diff --git a/CLAUDE.md b/CLAUDE.md
index 70e2feea3..d69e89184 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -129,7 +129,8 @@ The Mac crashed and rebooted under agent load (about twenty lanes, local cargo t
 
 ## CI red is stop-the-line (standing rule, 6 October 2026, 22:0x UK)
 - Whoever's merge turns master or a release-* branch red owns the fix inside 15 minutes or reverts the merge; the red watcher posts every failed run to the hidden updates channel and to /srv/ci-red/red.jsonl on the box (tools/ci/red-watch.mjs); the box's own red builds land in the same file with a class (remote-run.sh pre-flight, kept run logs) and the 09:00 UK digest counts them per class with each class's guard.
-- The pre-push gate is the same script CI runs: `tools/ci/pre-push.sh` (installed by `tools/ci/install-hooks.sh`; `--hook` before a push to master or release-*, `--ci` in the workflow). A check is added there, never only in ci.yml.
+- The pre-push gate is the same script CI runs: `tools/ci/pre-push.sh` (installed by `tools/ci/install-hooks.sh`; `--hook` before a push to master or release-*, `--ci` in the workflow). A check is added there, never only in ci.yml. On a feature branch the hook runs the light gate: the two structural checks plus the two never-push classes, the no-secrets check and the identity grep (7 October 2026).
+- After every push, the pushing lane reads its CI conclusion (`gh run list --branch <branch> --limit 1` until it is not in progress, then `gh run view <id> --log-failed` on a red) and owns any red before its next push; a red on any branch is reported to main the moment it is seen. The red watcher posts every failed run on every branch (branch, commit, red check, pushing author). Record: 7 October 2026, 11:26 to 12:47 UK, eight red runs on ca3-v4-node over three gate summaries carrying a 64-hex key, read by nobody.
 - Research and operations documents live outside the public export list: name them in `tools/ci/export-exclude.txt` (read by the identity check and by the mirror's sync.sh). What stays in the list is read by the public and must pass the identity grep.
 - A path Windows cannot hold (colon, trailing dot or space, reserved name, over 240 characters) never enters a commit: the pre-commit hook runs `tools/ci/windows-paths-check.sh --staged`.
 - Record: docs/analysis/ci-failures-2026-10-06.md (168 non-green runs in three days classified; 126 on master; all but two classes were tree checks that the gate now runs locally first).