diff --git a/vibe/guidebooks/factory-provisioning/ansible/README.md b/vibe/guidebooks/factory-provisioning/ansible/README.md
index f5dd516..9ec705c 100644
--- a/vibe/guidebooks/factory-provisioning/ansible/README.md
+++ b/vibe/guidebooks/factory-provisioning/ansible/README.md
@@ -118,3 +118,10 @@ flowchart LR
 | 06 | [Recover](06-recover.md) | Longhorn + data restore (on-demand DR branch) | 🟡 |
 | — | [Inventory & variables](inventory.md) | `hosts.yml` groups, `group_vars/` layering, host→service mapping | ✅ |
 | — | [Roles reference](roles.md) | The seven `arcodange.factory.*` roles | ✅ |
+
+---
+
+## Maintenance rule
+
+> [!IMPORTANT]
+> **Alter a playbook, role, inventory entry, or `group_vars` → update the matching page here in the same change.** Adding a stage, renaming a role, bumping the K3s version or a `requirements.yml` dependency, or moving a host between groups all change what the pages above describe — edit the page in the PR that changes the code, never as a follow-up. This is the [factory-provisioning maintenance rule](../README.md#maintenance-rule) applied to the Ansible half; the guidebooks' full [Rules to contribute](../../README.md#rules-to-contribute) also apply.
diff --git a/vibe/guidebooks/factory-provisioning/opentofu/README.md b/vibe/guidebooks/factory-provisioning/opentofu/README.md
index 9362cd6..b7c08f7 100644
--- a/vibe/guidebooks/factory-provisioning/opentofu/README.md
+++ b/vibe/guidebooks/factory-provisioning/opentofu/README.md
@@ -93,3 +93,10 @@ flowchart TD
 | [factory iac](factory-iac.md) | `iac/` root — Gitea, Vault, Google/GCS backup, Cloudflare, OVH | ✅ |
 | [postgres iac](postgres-iac.md) | `postgres/iac/` root — PostgreSQL roles & databases on pi2 | ✅ |
 | [CI apply flow](ci-apply-flow.md) | Both Gitea workflows, the Vault-JWT exchange, auto-approve apply | ✅ |
+
+---
+
+## Maintenance rule
+
+> [!IMPORTANT]
+> **Alter a `.tf` resource, a provider version, a state backend, or a CI workflow → update the matching page here in the same change.** Adding a resource to `iac/`, changing the `postgres/iac/` application list, bumping a provider pin, or editing `iac.yaml`/`postgres.yaml` all change what the pages above describe — edit the page in the PR that changes the code, never as a follow-up. This is the [factory-provisioning maintenance rule](../README.md#maintenance-rule) applied to the OpenTofu half; the guidebooks' full [Rules to contribute](../../README.md#rules-to-contribute) also apply.