diff --git a/src/commands/test/labeler/CLAUDE.md b/src/commands/test/labeler/CLAUDE.md
index adc1d19..f605776 100644
--- a/src/commands/test/labeler/CLAUDE.md
+++ b/src/commands/test/labeler/CLAUDE.md
@@ -1,6 +1,6 @@
 # test labeler
 
-Last verified: 2026-04-21
+Last verified: 2026-04-26
 
 ## Purpose
 
@@ -137,6 +137,22 @@ integration tests can replay fixtures instead of talking to real servers.
   stage still emit `Skipped` rows with a reason. When a
   whole stage is blocked upstream, the pipeline emits one
   `<stage>::not_run` row per downstream stage with a reason string.
+- **Downstream "blocked by" rows name the actual failing identity check**:
+  when identity fails to populate `IdentityFacts`, the pipeline scans
+  `identity_output.results` for the first `SpecViolation` / `NetworkError`
+  row and uses *that* check's ID (e.g. `identity::signing_key_present`,
+  `identity::labeler_record_fetched`, `identity::labeler_endpoint_is_https`)
+  as the blocker for every downstream `<stage>::not_run` row and for the
+  10 `report::*` Skipped rows. Hardcoding `identity::target_resolved` as
+  the blocker — the previous behavior — misattributed blocks to a check
+  that visibly passed in the same report whenever a later identity check
+  was the real gate. The `LabelerTarget::Endpoint { did: None }` path
+  (no DID supplied) is the one case where no identity check actually
+  failed, so downstream stages fall back to non-attributed
+  "blocked by identity stage" / `identity::target_resolved` phrasing in
+  that branch via `identity_blocker_id = None`. The blocker ID is
+  computed once in `pipeline::run_pipeline` and threaded into the report
+  stage through `CreateReportRunOptions::identity_blocker_id`.
 - **Identity facts gate downstream stages**: HTTP and crypto stages only
   run when identity populated `IdentityFacts`. Subscription can run from
   an explicit endpoint URL without identity (the
@@ -232,7 +248,11 @@ integration tests can replay fixtures instead of talking to real servers.
   `self_mint_curve`, `report_subject_override`, `self_mint_signer`,
   `pds_credentials`, `pds_xrpc_client` / `pds_xrpc_client_override`,
   `run_id`), `CreateReportTeeKind`, `PdsCredentials`, `parse_target`,
-  `run_pipeline` orchestration.
+  `run_pipeline` orchestration. Also owns the
+  `identity_blocker_check_id` helper that scans the identity stage
+  output for the first failing check and threads its ID into the
+  HTTP / subscription / crypto `<stage>::not_run` rows and into
+  `CreateReportRunOptions::identity_blocker_id`.
 - `identity.rs` — identity stage: DID resolution, labeler record fetch
   (through `atrium-api` types over the `HttpClient` seam), policy
   validation. `IdentityFacts` now also carries