diff --git a/.cursor/rules/story-end.md b/.cursor/rules/story-end.md
index 96603c8..97e1871 100644
--- a/.cursor/rules/story-end.md
+++ b/.cursor/rules/story-end.md
@@ -16,7 +16,11 @@ When the user **ends story work** on a ticketed branch—phrases like “end sto
 
 1. **`git checkout main`**
 2. **`git pull origin main`** (or `git pull` if `main` already tracks `origin/main` and that is correct for this repo)
-3. **`git branch -d <story-branch>`** — use the branch that was used for the issue (first path segment should be the Jira key, e.g. `NS-19-move-validation`). If Git reports “not fully merged”, **stop** and tell the user; do not `-D` unless they ask.
+3. **`git branch -d <story-branch>`** — use the branch that was used for the issue (first path segment should be the Jira key, e.g. `NS-19-move-validation`). If Git reports “not fully merged”, confirm whether **`origin/main`** already contains the story (e.g. squash merge or follow-up commits only cherry-picked to `main`). If yes, **`git branch -D <story-branch>`** is OK **only with user confirmation** so local unpushed tip is not lost by mistake.
+
+## 2a. When `main` is push-protected
+
+If the user asks to **push** changes that sit on **`main`** and **`git push origin main` fails** (required PR / status checks), create a branch from current `main` (e.g. `chore/…`), **`git push -u origin`** that branch, give them the PR link, then **`git reset --hard origin/main`** if you had temporarily advanced local `main` so local `main` matches remote until the PR merges.
 
 ## 3. What not to do