diff --git a/.gitignore b/.gitignore
index 29c0f9d..a4881a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,9 @@
+# local
+.claude/settings.local.json
+.venv/
+notes.md
+WORKFLOW.md
+# opentofu
 *.tfvars
 *.tfvars.json
 *.tfstate
@@ -10,18 +16,28 @@
 # traffic including the live API token - regardless of TF_LOG.
 crash.log
 crash.*.log
+# Live container env files; commit only the .env.example templates.
+.env
+# operator
+fingerprints/**
+!fingerprints/.gitkeep
+inventory/*.yaml
+!inventory/example.yaml
+# age/sops
 keys.txt
 *.agekey
 # Decrypted copies of secrets.enc.json (sops -d > ...).
 *.dec.json
 secrets.json
-/logs/**
-!/logs/.gitkeep
-# Live container env files; commit only the .env.example templates.
-.env
 # otel-lgtm: reference/ is a scratch clone of the upstream otel-lgtm repo for
-# research into the container's internals; tmp/ is scratch space.
+# research into the container's internals
 /otel-lgtm/reference/
-/otel-lgtm/tmp/
 # Windmill
 /windmill/local-dev/node_modules/
+# logs/private
+/logs/**
+!/logs/.gitkeep
+private/**
+!private/.gitkeep
+# scratch
+tmp/
diff --git a/README.md b/README.md
index 6216049..f882977 100644
--- a/README.md
+++ b/README.md
@@ -181,6 +181,21 @@ files are gitignored.
   re-run ansible, capture again to the same path: an empty `git diff` is the
   proof, now spanning both layers.
 
+Short version of the command sequence to destroy, recreate, and validate the fingerprint assuming the inventory entry is for a VM called ubuntu-test at an IP of 10.1.1.5.
+
+```sh
+source tofu.env
+git mv inventory/ubuntu-test.yaml inventory/destroy/
+tofu apply
+git mv inventory/destroy/ubuntu-test.yaml inventory/
+tofu apply
+ansible-playbook ansible/site.yaml --limit ubuntu-test
+./scripts/vm-fingerprint.sh ubuntu@10.1.1.5 fingerprints/ubuntu-test.txt
+git diff fingerprints/ubuntu-test.txt
+```
+
+NOTE: The inventory/destroy directory name is intentional, so it is clear what the next "tofu apply" is expected to do.
+
 ## Layer 2: Ansible
 
 Cloud-init is decided at first boot and reachable only by recreating the VM —
diff --git a/docs/.gitkeep b/docs/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/fingerprints/.gitkeep b/fingerprints/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/private/.gitkeep b/private/.gitkeep
new file mode 100644
index 0000000..e69de29