diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md
index 904bc27..7c4b3ef 100644
--- a/admin_ui_cleanup.md
+++ b/admin_ui_cleanup.md
@@ -387,6 +387,17 @@ plus stating the claim's scope honestly ("verified in these three; not checked i
 when it hasn't. All three were caught by someone re-examining their own earlier assertion, never by
 the assertion being challenged.
 
+**Enumerate untracked paths BEFORE staging, not after.** A sweep touches many files, so the landing
+commit is where unrelated local state gets swept in — and `git status` counts mislead: one repo's
+"78 modified" was 76 modified + 2 untracked, and one of the untracked entries was `.claude/`,
+containing that session's `settings.local.json`. A literal `git add -A`/`git add .` following a
+"commit the sweep" instruction would have put local permission config into a tracked commit feeding a
+production deploy, invisible inside a 76-file diff. Run `git status --porcelain` and read the `??`
+lines specifically; decide each one before staging anything. Two repos in this round had an exclusion
+that had to be made deliberately (`.claude/`, and a `docker-compose.yml` carrying an undecided
+`DisableLogin` override) — in both cases the exclusion was agreed before the commit existed, which is
+the only point at which it is cheap.
+
 **When every hypothesis is falsified, test the SHARED PREMISE before adding a new one.** Two
 investigations into a 0-byte log file eliminated, between them, config levels, env vars in five
 scopes, ACLs, stale files and a two-stage bootstrap — and deadlocked. The unexamined premise both