diff --git a/CLAUDE.md b/CLAUDE.md
index 66bd6a5..b086f36 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,10 +31,18 @@ force-overwrites divergent state. Issues/wiki/releases stay on Gitea. The same r
 applies to ThreadNet-Web, threadnet-call, thread-net-git and threadnet-operating; only
 the `Backlogs` repo (and this repo's wiki) are still direct-to-Gitea.
 
+**Exception that needs manual handling**: the monthly TURN-rotation CronJob runs in the
+cluster (no route to git.lab) and still opens its PR on Gitea. Never merge that PR on
+Gitea — instead fetch the rotation branch, merge it into main locally, push to git.lab;
+the mirror carries it back, Gitea auto-closes the PR (worked example: 2026-08-01,
+commit 640c934). If the mirror lags, force it: GitLab API
+`POST /projects/<id>/remote_mirrors/<mirror_id>/sync`.
+
 ## Repository Structure
 
 ```
 gitops/
+├── .gitlab-ci.yml            # Lab-CI verify job (YAML validation + SOPS-encryption check)
 ├── clusters/matrix/          # Flux GitRepository definition; entry point for reconciliation
 ├── apps/
 │   ├── base/