exe` (now `ZB.MOM.WW.ScadaBridge.Host.exe`), `scadalink.exe` (CLI `AssemblyName` is `scadabridge`), and `akka.tcp://scadalink@…` seed URIs (the actor system name in code is `scadabridge`).
+
+Per user decision, this tree was scrubbed by hand with the **same** substitution set, **including** the internal LDAP directory domain (`dc=scadalink,dc=local` → `dc=scadabridge,dc=local` and `@scadalink.local` → `@scadabridge.local`) applied in lockstep across both `appsettings` and `glauth.cfg` so LDAP login stays consistent. Because `deploy/` is git-ignored, these edits are **local-only / not committed** — they fix the on-disk artifacts for the next `wonder-app-vd03` deploy. Verified clean with `grep -rniI scadalink deploy/`.
+
 ## Section 4 — Runtime cutover
 
 Hard cutover. After the scrub, rebuild the image and `docker compose up -d --force-recreate` on both clusters (`docker/`, `docker-env2/`) so the running containers read `SCADABRIDGE_*`. **No database rename or wipe** — database names were already migrated in the `2026-05-28` effort and are unchanged here. If no stack is currently running, the cutover applies on the next `bash docker/deploy.sh`.
diff --git a/tools/scrub-scadalink-refs.sh b/tools/scrub-scadalink-refs.sh
index ceac430e..9f58feaa 100755
--- a/tools/scrub-scadalink-refs.sh
+++ b/tools/scrub-scadalink-refs.sh
@@ -7,6 +7,12 @@
 set -euo pipefail
 cd "$(git rev-parse --show-toplevel)"
 
+# NOTE: this script only sees git-TRACKED files (via git grep). Git-ignored
+# trees — notably /deploy/ (see .gitignore) — are out of its reach and were
+# scrubbed separately, by hand, with the same substitution set. A git-based
+# completeness gate likewise cannot see them; verify those trees with a plain
+# `grep -rniI scadalink <dir>`.
+
 # Carve-outs (migration records): prior rename tooling/design, the DB-rename
 # helper, this script itself, and the rename design + plan docs (which document
 # the old→new mapping and would be self-corrupted by the substitution).