diff --git a/CLAUDE.md b/CLAUDE.md
index a58b4847..55b74c00 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,10 +7,9 @@ design docs live. The authoritative behaviour is always the code in `core/`.
 **Read [`docs/ROADMAP.md`](docs/ROADMAP.md) for where the project is going** and
 [`docs/README.md`](docs/README.md) for the full documentation index.
 
-The north star: a world-class, **developer-ready app platform** where every app
-is manifest-driven, manifests ship via the **signed registry** (not disk files),
-and **third-party developers publish apps via an external/decentralized
-registry** — all rootless, secure, robust, and 100%-uptime-capable.
+The north star: a world-class, **developer-ready app platform** — every app
+manifest-driven, rootless, secure, and 100%-uptime-capable, with third-party
+developers publishing via an external/decentralized registry.
 
 Detailed sub-plans:
 - App platform / packaging phases + security model → [`docs/APP-PACKAGING-MIGRATION-PLAN.md`](docs/APP-PACKAGING-MIGRATION-PLAN.md)
@@ -58,8 +57,10 @@ lost by sitting uncommitted in a shared tree across sessions. To prevent that:
 - Frontend: `neode-ui/` → `npm run build` outputs to `web/dist/neode-ui/`.
   Grep the built bundle for new strings before shipping (the build can silently
   no-op).
-- App manifests load from disk on nodes at `/opt/archipelago/apps/*/manifest.yml`
-  today; the goal is to distribute them via the signed catalog instead.
+- App manifests are delivered inside the **signed catalog** (`releases/app-catalog.json`),
+  whose entry overrides the on-disk `/opt/archipelago/apps/*/manifest.yml`
+  (origin-wins; disk is the fallback). Editing a disk manifest alone does **not**
+  change a catalog-covered app — regenerate and re-sign the catalog.
 
 ## Production test gate (definition of done)