diff --git a/user/CLAUDE.md b/user/CLAUDE.md
index 3609413..736cf2b 100644
--- a/user/CLAUDE.md
+++ b/user/CLAUDE.md
@@ -95,6 +95,18 @@ asterisks of the same length, overwriting in place so the live session's
 appends are not lost. Read the header before changing it; the same-length,
 same-inode detail is load-bearing.
 
+**Do not mask a throwaway.** He sometimes sets a real password aside, hands you
+a temporary one so you can drive an API — Nginx Proxy Manager, a router, a
+service admin — and reverts it afterwards. Leave those in the history. They are
+worthless once reverted, and he may need to read the value back while he is
+still working. Masking one destroys something he is actively using.
+
+Take his word for which kind it is. "Temporary", "throwaway", "I'll change it
+back", or a password he clearly just invented for this task — leave it. A token
+he pastes from a password manager or a provider console — mask it. When it is
+genuinely unclear, mask it and say so in one line, so he can re-paste if he
+still needs it.
+
 Two habits that matter more than the cleanup:
 
 - **Keep secrets off command lines.** Pass them by stdin or an env var. Argv is