diff --git a/backend/src/main/resources/content/processes/develop/overview.md b/backend/src/main/resources/content/processes/develop/overview.md
index 3a1dbce..dc57ea7 100644
--- a/backend/src/main/resources/content/processes/develop/overview.md
+++ b/backend/src/main/resources/content/processes/develop/overview.md
@@ -99,8 +99,11 @@ intentionally stay on `main` (no `develop`): `hiveops-src`, `hiveops-docs`, `hiv
    `processes.*`, `technical.*`, and `audience: bcos`/`internal` tabs never ship to prod.
 9. **PR `develop` → `main`.**
 10. **Reconcile the issue** and place it in the target **milestone** (e.g. `2026-08`). Use `Refs #N`
-    in PRs, never `Fixes/Closes #N` (auto-close bypasses the Verify Fix → Tristan gate). Assign by
-    type: frontend → Tristan, backend → Johannes.
+    in PRs **and commit subjects**, never `Fixes`/`Closes`/`Resolves #N` (auto-close bypasses the
+    Verify Fix → Tristan gate). This applies to **commit messages too**, not only PR bodies: Gitea
+    scans commits merged to `main` for closing keywords, so a subject like
+    `fix(x): … close … (#N)` will close `#N` on release — keep `close`/`fix`/`resolve` away from any
+    `#ref`. Assign by type: frontend → Tristan, backend → Johannes.
 11. **Prod decision.** Decide **together**: manual build + deploy to production now
     ([[processes.main]]), or leave it for the next release window ([[processes.release]]).
 
@@ -116,6 +119,10 @@ intentionally stay on `main` (no `develop`): `hiveops-src`, `hiveops-docs`, `hiv
   bootstrap config, needed before a session can call this API.
 
 ## Do NOT
+- Do NOT put `Closes`/`Fixes`/`Resolves #N` in a PR body **or a commit subject** — it auto-closes
+  the issue on merge to `main`, silently defeating the Verify Fix → Tristan gate. Use `Refs #N`, and
+  keep those keywords away from any `#ref` even incidentally (a subject like `… close … (#N)` is
+  enough). Real incidents: hiveops-auth#68, hiveops-incident#329 (`hiveiq-ops/hiveiq-devops#58`).
 - Do NOT commit directly to `main` or bypass branch protection.
 - Do NOT skip the bcos.dev smoke test (⑦) or the Guide update (⑧) before promoting.
 - Do NOT write a frontend page from scratch or build on a non-conformant one (③).