diff --git a/CLAUDE.md b/CLAUDE.md
index ea8312f..eb53c54 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -144,6 +144,33 @@ session.
 The default mode is autonomous. The notification is the
 exception, not the rule.
 
+## Bug fixes — TDD, always
+
+Every bug fix is test-driven. Concretely:
+
+1. **Red first.** Before touching the fix, write a test that
+   demonstrates the bug — it must fail on the current code,
+   ideally with output that pins down the symptom (segfault,
+   wrong stdout, refcount underflow, panic). If a minimal
+   reproducer already exists (e.g. handed back by the bencher
+   or debugger), shape the test around that.
+2. **Green second.** Make the smallest change that turns the
+   red test green. No surrounding cleanup, no opportunistic
+   refactor; the fix is the fix.
+3. **Keep the test.** It stays as a regression — never delete
+   it after merging. Future iters that touch nearby code
+   exercise it automatically.
+
+Bug fixes do NOT need orchestrator permission. When a bug is
+unambiguous (build broken, fixture crashes, observable wrong
+output, structured diagnostic from the bench / debugger), the
+fix is autonomous orchestrator work. The user's role is to
+direct *features*, not to gate *fixes*.
+
+A bug fix without a regression test is a code change, not a
+fix. The test is what makes the fix durable across future
+edits.
+
 ## Iter cycle
 
 Work is organised into **iters** — tightly scoped commits that