diff --git a/.claude/commands/syncro.md b/.claude/commands/syncro.md
index 4656c0a..02f9935 100644
--- a/.claude/commands/syncro.md
+++ b/.claude/commands/syncro.md
@@ -23,6 +23,16 @@ Create, update, close, comment on, and bill tickets in Syncro PSA.
 **Rate limit:** 180 requests/minute per IP
 **Docs:** https://api-docs.syncromsp.com/
 
+## Hard Rules (violations have occurred — no exceptions)
+
+**Before any POST:** Always show the full payload to the user and wait for explicit confirmation. This applies to tickets, comments, line items, and invoices — including hidden/internal notes.
+
+**After any ambiguous POST result** (null fields, jq error, curl error, timeout): Do NOT retry. GET the resource first to confirm whether the action succeeded. Syncro has no idempotency on any endpoint — one POST always creates one record. Duplicate tickets and comments cannot be deleted via API; comments require manual GUI removal.
+
+**Ticket response shape:** `{"ticket": {...}}` — always use `.ticket.id`, never `.id`. The flat-object jq pattern silently returns nulls and looks like failure when it isn't.
+
+**Billing:** Always ask for minutes and labor type before adding any line item. Never assume a default.
+
 ## Implementation
 
 When invoked, use the Syncro REST API via `curl`. All requests include `?api_key=<key>` as query parameter (NOT in header — Syncro uses query param auth).