diff --git a/vaultwarden/vaultwarden.env b/vaultwarden/vaultwarden.env
index 637a90f..fa1af21 100644
--- a/vaultwarden/vaultwarden.env
+++ b/vaultwarden/vaultwarden.env
@@ -1,7 +1,7 @@
 # Vaultwarden - Pattern B env (folder-mode); ADMIN_TOKEN/DATABASE_URL are Docker secrets
 # 2026-07: DATABASE_URL secret rotated to point at 'postgresql' alias instead of 'db'
 # as part of PostgreSQL HA migration prep (ADR-0001).
-# Retry #6: found and fixed the actual root cause -- 3DPRINT_DB_PASSWORD env var alias
-# started with a digit (invalid per POSIX), likely poisoning the whole environment
-# block for provision-secrets and causing SWARM_MANAGER_IP to read empty in that
-# step specifically. Renamed to PRINT3D_DB_PASSWORD. This should be the real fix.
+# Retry #7: TRUE root cause found via full-length diagnostic -- Woodpecker substitutes
+# ${VAR} at pipeline-compile time (secrets absent from that map -> empty string baked
+# into the script). All runtime secret refs now escaped as $${VAR}. This trigger
+# should finally provision vaultwarden_database_url_v2 and roll the service.