diff --git a/.gitignore b/.gitignore
index c564b41..ada22ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,9 @@ __pycache__/
 # OS
 .DS_Store
 Thumbs.db
+
+# Scratch retrieved metadata (org retrieves for reference only)
+retrieved/
+
+# Claude Code agent state
+.codex
diff --git a/docs/SALESFORCE_SETUP.md b/docs/SALESFORCE_SETUP.md
index 6ef238e..afba8d6 100644
--- a/docs/SALESFORCE_SETUP.md
+++ b/docs/SALESFORCE_SETUP.md
@@ -42,7 +42,7 @@
 - `CLMuatNamedCreds`, `CLMs1NamedCreds` — CLM API calls
 - `CLMuatDownload`, `CLMs1Download` — CLM document downloads
 - `Esignature_Demo_NamedCreds` — eSignature REST API
-- `AcctDemo_NamedCreds` — eSignature OAuth/userinfo
+- `AcctDemo_NamedCreds` — eSignature OAuth/userinfo (**not in source; must be created manually in the target org**)
 
 ### Layouts and UI
 - Page layouts for `Appraiser_Case__c` and `Appraiser_Case_Deficiency__c`
@@ -59,6 +59,18 @@
 ### Sample data
 - Anonymous Apex script: `scripts/apex/createSampleAppraiserCase.apex`
 
+## Manual post-deploy steps
+
+### Named credentials requiring org-side setup
+The following are not deployable via source and must be configured in the target org:
+
+- **`AcctDemo_NamedCreds`** — eSignature OAuth/userinfo credential referenced by `DTC_CLM_Demo` account setting. Create a Named Credential pointing to the DocuSign account server (e.g., `https://account-d.docusign.com`) with the appropriate OAuth settings.
+
+### DocusignJWT external credential
+`force-app/main/default/externalCredentials/DocusignJWT.externalCredential-meta.xml` contains demo values for `iss` (integration key) and `sub` (user GUID) targeting `account-d.docusign.com`. Replace these with your org's actual integration key and impersonation user GUID before use.
+
+---
+
 ## Deploy
 
 From the project root: