diff --git a/tools/export-github.sh b/tools/export-github.sh
index baf9c824..6cbf194d 100755
--- a/tools/export-github.sh
+++ b/tools/export-github.sh
@@ -121,6 +121,12 @@ done
   fi
 )
 
+# NOTE ON EXCLUDES: this walks the WORKING TREE, so .gitignore does not apply.
+# Anything ignored-but-present has to be named here or it reaches publication -
+# how a stray .env.bak once did, and how devnotes/ (local review writeups, chat
+# handoffs) did. The scrub gate catches such things, which is the point, but a
+# gate failure is a stop, not a filter: add the exclude rather than deleting
+# your notes to get a bundle out.
 rsync -a --delete \
   --exclude '.git' \
   --exclude '.gitea' \
@@ -129,6 +135,7 @@ rsync -a --delete \
   --exclude '/docs/*' \
   --exclude '/tools' \
   --exclude '/mcp' \
+  --exclude '/devnotes' \
   --exclude 'start-api.sh' \
   --exclude 'start-ui.sh' \
   --exclude 'CLAUDE.md' \