diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index f0e2ae7..9716e65 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -116,10 +116,13 @@ services:
   #      should show "✅ adminNpubs: npub1..."
   nsecbunker:
     # Builds from the aiolabs/nsecbunkerd fork checkout at
-    # ${NSECBUNKER_SRC:-~/dev/nsecbunkerd/master} — carries all our
-    # upstream-rot patches (#1-#5, #8) so the build works from a clean
-    # clone. See aiolabs/nsecbunkerd for the catalog of patches.
-    build: ${NSECBUNKER_SRC:-/home/padreug/dev/nsecbunkerd/master}
+    # ${NSECBUNKER_SRC:-~/dev/nsecbunkerd/dev}. The `dev` worktree
+    # carries the #7-diagnosis series (kind-fix, db migration entrypoint,
+    # nix flake fixes, transport instrumentation) on top of the master
+    # baseline (upstream-rot patches #1-#5, #8). Once dev is merged to
+    # master, this default can swap back to `master/`. See aiolabs/
+    # nsecbunkerd dev branch and ~/dev/coordination/log.md 2026-05-27.
+    build: ${NSECBUNKER_SRC:-/home/padreug/dev/nsecbunkerd/dev}
     hostname: nsecbunker
     restart: on-failure
     pids_limit: 100
@@ -128,6 +131,10 @@ services:
     environment:
       DATABASE_URL: "file:/app/config/nsecbunker.db"
       ADMIN_NPUBS: ${NSECBUNKER_ADMIN_NPUBS}
+      # Per-relay publish-status diagnostic logging for aiolabs/nsecbunkerd#7.
+      # Set to '1' in .env or shell to enable REQUEST_IN / RESPONSE_SENT /
+      # PUBLISHED / PUBLISH_FAILED instrumentation. Default off.
+      NSEC_BUNKER_DEBUG_TRANSPORT: ${NSEC_BUNKER_DEBUG_TRANSPORT:-0}
     volumes:
       - ./data/nsecbunker:/app/config