HIPAA org policy now 'latches': restricted features stay off for the rest of the session

What

• If Claude Code observes that you're signed into a HIPAA-regulated organization's policy during a session, that fact is now "latched" (remembered) even if the server later stops reporting it.
• Features gated by this policy, including Artifacts and Remote Control, stay disabled for the rest of the session once latched, with a new user-facing message explaining why.
• This is treated as a distinct "latched" state alongside the existing org_denied/unregistered/route_missing states in policy checks, and maps to the same policy_denied error code.
• Switching to a non-HIPAA organization afterward does not lift the restriction; it only clears when Claude Code is restarted.

Why This prevents a session from briefly picking up looser settings by switching organizations after a HIPAA-regulated policy was already in effect, closing a potential gap where compliance-restricted features could be re-enabled mid-session.