diff --git a/PROCESS.md b/PROCESS.md
index 3a7bf13..c3c5621 100644
--- a/PROCESS.md
+++ b/PROCESS.md
@@ -12,13 +12,13 @@ milestone/p<N>-<name>                 one per phase in docs/MILESTONES.md; creat
         │  PR when the phase exit criteria are met (CI green on the milestone branch)
         ▼
 dev                                   integration; deployed to the preview environment; soak-tested
-        │  PR only from dev (promotion guard) with CI green; squash or merge commit, tagged
+        │  PR only from dev (promotion guard) with CI green; merge commit, tagged
         ▼
 main                                  production; protected; never receives direct pushes
 ```
 
 Rules:
-- `main` and `dev` are protected: PRs only, required checks (`CI` jobs + `Promotion guard`), no force-push, linear history on `main`.
+- `main` and `dev` are protected: PRs only, required checks (`CI` jobs + `Promotion guard`), no force-push, no deletions. Promotions are **merge commits** (not squash/rebase) so `dev` and `main` share history and each phase stays traceable.
 - Milestone branches are `milestone/p0-toolchain`, `milestone/p1-security`, … (names in `docs/MILESTONES.md`). They are deleted after their PR into `dev` merges; the next milestone branch is cut from the updated `dev`.
 - Work branches are cut from the current milestone branch and merged back into it by PR. They never target `dev` or `main`.
 - `hotfix/*` may target `dev` directly (and is then promoted to `main` through `dev`); it is the only exception.
diff --git a/scripts/github/protect-branches.sh b/scripts/github/protect-branches.sh
index 03ca22d..eac3729 100644
--- a/scripts/github/protect-branches.sh
+++ b/scripts/github/protect-branches.sh
@@ -10,7 +10,7 @@ REPO="${1:-$(gh repo view --json nameWithOwner -q .nameWithOwner)}"
 CHECKS='"Lint · Typecheck · Secrets","Unit · Integration","Build · Audit · Size","Check source branch"'
 
 protect() {
-  branch="$1"; linear="$2"
+  branch="$1"; linear="$2" # linear history stays off: promotions are merge commits (PROCESS.md)
   echo "Protecting $REPO:$branch"
   gh api -X PUT "repos/$REPO/branches/$branch/protection" \
     -H "Accept: application/vnd.github+json" \
@@ -31,6 +31,6 @@ protect() {
 JSON
 }
 
-protect main true
+protect main false
 protect dev false
 echo "Done. Verify under Settings → Branches."