diff --git a/docs/agents/port-loop.md b/docs/agents/port-loop.md
index e1c90f80..3cd25bdb 100644
--- a/docs/agents/port-loop.md
+++ b/docs/agents/port-loop.md
@@ -89,6 +89,39 @@ what a given instrument killed, so those re-open when it improves. Grep
 5. [`TEMPORAL-VERIFICATION.md`](TEMPORAL-VERIFICATION.md) — binding on anything
    that moves.
 
+## Each iteration
+
+The Decoder's brief has had this section since 2026-09-04; this one did not, so
+the rules below were stated but the *steps* that carry them out were never
+written down. Steps 1 and 8 are the ones that were missing entirely.
+
+1. **Read your notifications**, then `git fetch origin && git merge origin/main`.
+   Notifications are **polled — nothing pushes them.** If you skip this, nothing
+   addressed to you ever arrives, and it looks like silence rather than an error.
+2. **Pick one item** — the highest-priority `state/approved` issue that is yours.
+   Mid-item? Continue it.
+3. **Build the smallest thing that reaches a gate.** A gate is an **artifact**,
+   never "it compiles".
+4. **Verify against captures of the real game, not against our renderer**, and
+   **state the expected number before you measure it.** Where a capture and
+   `sylpheed-cli screen render` disagree, say which is wrong rather than tuning
+   until they agree.
+5. **Classify every value you author.** Exactly one of: **decoded** (a spec in
+   `docs/re/`, cited by path) · **measured** (the Decoder measured it off the
+   running game, with the capture) · **authored** (you chose it — it goes in
+   `authored/` with its `why`, and it is *not* a measurement). Never a fourth
+   thing, and never an invented number where a measured one is pending.
+6. **Refute something.** Each iteration, attempt to refute one claim — another
+   agent's, or one of your own from a previous iteration — and record the
+   attempt whether or not it survived.
+7. **Write it down** in `docs/port/`, and record the `HANDOFF.md` sha you built
+   against.
+8. **Commit, `push-work`, open the PR**, label the issue `state/needs-human`, and
+   **stop.** One unit per iteration; do not stack a second on an unverified
+   first. ⚠️ `push-work` **only pushes** — it does not open the PR and does not
+   set the label. Those are two separate MCP calls (`pull_request_write`,
+   `issue_write`), and they are the two most commonly skipped steps in this list.
+
 ## The wall
 
 The Godot project **never reads a disc format**. No IPFB, RATC, T8aD, XMA or WMV.