diff --git a/CLAUDE.md b/CLAUDE.md
index 2545d5f..81005a4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -100,6 +100,12 @@ below are the procedure — run them in order, every task, not only the big ones
    without having read the diff yourself. A refusal is exactly when that shortcut is tempting,
    because no action is left that forces you to look, and taking it turns this step into
    forwarding a reviewer's verdict — which is delegating the merge by proxy, two lines above.
+   **Test a refusal; do not read it off a permissions field.** A protected branch holds its merge
+   rights separately from the repository permissions, so that field can say yes while the merge is
+   refused, and still say no after a grant makes it work. Probe instead, with a request that cannot
+   succeed on its merits, so a rejection can only mean the refusal. Treat a transport failure as a
+   third answer that proves nothing: a timeout, a DNS error or a bad URL is not a refusal, and
+   counting it as one makes you sure of something you never measured.
 
 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,