diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md
index 95ff8ed..c64e9df 100644
--- a/admin_ui_cleanup.md
+++ b/admin_ui_cleanup.md
@@ -405,10 +405,25 @@ the only point at which it is cheap.
    that is supposed to be there. So run both:
 
    ```bash
-   git diff --name-only <base>..<sha>                 # wrong-file
+   git diff --name-only <base>..<sha>                 # (a) wrong-file
    git show <base>..<sha> | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}'
+   git show <base>..<sha> | grep '^+' \
+     | grep -oE '[A-Fa-f0-9]{24,}|[A-Za-z0-9+/]{32,}={0,2}' | grep -v /   # (c) unlabeled entropy
+   git show <base>..<sha> | grep -c 'BEGIN [A-Z ]*PRIVATE KEY\|BEGIN CERTIFICATE'
    ```
 
+   **(b) is keyword-anchored and therefore blind to unlabeled material** — a minted key id like a bare
+   32-hex string has no keyword near it and will not match; verified. Hence (c), and hence the PEM
+   check, since `-----BEGIN` is labeled but by none of those six words. The prefix list is also
+   **repo-specific and goes stale** (`otua_` is OtOpcUa's, `histgw_` HistorianGateway's) — extend it
+   per repo rather than treating the line as fixed.
+
+   **The reliable check is none of the above: if your verification gate MINTED anything — an API key,
+   a token, a test account — grep the commit for the literal values it produced.** Generic patterns
+   are a net for what you did not anticipate; the literal grep is the check for what you *did*, and
+   only it is dependable, because you know the exact string and nobody else does. A clean generic scan
+   is weak evidence when a gate minted credentials that the scan structurally cannot see.
+
    Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and
    HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the
    enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local