diff --git a/.cursor/BUGBOT.md b/.cursor/BUGBOT.md
index e4e67b7..df9d63c 100644
--- a/.cursor/BUGBOT.md
+++ b/.cursor/BUGBOT.md
@@ -125,3 +125,11 @@ consequence — what they see, and which exit code they get — not just the cod
 
 This repo is **public**: never put a customer name, internal hostname, or internal-only ticket
 detail in a finding. A bare `tracebloc/backend#NNNN` reference is fine.
+
+## Working with Bugbot findings (team norm)
+
+Every Bugbot review thread gets a reply, then gets resolved:
+- **Fixed**: say what changed and in which commit.
+- **False positive**: say why, with evidence (file/line, measured behavior).
+Unresolved cursor threads HOLD release-train promotions (soft gate) — an
+unaddressed finding blocks the fleet, not just this PR.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 15123e4..2fe3a99 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -105,3 +105,7 @@ Coverage says a line *ran*; mutation testing says a test would *fail* if the lin
 4. File one issue per real gap, titled `test(<pkg>): pin <behavior> (mutation survivor)`, quoting the gremlins line (mutant type + file:line) and what behavior the missing test must pin. That issue then flows through the kanban like any other test ticket — #262, #263, #264 are the pattern.
 
 Survivors are *findings to triage*, not build failures — the workflow stays green even when mutants live, on purpose.
+
+## Bugbot findings
+
+See `.cursor/BUGBOT.md` — every thread gets a reply (fixed / false-positive-with-evidence), then resolved.