Flag the patient_id PHI dispute and a stale readiness row

Three corrections, none of which resolve a question that belongs to counsel.

- PHI Architecture: the bullets accurately describe an architecture that
  excludes direct identifiers, but they do not establish that Signal is
  PHI-free and were being read that way. An internal account number is one
  of HIPAA's 18 identifiers. context/current-state.md said the opposite
  outright. Both now carry a matching DISPUTED flag pointing at each other,
  with instructions to build to the more restrictive reading until Clyde
  Mathes replies. Deliberately not resolved here.
- Attorney rows named Bittinger/Nixon. The bundle went to Clyde Mathes
  ~2026-07-23.
- Readiness table: it reads 13/13 and "100% pilot-ready" as of 2026-06-16,
  but the row "Demo login / controlled access working: PASS" is contradicted
  by the CLERK LOGIN thread dated 2026-07-07 recording that sign-in fails.
  Added a warning not to quote the percentage externally until that row is
  re-tested. Re-counting a table doesn't help when a row has gone stale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011bZhDfpTgToFvDX1CDE8oh

CLAUDE.md

@@ -31,6 +31,17 @@ and stays predictable.
   quantity, payer — NOTHING else
 - All logs use hashed patient_id, never raw
 
+**DISPUTED, awaiting counsel (flagged 2026-07-26).** The bullets above describe an
+architecture that excludes direct identifiers, and that is accurate. They do NOT
+establish that Signal is therefore PHI-free, and must not be read that way. An
+internal account number is one of HIPAA's 18 identifiers, so `patient_id` itself
+may be PHI. The attorney bundle sent to Clyde Mathes ~2026-07-23 asks this exact
+question and the answer governs. Until it returns, build to the more restrictive
+reading: treat `patient_id` as potentially PHI. Cross-reference:
+`context/current-state.md` Stack section carries the matching flag.
+Never state externally that Signal is HIPAA compliant, holds no PHI, or needs no
+BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md:51`.
+
 ## Current Stack (Updated 2026-06-22)
 
 - Backend: Railway (Python/FastAPI) — live at <https://signal-api-production-91c2.up.railway.app>
@@ -79,6 +90,16 @@ Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Project
 
 ### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13)
 
+> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has
+> not been re-verified since. The row "Demo login / controlled access working: PASS"
+> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md`
+> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app
+> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug
+> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready"
+> to anyone external.** The file's own instruction below says to re-count before
+> quoting a percentage; re-counting is not enough if a row is stale, so re-test the
+> login row specifically.
+
 | Checklist Item | Status |
 |---|---|
 | App hosted behind stable URL | PASS — <https://signal-ui-xi.vercel.app> (deployed 2026-05-29) |
@@ -132,8 +153,8 @@ This checklist tracks compliance gates separately from build readiness. Update i
 | Privacy Policy published at stable public URL | PASS — privacy-policy.md written 2026-06-07; Privacy.jsx deployed to <https://signal-ui-xi.vercel.app/privacy> |
 | FDA CDS exemption memo written and attorney-reviewed | NOT DONE |
 | Supabase plan tier confirmed (Pro vs Team) and PHI posture documented | PASS — Pro plan confirmed 2026-06-10 ($25/mo). HIPAA available as paid add-on on Team ($599/mo) — deferred to post-funding per Real PHI gate. Pro is correct posture for pilot. |
-| Pilot LOI reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
+| Pilot LOI reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, bundle sent ~2026-07-23, reply expected within days** (corrected 2026-07-26; the prior "Bittinger/Nixon review pending" note was stale) |
-| NDA template reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
+| NDA template reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, same bundle, sent ~2026-07-23** (corrected 2026-07-26) |
 | Pilot LOI executed with supplier | NOT DONE |
 | NDA executed with supplier | NOT DONE |
 | Minimum necessary field documentation written (why each of 5 fields is required) | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |