diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md
index 7c4b3ef..95ff8ed 100644
--- a/admin_ui_cleanup.md
+++ b/admin_ui_cleanup.md
@@ -398,6 +398,23 @@ that had to be made deliberately (`.claude/`, and a `docker-compose.yml` carryin
 `DisableLogin` override) — in both cases the exclusion was agreed before the commit existed, which is
 the only point at which it is cheap.
 
+   **Audit the commit's CONTENT, not just its file list — they catch disjoint failures.** A filename
+   audit finds the wrong-file problem (`.claude/`, a stray `.db`, a `.pfx`). It cannot find the
+   right-file-wrong-content problem: a sweep whose live gate mints an API key, a token or a connection
+   string can paste it into a *legitimately tracked* plan doc, where a `--name-only` check sees a file
+   that is supposed to be there. So run both:
+
+   ```bash
+   git diff --name-only <base>..<sha>                 # wrong-file
+   git show <base>..<sha> | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}'
+   ```
+
+   Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and
+   HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the
+   enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local
+   permission config in a production commit — and ScadaBridge is exactly the repo where it nearly
+   happened. Adding the ignore line to the two that lack it converts a discipline into a guarantee.
+
 **When every hypothesis is falsified, test the SHARED PREMISE before adding a new one.** Two
 investigations into a 0-byte log file eliminated, between them, config levels, env vars in five
 scopes, ACLs, stale files and a two-stage bootstrap — and deadlocked. The unexamined premise both