diff --git a/TODO.md b/TODO.md
index 0b2cf7e..07353b8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -201,6 +201,11 @@ English magazine text before it is marked complete.
   `docker-compose.yml`, since that host has no `.git` checkout of its own to diff against, only the rsynced tree.
   A code change means: re-rsync the tree (excluding `.git`, `config/`, `logs/`), `docker compose build`, `docker
   compose up -d` — no separate push/pull step, same as the DGX's own bind-mount-and-recreate pattern.
+  **Footgun confirmed 2026-09-27:** `docker-compose.yml` must ALSO be excluded from the rsync (`--exclude
+  docker-compose.yml`) — otherwise it silently overwrites the NUC's own compose file with the DGX's (wrong
+  `build`/`image`, `dgx_net`/`docker-socket-proxy` the NUC doesn't have), and `docker compose up -d` then fails with
+  `network dgx_net declared as external, but could not be found`. Recovery: `cp docker-compose.nuc.yml
+  docker-compose.yml` on the NUC, then `up -d --force-recreate`.
 
 ## Deferred — public multi-user readiness (cross-app initiative)