diff --git a/.gitleaks.toml b/.gitleaks.toml
index db763a2c..11f85995 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -52,6 +52,25 @@ paths = [
   # registry, which trip the generic-api-key entropy heuristic.
   '''(^|/)Project\.toml$''',
   '''(^|/)Manifest\.toml$''',
+
+  # The SCANNER'S OWN STAGED ARTEFACT -- not an exemption for a file that
+  # "is fine", which the DESIGN RULE above forbids, but the one file the
+  # scanner writes into its own scan target.
+  #
+  # The standards secret-scanner reusable copies
+  # `config/gitleaks/estate-baseline.toml` to `.gitleaks-estate.toml` in the
+  # workspace root UNCONDITIONALLY, before the step that decides whether this
+  # repo references it (hyperpolymath/standards#888). That baseline documents
+  # worked examples of credential SHAPES, so `generic-api-key` fires on it and
+  # the required `scan / gitleaks` gate goes red for reasons no commit here
+  # caused (3 findings on `.gitleaks-estate.toml`, run 37023024168).
+  #
+  # Anchored `^...$` -- ROOT ONLY. A path regex matches a BASENAME AT ANY
+  # DEPTH unless anchored, so `(^|/)` would also blind the scanner to a real
+  # `src/.gitleaks-estate.toml`. The reusable only ever writes the file at the
+  # root, so root-only is exact. Same cure as metadatastician/IDApTIK#127;
+  # remove once standards#888 lands and the caller pin is bumped past it.
+  '''^\.gitleaks-estate\.toml$''',
 ]
 
 regexes = [
diff --git a/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc b/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
index 5b0bb884..7f60b6bc 100644
--- a/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
+++ b/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
@@ -11,7 +11,7 @@ confirmation.
 
 == Context
 
-* Token ID: `689fa59a165c47cc61095d984c453205`
+* Token value: [REDACTED — see the incident references below; rotation remains unverified].
 * Leak location: `standards/avow-protocol/deploy-repos.sh:5` commit `5f2f8b2`
 * Token status: **UNVERIFIED** at Cloudflare as of session-end 2026-05-26.
 * Code fix PR `standards#161` MERGED 2026-05-26 — removed the literal token from the file.
@@ -21,7 +21,7 @@ Memory: `project_cloudflare_token_leak_2026_05_21.md`.
 
 == Concrete steps
 
-. **ASK** the user explicitly: "Was Cloudflare token `689fa59a...` rotated?"
+. **ASK** the user explicitly: "Was the leaked Cloudflare token referenced below rotated?"
    Do not proceed without an unambiguous yes.
 . If yes:
 .. Confirm the new token works for whatever workflow depended on the old one.