diff --git a/TODO.md b/TODO.md
index bc3d9a2..c78ba00 100644
--- a/TODO.md
+++ b/TODO.md
@@ -126,11 +126,13 @@ Secrets and variables, per environment. The App-token pair is repository-scoped
 | --- | --- |
 | `DEPLOY_SSH_PRIVATE_KEY` | secret |
 | `DEPLOY_SSH_HOST`, `DEPLOY_SSH_USER`, `DEPLOY_SSH_KNOWN_HOSTS` | variable |
-| `DEPLOY_ROOT`, `HUGO_BASEURL` | variable |
+| `HUGO_BASEURL` | variable |
 | `PANGOLIN_ACCESS_TOKEN_ID`, `PANGOLIN_ACCESS_TOKEN` | secret, staging only |
 | `CODEGEN_APP_CLIENT_ID`, `CODEGEN_APP_PRIVATE_KEY` | secret, both stores |
 
-`DEPLOY_SSH_PRIVATE_KEY` now holds the same key in both environments, per the decision above. The environment split still carries the deploy root, the base URL, and the staging-only token pair, so it is not decorative.
+`DEPLOY_SSH_PRIVATE_KEY` holds the same key in both environments, per the decision above. The environment split still carries the base URL, the SSH endpoint, and the staging-only token pair, so it is not decorative.
+
+The deploy root is deliberately absent from this table. The rsync destination is anchored at the deploy key's confinement root, so the workflow names an environment rather than a host path, and a declared-but-unread name is drift no audit can tell from a missing one. The local `DEPLOY_ROOT` in `secrets/<environment>.env` is a different value and is still read.
 
 <!-- Repo -->