diff --git a/CLAUDE.md b/CLAUDE.md
index 8cb44be..5b1ecd6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -78,7 +78,14 @@ Selftest modes (run from the build server, pointed at the demo API):
 
 ## Conventions
 
-- Push to `main` directly; no feature branches.
+### Trunk-based — no branches
+
+All shippable work commits **directly to `main`**; `main` is always equal to what is deployed. **Do NOT create feature/fix branches.**
+
+- **Report-only artifacts** (audits, findings, fixspecs, reconciliations) → `felhom.eu/documentation/` (`audits/`, `backlog/`), committed to `main`. Never a branch, never left loose at the repo root.
+- **Risky/supervised fixes** (agent / golden / provisioning / destructive) are spec'd, then implemented **during the supervised session itself, directly on `main`** — not prepared ahead on a branch. (This is the common case for *this* repo.)
+- **Unattended escape hatch:** if a fix can't be cleanly verified/shipped, **revert it and report it** for a supervised redo (or paste the diff into the spec doc in `documentation/`) — do not park it on a branch.
+- This supersedes any older "prepared on branch `fix/…`, pending review" pattern.
 
 > **In every repository where you make a change, update both files in that repo:**
 > - **`CHANGELOG.md`** — a cumulative log of **all** changes; newest entry on top.