diff --git a/CLAUDE.md b/CLAUDE.md
index 10fb221..9d888a1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,6 +60,10 @@ All shippable work commits **directly to `main`**; `main` is always equal to wha
 - Add debug capabilities (logging, verbose output) for easier troubleshooting
 - If you need more input or troubleshooting command output, ask first — don't guess
 
+## Live validation
+
+Live validation of a user-facing feature must exercise the real UI/user flow end-to-end (e.g. connect → enroll → deploy), not shortcut via direct API/agent/CLI calls — a shortcut can give false confidence and leave the system inconsistent (see the F9 storage episode). Low-level mechanism tests where the direct call IS the mechanism are exempt.
+
 ## Environment
 
 | Machine | OS | IP | Purpose |