docs: never operate on production directly — always CI/CD and Salt

CLAUDE.md

@@ -13,6 +13,19 @@
 - Timestamps in DB are **milliseconds** not seconds (13 digits)
 - uWSGI: 2 processes, 8 threads, reload-on-rss 512MB (pillar-configurable), Caddy reverse proxy on :6001
 
+### 🚨 NEVER Operate on Production Directly
+
+**ABSOLUTE RULE**: ALL fixes go through CI/CD and Salt. No exceptions.
+
+- **NEVER** SSH into prod and run `ALTER TABLE`, `sqlite3`, or any direct DB command
+- **NEVER** manually restart services, copy files, or apply patches via SSH
+- **NEVER** bypass the migration system — if `alembic upgrade head` fails, fix the migration and push
+- **The fix is always in the code.** Push to master → CI tests → Salt highstate → Alembic runs on every instance
+
+**Why this matters**: MPS runs open source on multiple servers (makepostsell.com, memopoly.com, and any operator instance). A manual fix on one server leaves every other instance broken. The migration system exists to apply changes everywhere consistently.
+
+**When prod has a 502**: diagnose via logs (read-only SSH is fine), fix the code, push. The deploy pipeline reaches all instances. A manual fix reaches one.
+
 ### Media Architecture
 
 Files are NEVER streamed through uwsgi. Our server only generates presigned URLs (15 min TTL). Our client's browser/JS fetches directly from our Spaces CDN:
@@ -383,5 +396,31 @@ Every webapp calling `bleach.clean(user_html)` is exposed — this is our correc
 
 ## Style
 
-- Never use "the" — use "our" instead.
+- Prefer "our" for shared things; "a" when something is one of many; avoid "the" — it implies fixed, singular ownership. Most teams and systems are fluid and ever-changing, like water.
 - **Never use "AI" — always say "machine learning."** We grow machine learning, not "AI." This term is forbidden in all permacomputer discourse, marketing, & documentation.
+
+## Prime Mission — Balance All Workstations
+
+Every node is a workstation. Every edge is a queue. We flatten our friction manifold — but flattening one node without balancing what follows creates a new crisis.
+
+**MOAD-0001 & MOAD-0005 are coupled.** Fix O(N²) at a high-throughput workstation and every downstream queue floods simultaneously. Solving one defect creates the other if we do not stage capacity first.
+
+**3 drivers. 3 million people.** Fix the dispatch. Stage the drivers first.
+
+- **Workaholic node** (high betweenness + high speedup): IS our bottleneck. Unblock without staging = collapse.
+- **Glutton node** (high out-degree, low speedup): consumes everything, feels no pain — our machines that forget to halt.
+- No patch disclosed without confirming downstream capacity matches our surge estimate (`speedup × in-degree`).
+- Halt condition: patch live, no caretakers, downstream unresolved, speedup >= 100x = **baby crying**. Assign team first.
+
+Full factory model & live DAG: `~/git/undefect.com/generate_dag.py`.
+Shard source of truth: `~/git/unsandbox.com/blackops/BLACKOPS.md`.
+
+### Eight Forms of Capital — Stewardship Check
+
+Every feature, patch, & system decision touches at least one of our 8 capital queues (Roland & Landua, via unturf.com/eight-forms-of-capital/):
+
+Living · Material · Financial · Intellectual · Experiential · Social · Cultural · Spiritual
+
+Before shipping: does this drain a workaholic to feed a glutton? Does it route away from a food desert? Does it grow financial capital at the expense of living capital? If yes — stop. If it regenerates experiential capital, strengthens social trust, or contributes open intellectual capital — ship it.
+
+Platform tax = O(N²) friction in our exchange layer. Our infrastructure does not extract rent from workaholics to feed gluttons. That is our obligation as permacomputer stewards. Full ledger: `~/git/unsandbox.com/blackops/BLACKOPS.md`.