diff --git a/CLAUDE.md b/CLAUDE.md
index 76723eb..a56e09e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -231,8 +231,12 @@ Five things to get right, each of which has gone wrong here before:
    `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
    the outside.
 
-If a step is refused by the command classifier, do not try to route around it. Say what you were
-going to run and why, and ask the operator to run it with `!`.
+**Known blocker.** The command classifier refuses `kill` on the daemon, so step 2 cannot run by
+default however clearly this file grants permission — a `CLAUDE.md` rule does not widen tool
+permissions. Until the operator adds a Bash permission rule for it, the honest sequence is: the lead
+builds the jar and verifies it, then asks the operator to run the stop and start with `!`. Do not try
+to route around the refusal by other means. Say what you were going to run and why, and let the
+operator decide.
 
 ### The prompt is part of the product — update it with the code (mandatory)