diff --git a/CLAUDE.md b/CLAUDE.md
index 4dad52b..50a8dac 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -150,6 +150,8 @@ After every PR (or PR stack) merges to main:
 - **Library-first UI**: Always prefer existing library components (Taiga UI, Angular CDK) over custom HTML + CSS implementations. Writing custom UI or logic without justification is NG. Taiga UI components are customizable via CSS custom properties (`--tui-*`) — override tokens in `styles.css` rather than reimplementing from scratch.
 - **Library-source-first debugging (mandatory, not advisory)**: When a library, framework, or infra tool (Dependabot, GitHub Actions, Docker, pnpm) behaves unexpectedly — OR before proposing a fix for a config error in any of these tools — read the official documentation and search the issue tracker for the exact error message **before writing any fix**. This applies to the very first fix attempt, not only after subsequent failures. Empirical trial-and-error without reading the source produces multiple fix commits for the same root cause. Minimum: read the relevant config reference, check the changelog for breaking changes in the version in use, and search GitHub Issues / Discussions for the exact error message.
 
+- **Verify before asserting (mandatory)**: Check it, get corroboration, and assert as fact only what that corroboration established. Every factual claim written into an issue, PR body, plan, commit message or review — "absent from `git ls-files`", "the build passes", "the tests were run" — comes from a command actually executed in the session that writes it. Anything not yet corroborated is either verified before it is written, or written as an explicitly labelled hypothesis. A claim that was never checked reads exactly like a measured one to every later reader, so it passes review and gets acted on.
+
 ## Testing
 
 - **Boundary-first**: Always test application boundaries — HTTP controllers, WebSocket gateways, pipes. Internal service logic is tested only where needed to reach the coverage target.