diff --git a/CLAUDE.md b/CLAUDE.md
index 2669e0c..be53cde 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -18,9 +18,9 @@
 **ABSOLUTE RULE**: ALL fixes go through CI/CD and Salt. No exceptions.
 
 - **NEVER** SSH into prod and run `ALTER TABLE`, `sqlite3`, or any direct DB command
-- **NEVER** manually restart services, copy files, or apply patches via SSH
 - **NEVER** bypass the migration system — if `alembic upgrade head` fails, fix the migration and push
-- **The fix is always in the code.** Push to master → CI tests → Salt highstate → Alembic runs on every instance
+- **The fix is always in the code.** Push to master → CI tests → deploy (Salt highstate or CI-direct) → Alembic runs on every instance
+- Restarting services via SSH is fine for recovery, but the underlying fix must still go through code + deploy
 
 **Why this matters**: MPS runs open source on multiple servers (makepostsell.com, memopoly.com, and any operator instance). A manual fix on one server leaves every other instance broken. The migration system exists to apply changes everywhere consistently.