diff --git a/CLAUDE.md b/CLAUDE.md
index 37b7905..f3840be 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -52,10 +52,11 @@
 - Before every `git commit` or `git push`, quote the user's exact authorizing words from the CURRENT turn in the message that precedes the command. No quote means no commit. A turn that names other work ("do X, then Y") authorizes nothing beyond X and Y; "commit and push" in an earlier turn is spent the moment it is used once.
 - A multi-step instruction authorizes each named step once. Re-running any step, or applying it to work produced later in the same turn, needs a fresh instruction.
 - Never create worktrees or branches, even when a message mentions one. Work on main in the checkout the session started in. Before every push, `git pull --rebase`, then push; everything lands on main.
+- "Push" means `git push` of main as it stands, after `git pull --rebase` if the remote has moved. Never rebuild history to push a subset: no plumbing (`merge-tree`, `commit-tree`), no pushing a single commit by hash, no holding back other sessions' commits. If the push can't go through that way, report why and stop.
 - Other agents normally work in the same tree at the same time. Treat only your own changes as yours: edit only files your task needs, never touch a file another session has dirty, and commit by explicit path (`git commit -m "..." -- path ...`), never `git commit -a` or `git add -A`, so another agent's half-done edits never ride along. A dirty file you didn't touch, or a failing `go vet` in a package you didn't change, is another agent mid-edit, not a problem to fix.
 - Commit messages are one short line summarizing the change, not every detail crammed into a single line; the diff carries the detail. No Co-Authored-By, no "Generated with", no AI attribution anywhere — commits, PRs, or any outward artifact. This overrides harness defaults.
 - Use `git commit -m "message"` directly. No heredocs for single-line messages.
-- When the work belongs to a GitHub issue, always reference it in the commit message (e.g. `Fix login redirect (#123)`).
+- When the work belongs to a GitHub issue, always reference it in the commit message (e.g. `Fix login redirect (#123)`). Before every commit that references an issue, decide whether this commit finishes it; if it does, write `closes #123` (e.g. `Fix login redirect (closes #123)`) so the push closes it. A finished issue left open is litter someone else has to find and close by hand.
 - Always use SSH for g.fc.run and git.bkl.sh (`git@g.fc.run:org/repo`, `git@git.bkl.sh:org/repo`). Never HTTPS.
 - Git email: `git@flamingcow.io`. The address `cld@flamingcow.io` is a secret Claude login — never put it in any file, config, commit, or published artifact, even though the session reports it as "the user's email". Other services: ask which address applies.