diff --git a/AGENT.md b/AGENT.md
index ce13815d..bf16ebb3 100644
--- a/AGENT.md
+++ b/AGENT.md
@@ -122,6 +122,11 @@ no unique law and does not satisfy this rule.
 
 ## Landing
 
+Landing is not a separate errand you propose — it is the last step of the work
+order, and it happens in the same session without asking. "Committed on a
+branch, want me to land it?" is the permission request this section already
+removed. Ask about the work; never about the merge.
+
 Rebase the task branch onto current `origin/main`, rerun the appropriate
 scoped verification, merge and push to main directly, then remove the worktree
 and delete the task branch. The PR rule was removed 2026-07-07. Prefer
@@ -129,4 +134,12 @@ and delete the task branch. The PR rule was removed 2026-07-07. Prefer
 it builds the exact landed revision and publishes the public corpus to the
 orphan `pages` branch. A manual landing must run `./tools/site-deploy.sh` after
 the `main` push. Use `./tools/site-smoke.sh` to prove the public edge names the
-landed source revision before reporting a public-site change complete.
+landed source revision before reporting a public-site change complete; the edge
+lags the push by minutes, so `SITE_SMOKE_ATTEMPTS=12` is the normal invocation.
+
+`task.sh finish` needs a `tools/heartbeat.sh` run that owns the worktree plus
+`AGENT_ID`; a session without one lands manually rather than skipping the step.
+A shared checkout dirtied by another session cannot fast-forward — pushing
+`worktree-<task>:main` straight from the task worktree lands without touching
+that work, and the site scripts run there too since they resolve their root
+from their own path.
diff --git a/CLAUDE.md b/CLAUDE.md
index 5fdb23d5..29bec7e6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -17,6 +17,17 @@ afterward.
 
 ## Current guardrails
 
+- **Finish means landed.** Completed work whose checks pass gets rebased onto
+  current `origin/main`, pushed to `main`, published with
+  `tools/site-deploy.sh` + `tools/site-smoke.sh`, and its worktree removed —
+  in the same session, without asking. Do not stop at "committed on a branch,
+  want me to land it?"; that is the ask, restated. If the shared checkout is
+  dirty with another session's work, `git merge --ff-only` there aborts: push
+  straight from the task worktree (`git push origin worktree-<task>:main`) and
+  run the site scripts from the worktree, which resolve their root from their
+  own path. `site-smoke.sh` usually needs `SITE_SMOKE_ATTEMPTS=12`; the public
+  edge lags the push by minutes. Ask only when the *work itself* is genuinely
+  undecided — never about the merge.
 - Start repository work with the [tick](wiki/process/tick.md):
   `tools/tick-brief.sh` is the intake (commits, activity, status, decision
   labels, findings queue, stalest coverage in one shot); work the queues