diff --git a/CLAUDE.md b/CLAUDE.md
index 5ce0745..a77dc27 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -113,7 +113,7 @@ Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Project
 | Placeholder content removed | PASS — StatCard undefined variables fixed 2026-06-09; empty state heading "Drop your file here" + StatusLegend below; stoplight colors + ✓ for Clear to Ship; tab counts and percentages; legend bar removed from worklist header — all deployed 2026-06-16 |
 | Browser smoke test passes | PASS — CSV import, all filter tabs, Confirm Visit, Export all verified 2026-06-10; sidebar count sync fixed |
 | Data handling rules documented | PASS — privacy-policy.md + data-handling.md written 2026-06-07; minimum necessary fields, CSV disposition policy, retention, and payer_rules.json cadence all documented |
-| Real PHI blocked | PASS — architecture confirmed; Supabase Pro plan verified 2026-06-11 |
+| Real PHI blocked | **PASS, BUT DISPUTED (flagged 2026-07-27)** — this PASS rests on the same architecture reading flagged as DISPUTED in the PHI Architecture section above. It is sound in the narrow sense that no real supplier data has been loaded, and unsound as evidence that the design excludes PHI, which is the open question with counsel. Do not cite this row as proof Signal holds no PHI. |
 | Pilot success metrics written down | PASS |
 
 Update this table every build session. Re-count PASS items before quoting a % to anyone.