diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index 576804b..3ccb610 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -8,26 +8,26 @@ Catch prompt injection attacks before they reach production — in skill files,
 
 ## Requirements
 
-> Current requirements live in `.planning/REQUIREMENTS.md` (milestone: **v0.2.0 — Agent-shaped
-> attacks**, opened 2026-08-30). The list below is the **original v0.0.1 set, retained for
-> history**.
+> Requirements live in each milestone's archived `REQUIREMENTS.md` under `.planning/archive/`.
+> There is no active milestone: maintenance-only since 2026-10-23. The list further below is
+> the **original v0.0.1 set, retained for history**.
 
 ### Validated — shipped and confirmed
 
-- ✓ **Production Readiness (v0.0.3 + v0.1.0)** — shipped 2026-08-29. Detection recall went
-  **10/60 → 56/60**, measured against a corpus written from the threat model and published in the
-  README. CI restored, SARIF output, `install-hook`, `--baseline`, `--fail-on`, Unicode
-  normalization, multi-line matching, markdown context awareness, 48 patterns, SLSA provenance
-  over six target-triple binaries. Consumed by `spec-ci-plugin` v1.1.1 via the moving `@v1` tag.
-  Archived at `.planning/archive/milestone-v0.1.0/`.
+- ✓ **Production Readiness (v0.0.3 + v0.1.0)** — shipped 2026-08-29. Recall **10/60 → 56/60**
+  on a corpus written from the threat model. CI restored, SARIF output, `install-hook`,
+  `--baseline`, `--fail-on`, Unicode normalization, multi-line matching, 48 patterns, SLSA
+  provenance over six target-triple binaries. `.planning/archive/milestone-v0.1.0/`.
+- ✓ **v0.2.0 — Agent-shaped attacks** — released 2026-10-10. The scanner reads agent
+  configuration, not just prose: structural frontmatter engine, recursive decoder, and three
+  agentic categories (tool & permission abuse, MCP tool-description poisoning, persistence &
+  lifecycle hijack). 48 → 79 patterns. CAT-03 held-out recall **2/12** is the published number;
+  development recall 103/115. `.planning/archive/milestone-v0.2.0/`.
 
-### Active — v0.2.0
-
-The scanner learns to read agent **configuration**, not just agent **prose**. All 48 existing
-patterns target payloads aimed at a chat model reading text; none target a wildcard permission
-grant in frontmatter, an instruction hidden in an MCP tool `description`, or a lifecycle hook that
-reinstalls the attacker's instructions. See `.planning/REQUIREMENTS.md`.
+### Active
 
+None — maintenance-only. Since release: #197 added `PI114`-`PI118` (84 patterns, development
+recall 105/115). Close-out gaps (#164-#184) wait on the unplanned GitHub milestone v0.3.0.
 
 ### Original v0.0.1 set (historical)
 - [ ] **SCAN-01**: 30+ patterns across 5 categories (role override, instruction injection, exfiltration, jailbreaks, encoding)
@@ -63,17 +63,20 @@ reinstalls the attacker's instructions. See `.planning/REQUIREMENTS.md`.
 - anyhow for binary error handling, thiserror for library errors
 - cargo fmt + cargo clippy -- -D warnings before every commit
 - No unwrap() in production code
-- Self-hosted CI runners (arc-runner-unityinflow + orangepi)
+- CI and release run on GitHub-hosted runners (public repo; the org runner group refuses self-hosted jobs on it — see CLAUDE.md)
 
 ## Key Decisions
 | Decision | Rationale | Outcome |
 |----------|-----------|---------|
 | Rust over TypeScript | <200ms performance requirement for pre-commit hook | ✅ Held — matching is fast; the perf problem was per-file regex compilation, not the language |
 | YAML patterns over embedded | Community contributions via PR, no recompilation needed | ✅ Held — embedded core + external overlay works |
-| SARIF output | GitHub Advanced Security integration, industry standard | ⏳ Never built — carried to Phase 4 |
-| regex over Aho-Corasick | Simpler for v0.0.1, Aho-Corasick for v0.1.0 if perf needed | ⏳ Carried to Phase 4; compile-once (Phase 2) matters more |
-| Public/fork CI on a GitHub-hosted runner (2026-08-21) | Org runner group blocks all self-hosted jobs on public repos; the private-window alternative denies CI to fork PRs and kills community pattern contributions. Scoped exception mirroring the spec-ci-plugin D-02 split. | ⏳ Phase 1 |
-| "Production ready" = v0.0.3 + v0.1.0 (2026-08-21) | Correctness and signal quality before differentiation. Agentic categories deferred to v0.2.0. | ⏳ In progress |
+| SARIF output | GitHub Advanced Security integration, industry standard | ✅ Shipped in v0.1.0 |
+| regex over Aho-Corasick | Simpler for v0.0.1, Aho-Corasick for v0.1.0 if perf needed | ✅ Held — compile-once mattered more; the PERF-01 budget moved 200 → 400 ms for the 79-pattern library (#188) |
+| Public/fork CI on a GitHub-hosted runner (2026-08-21) | Org runner group blocks all self-hosted jobs on public repos; the private-window alternative denies CI to fork PRs and kills community pattern contributions. Scoped exception mirroring the spec-ci-plugin D-02 split. | ✅ Held — fork PRs (#197, #200) received CI and #197 merged |
+| "Production ready" = v0.0.3 + v0.1.0 (2026-08-21) | Correctness and signal quality before differentiation. Agentic categories deferred to v0.2.0. | ✅ Shipped 2026-08-29 |
+| v0.2.0: engines before categories, three categories not eight (2026-08-30) | #32 is a stated prerequisite for `PI050`-`PI069`; three categories kept each PR reviewable (GATE-04) | ✅ Shipped 2026-10-10 |
+| Publish the held-out CAT-03 number, not the development one (2026-10-09) | A development corpus restated to the pattern authors overstates a detector; only a sealed blind set is independent | ✅ Held — 2/12 published beside 7/12 development |
+| Scope freeze after v0.2.0 (2026-10) | Ecosystem focus moves to agent-memory v0.1.0 | ✅ Maintenance-only from 2026-10-23 |
 
 ---
-*Last updated: 2026-08-21*
+*Last updated: 2026-10-23 after v0.2.0 milestone archive*
diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index a39723b..bc25fbe 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -1,226 +1,23 @@
-# Roadmap: injection-scanner v0.2.0 — Agent-shaped attacks
+# Roadmap: injection-scanner
 
-**Opened:** 2026-08-30 · **Previous milestone:** Production Readiness (v0.0.3 + v0.1.0), shipped
-2026-08-29, archived at `.planning/archive/milestone-v0.1.0/`
+**No active milestone — maintenance-only** since 2026-10-23, by the scope freeze recorded when
+v0.2.0 was planned: ship v0.2.0, release it, then move the ecosystem's focus to agent-memory.
 
-## Why this order
+## Milestones
 
-The two engines come first, and not for tidiness — the dependency is real and confirmed from both
-sides. #32 states it is "the prerequisite for the `PI050`–`PI059` and `PI060`–`PI069` categories",
-and #33/#34 both list frontmatter-shaped patterns (`allowed-tools: *`, `Bash(*)`, `mcpServers`
-entries) that regex cannot address without the false positives #32 exists to remove.
+- ✅ **v0.0.1** — first release (April 2026) — `.planning/archive/milestone-v0.0.1/`
+- ✅ **Production Readiness (v0.0.3 + v0.1.0)** — shipped 2026-08-29; recall 10/60 → 56/60 —
+  `.planning/archive/milestone-v0.1.0/`
+- ✅ **v0.2.0 — Agent-shaped attacks** — Phases 1-5, 23 plans, released 2026-10-10; 48 → 79
+  patterns, 5 → 9 categories; CAT-03 held-out recall 2/12 is the published number —
+  `.planning/archive/milestone-v0.2.0/`
 
-Each of #33 and #34 does split into a **prose half** that today's engine could match and a
-**structured half** that cannot. Shipping the prose halves first is possible — and rejected:
-it means touching each category twice and taking exactly the false-positive risk the structured
-parser eliminates.
+## What maintenance-only means here
 
-**#30 sits second rather than last** because it is the only item in the milestone that moves the
-*published* recall number — 56/60 → 59/60 — so it converts into a visible claim immediately,
-and it retires #6 and #7, already closed against it.
-
-## Phases
-
-- [x] **Phase 1: Structural frontmatter engine (ENG-01, #32)** — Parse YAML/TOML/JSON frontmatter
-      with a real parser; inspect `allowed-tools`, `tools`, `permissions`, `mcpServers`, `hooks`,
-      `model`/`system` as data. Unblocks Phases 3 and 4.
-
-- [x] **Phase 2: Recursive decoder (ENG-02, #30)** — base64, hex, URL, HTML entities, `\u` escapes,
-      applied recursively with a decode-bomb bound. Takes recall to 59/60.
-
-- [x] **Phase 3: Tool & permission abuse (CAT-01, #33)** — `PI050`–`PI059`.
-- [x] **Phase 4: MCP & tool-description poisoning (CAT-02, #34)** — `PI060`–`PI069`.
-- [x] **Phase 5: Persistence & lifecycle hijack (CAT-03, #35)** — `PI070`–`PI079`.
-
-## Phase details
-
-### Phase 1: Structural frontmatter engine — ENG-01 (#32)
-
-**Goal:** the scanner reads configuration as configuration.
-
-**Success criteria**
-
-- YAML, TOML and JSON frontmatter parse with a real parser; a malformed document is skipped
-  loudly and never aborts the scan (the FIX-03 rule, applied to a new input class)
-
-- Structured findings carry a distinct `context` so they are separable in JSON/SARIF output
-- Zero new findings on `tests/corpus/clean/` **and** on the third-party sweep
-- A structured finding can sit at CRITICAL because its shape is unambiguous — proven by a test,
-  not asserted
-
-**Watch for**
-
-- `.mdc`, `.cursorrules` and extensionless agent files are already in the default set; frontmatter
-  detection must not assume `.md`
-
-- Parser choice is a supply-chain decision — this crate parses untrusted input by definition
-
-### Phase 2: Recursive decoder — ENG-02 (#30)
-
-**Goal:** an encoded payload is no longer a bypass, however many layers deep.
-
-**Success criteria**
-
-- Recall reaches **59/60**; `tests/recall_test.rs` updated to the new exact count
-- Decode depth and output size are bounded; a decode bomb is refused, not OOM'd
-- A decoded finding reports the **original** byte offsets, not offsets into the decoded text
-- `matched_text` still carries original bytes — the `--baseline` digest depends on it, and
-  normalizing it would turn every baselined finding into a free pass for its obfuscation family
-
-**Watch for**
-
-- #6 and #7 are closed as superseded by this; make sure both cases are actually covered
-- Separator normalization already rewrites `-` as whitespace before matching — decoded text
-  enters the same pipeline
-
-### Phase 3: Tool & permission abuse — CAT-01 (#33)
-
-**Goal:** `PI050`–`PI059`. Injection whose payload widens the agent's own authority.
-
-**Success criteria**
-
-- Twelve new corpus payloads written from the threat model; pattern count is not a target — it is
-  whatever the threat model requires within `PI050`–`PI059`, and the resulting number is recorded
-  after the fact
-
-- Both halves covered: structured (wildcard grants via ENG-01) and prose
-  (`--dangerously-skip-permissions`, "no need to ask", "add this to your settings.json")
-
-- A frontmatter-scoped `PI05x` pattern **does** fire on a file's own wildcard grant, accepting
-  overlap with `spec-linter` S005 — the boundary is provenance, not phrasing: S005 lints a spec you
-  wrote, in your own repo, at authoring time; this scanner is pointed at untrusted input, so the
-  same `allowed-tools: *` is a lint finding in your own CLAUDE.md and an attack in a skill someone
-  shipped you
-
-> Both corrections above come from `03-CONTEXT.md` D-11 (the S005-boundary criterion) and D-16 (the
-> "10 patterns" criterion). CONTEXT.md is authoritative where it conflicts with this roadmap — do
-> not re-derive or re-inherit the superseded wording.
-
-**Plans:** 7/7 plans executed
-
-Plans:
-
-- [x] 03-01-PLAN.md — Corpus, recall harness and the measured pre-pattern baseline (D-01..D-05)
-- [x] 03-02-PLAN.md — Five false-positive control specimens in `tests/corpus/clean/` (D-06, D-06a, D-06b)
-- [x] 03-03-PLAN.md — GATE-03 sweep script, recorded pre-pattern sweep, ROADMAP correction (D-10, D-11, D-16)
-- [x] 03-04-PLAN.md — Relaxed-control schema field, mutation-pairing gate, PI050+ ratchet (D-07, D-08, D-09)
-- [x] 03-05-PLAN.md — Structural patterns PI050-PI052, CRITICAL, `scope: frontmatter` (D-12, D-13)
-- [x] 03-06-PLAN.md — Prose patterns PI053-PI057, HIGH (D-14, D-15, D-17)
-- [x] 03-07-PLAN.md — GATE-03 delta sweep, number reconciliation, deferral issues, pre-PR gate
-
-### Phase 4: MCP & tool-description poisoning — CAT-02 (#34)
-
-**Goal:** `PI060`–`PI069`. The attack the user never sees.
-
-**Success criteria**
-
-- 10 patterns; 12 new corpus payloads
-- Imperative language inside a tool `description`; unpinned `npx -y` and `http://` servers;
-  cross-tool shadowing; version/date-conditional rug-pull markers
-
-- **Highest false-positive risk in the milestone** — a legitimate MCP manifest is full of
-  imperative description text. The `Show the current system prompt` precedent applies: the
-  possessive requirement is what keeps PI021 off real manifests. Expect to need a similar
-  narrowing rule, and sweep real MCP manifests specifically, not just documentation
-
-**Plans:** 7/7 plans executed
-
-Plans:
-
-- [x] 04-01-PLAN.md — Pre-edit GATE-03 baseline, per-category structural corpus collector, GATE-05 range repair
-- [x] 04-02-PLAN.md — 12 threat-model payloads, wrapper-shape projection control, measured pre-pattern baseline (GATE-01)
-- [x] 04-03-PLAN.md — Clean-corpus boundary specimens, vendored registry sample with provenance (D-06)
-- [x] 04-04-PLAN.md — PI060-PI062 config hygiene, MEDIUM, `scope: frontmatter` (D-03)
-- [x] 04-05-PLAN.md — PI063-PI065 tool-description poisoning, HIGH, prose (D-01, D-02)
-- [x] 04-06-PLAN.md — PI066-PI069 shadowing and rug-pull heuristics, MEDIUM, prose (D-04)
-- [x] 04-07-PLAN.md — Whole-category sweep, number reconciliation, deferral issues, phase close
-
-### Phase 5: Persistence & lifecycle hijack — CAT-03 (#35)
-
-**Goal:** `PI070`–`PI079`. Payloads that survive the obvious cleanup.
-
-**Success criteria**
-
-- 9 patterns in `PI070`-`PI079` (`PI078` deliberately unallocated, amended by D-07 in plan 05-06); 12 new corpus payloads
-- Self-rewriting instructions, hook and lifecycle abuse, memory-file poisoning
-- At least one pattern detects an instruction to write *into* a file the agent will re-read
-
-> **`05-CONTEXT.md` is authoritative where it sharpens these criteria — do not re-derive the
-> superseded readings.** Three things were settled there after measurement. (1) The range has **9**
-> free slots, not 10: `PI070` already shipped via PR #110, so the phase plans `PI071`–`PI079` and
-> the "10 patterns" line above counts the whole range rather than the phase's own additions (D-07);
-> `PI078`/`PI079` are provisional and the criterion is amended in the same change if either is
-> dropped. (2) The 12 corpus payloads **replace** the 6 inherited with PR #110, which were
-> GATE-01-tainted — payload 1 was byte-identical to `PI070`'s own `example` — so the pinned recall
-> row is expected to fall below its published 6/6 and that is the gate working (D-01). (3) Issue
-> #35's "CRITICAL across the board" is **not** followed: `PATTERNS.md` rule 3 governs severity and
-> nothing in this range ships in that tier (D-06).
->
-> **Amended in plan 05-06 under D-07's authority.** `PI078` (remote-lifecycle-hook-endpoint) was
-> measured and dropped, so the range ships 9 patterns (`PI070`-`PI077` and `PI079`) and the id
-> `PI078` stays unallocated. The measurement: a dotted-host remote-endpoint rule fires on the
-> structural attack payload 04 and on the clean `persistence-corporate-audit-endpoint.json`
-> specimen alike, and swapping the bound event, the host's registrable domain and the URL between
-> the two documents moved nothing. `PI079` was kept (MEDIUM) on its own measured criterion.
-
-**Plans:** 7/7 plans executed
-
-Plans:
-
-- [x] 05-01-PLAN.md — GATE-03 pre-edit baseline, 12 blind-written payloads, measured pre-pattern pins (D-01, D-03, D-05)
-- [x] 05-02-PLAN.md — Nine clean-corpus specimens and the two mutation proofs that make D-03's amendment and D-04's conjuncts load-bearing (D-02, D-03, D-04)
-- [x] 05-03-PLAN.md — `PI070` object/verb widening and `PI071` agent-persistence-nonmodal, HIGH, prose (D-06)
-- [x] 05-04-PLAN.md — `PI072` self-propagation, `PI074`/`PI075` memory arms, and the self-matching backlog bullets (D-02, D-05, D-06)
-- [x] 05-05-PLAN.md — `PI073` instruction-file-write-directive (MEDIUM) and `PI076` agent-hook-registration-directive (D-04, D-06)
-- [x] 05-06-PLAN.md — `PI077` structural lifecycle arm, plus `PI078`/`PI079` resolved on measured criteria (D-03, D-06, D-07)
-- [x] 05-07-PLAN.md — Whole-category GATE-03 delta, number reconciliation, deferral issues, #35 close-out, pre-PR gates
-
-## Gates applied to every phase
-
-| Gate | Rule |
-|---|---|
-| GATE-01 | 12 corpus payloads per category, from the threat model, never derived from patterns |
-| GATE-02 | Recall counts pinned **exactly** — an improvement fails the build too |
-| GATE-03 | ~1,300-file third-party sweep on every pattern change |
-| GATE-04 | No reviewable unit widens more than one category |
-| GATE-05 | The false-positive control is mutation-tested |
-
-Also standing: `main` stays strictly linear (0 merge commits); a pattern's `name` is a consumer
-contract (`pattern_name` ships in the JSON `spec-ci-plugin` reads) — widen the `description`, never
-rename.
-
-## Progress
-
-| Phase | Requirement | Issue | Status |
-|---|---|---|---|
-| 1. Structural frontmatter engine | ENG-01 | #32 | **Done** — PR #104 |
-| 2. Recursive decoder | ENG-02 | #30 | **Done** — PR #108 |
-| 3. Tool & permission abuse | CAT-01 | #33 | **Done** — PR #109 |
-| 4. MCP & tool-description poisoning | CAT-02 | #34 | **Done** — PR #120 + PR #136 |
-| 5. Persistence & lifecycle hijack | CAT-03 | #35 | **Complete.** 7/7 plans; 9 patterns `PI070`-`PI077` and `PI079`, `PI078` unallocated. Held-out recall 2/12 published as the CAT-03 number, development 7/12, library-wide 103/115. Merged as PR #185 (48 commits, rebased); #35 closed. The blocking review finding #183 was fixed before the PR, not deferred, and its own cost filed as #184 |
-
-**Library (Phase 5 close, plan 05-07):** **79 patterns**, measured directly from the loader and asserted by
-`test_total_pattern_count`: the 71 at Phase 4's close plus CAT-03's eight new patterns (`PI071`-`PI077` and `PI079`; `PI070`
-had shipped from PR #110 and is not a new count). `PI078` is deliberately unallocated, so the range ships 9 patterns, not
-the 10 its id span names.
-**Recall (Phase 5 close, plan 05-07):** **103/115 (89.6%)** on the development corpus, up from 102/109 at Phase 4's close.
-The denominator moved by +6, not by the 12 CAT-03 payloads alone, because the 6 inherited and GATE-01-tainted CAT-03
-payloads were replaced (D-01) and the category's pre-pattern baseline was 97/115. CAT-03's own development rows are
-**7/12 (58.3%)** (prose 4/7, structural 3/5). **The published CAT-03 number is the sealed held-out set's: 2/12 (16.7%)**
-(prose 2/8, structural 0/4), reported beside the development score and **never summed into the 115**. The projection
-this milestone opened with did not anticipate a held-out set, and the gap between 58.3% and 16.7% is the finding.
-
-**Library:** **71 patterns** as of Phase 4's close (04-07), measured directly from the loader —
-corrected from the ~78 projected when the milestone opened. CAT-02 (`PI060`-`PI069`) added
-exactly its planned 10; the difference from the projection is other, un-milestoned pattern work
-that landed on `main` during the same window (PR #110's `PI058`/`PI070`/`PI110`-`PI113`, plus
-subsequent widenings), independent of this phase's own count. CAT-03 (`PI070`-`PI079`, Phase 5)
-is already partially seeded by `PI070` from that same PR.
-**Recall:** **102/109 (93.6%)** as of Phase 4's close (04-07), corrected from the 76/84 (90.5%)
-projection recorded as of 04-02. The denominator grew to 109, not the originally projected 84 —
-25 payloads beyond CAT-02's own 12 landed from other PRs during the same window (#110's
-multilingual range, #122's widenings, and independent corpus growth in encoding/role-override).
-CAT-02's own row is now **9/12 (75%)**, up from its measured pre-pattern baseline of 6/12 — the
-remaining three misses are the two rug-pull structural payloads (D-05's deferred structural
-cross-reference; see `deferred-items.md`) and one deliberately-undetected unpinned-registry-install
-payload (D-03's accepted cost).
+- **Merged:** bug fixes, false-positive fixes, CI and dependency upkeep, and community pattern PRs
+  that pass every gate. Merged after the release: #197 (`PI114`-`PI118`, multilingual, 84 patterns)
+  and #200 (`PI079` threshold evidence, #180).
+- **Not started:** new detection categories or engines. The detection gaps filed at the v0.2.0
+  close-out (#164-#184) sit on the GitHub milestone **v0.3.0**, which has no plan and no date.
+- **Backlog:** `docs/DETECTION-BACKLOG.md`. The next milestone opens with `/gsd-new-milestone`,
+  only when the freeze is lifted.
diff --git a/.planning/STATE.md b/.planning/STATE.md
index edd6134..cc7a133 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -1,341 +1,54 @@
 ---
 gsd_state_version: 1.0
-milestone: v0.2.0
-milestone_name: Agent-shaped attacks
-status: in_progress
-stopped_at: "Phase 5 COMPLETE and merged (PR #185, 48 commits, rebase-merged; #35 closed). All 5 phases of v0.2.0 done and the milestone has 0 open issues. Patterns frozen at 79; held-out CAT-03 recall 2/12 published, development 103/115. #183 fixed pre-PR, its cost filed as #184. NEXT: release v0.2.0 (tag-triggered, GitHub-hosted release.yml), then complete/archive the milestone, then agent-memory v0.1.0 per the scope freeze."
-last_updated: "2026-10-09T13:20:00.000Z"
-state_head: f0e2308
+milestone: none
+milestone_name: maintenance-only
+status: maintenance
+stopped_at: "v0.2.0 released 2026-10-10 and archived 2026-10-23 to .planning/archive/milestone-v0.2.0/. No active milestone: injection-scanner is maintenance-only by the scope freeze, and the ecosystem focus is agent-memory v0.1.0."
+last_updated: "2026-10-23T00:00:00.000Z"
+state_head: 2f672c8
 progress:
-  total_phases: 5
-  completed_phases: 5
-  total_plans: 23
-  completed_plans: 23
-  percent: 100
+  total_phases: 0
+  completed_phases: 0
+  total_plans: 0
+  completed_plans: 0
+  percent: 0
 ---
 
 # State: injection-scanner
 
 ## Project Reference
 
-See: `.planning/PROJECT.md`
+See: `.planning/PROJECT.md` (updated 2026-10-23)
 **Core value:** Catch prompt injection attacks before they reach production
-**Milestone:** **v0.2.0 — Agent-shaped attacks** (opened 2026-08-30)
+**Current focus:** none here — maintenance-only. Ecosystem focus is agent-memory v0.1.0.
 
-> Full history for the previous milestone — 412 lines of session notes — is archived at
-> `.planning/archive/milestone-v0.1.0/STATE.md`, alongside its REQUIREMENTS, ROADMAP and phases.
+> The full v0.2.0 state (341 lines, including "Four things from Phase 5 worth not rediscovering"
+> and the standing gates) is archived at `.planning/archive/milestone-v0.2.0/STATE.md`. Read it
+> before opening the next milestone.
 
-## Current Phase
+## Shipped
 
-**Phase 5 — Persistence & lifecycle hijack (CAT-03, #35)** · **7/7 plans executed** (closed out 2026-10-09 by plan 05-07).
-The phase-complete marker and the pull request are the orchestrator's; the last phase of this milestone. Phases 1-4 are
-complete (Phase 4: PR #120 + PR #136).
+**v0.2.0 — Agent-shaped attacks**, released 2026-10-10. Structural frontmatter engine (#32),
+recursive decoder (#30), and three categories: tool & permission abuse (#33), MCP &
+tool-description poisoning (#34), persistence & lifecycle hijack (#35). 79 patterns at release.
 
-**What shipped:** 9 patterns in `PI070`-`PI079` — `PI070` (already on `main` from PR #110, widened here) plus eight new
-(`PI071`-`PI077` and `PI079`). **`PI078` is deliberately unallocated** (D-07: a remote-lifecycle-hook-endpoint rule fires on the
-attack payload and on the clean corporate-audit specimen alike). The range had **9** free slots, not 10, because `PI070` had already
-shipped. Six are HIGH (`PI070`, `PI071`, `PI072`, `PI075`, `PI076`, `PI077`) and three MEDIUM (`PI073`, `PI074`, `PI079`);
-**nothing is CRITICAL** (D-06, recorded on #35). Library: **79 patterns**.
+## Since the release
 
-**The headline number is the held-out one, and it is much lower.** The category scores **7/12 (58.3%)** on its development corpus
-(prose 4/7, structural 3/5) but **2/12 (16.7%)** on a sealed, blind-authored held-out set (prose 2/8, structural 0/4) that was hashed
-before any `PI071`+ pattern existed and opened once, after the patterns were frozen. Neither held-out detection is a pattern this phase
-wrote (`PI025`, `PI070`). Per `heldout-set.md` rule 4 the ten misses were reported, not tuned away. Library-wide development recall is
-**103/115 (89.6%)**; the held-out rows are totalled separately and never summed into it.
+- **#197 merged 2026-10-23** (community, BasilZafar11): `PI114`-`PI118` multilingual evasion.
+  Library is **84 patterns / 9 categories**. Development recall **105/115 (91.3%)**, up from
+  103/115. The CAT-03 held-out number is unchanged at **2/12** and is still the published one.
+- **#200 merged 2026-10-23** (community, BasilZafar11): independent evidence and a threshold
+  sensitivity test for `PI079` (closes #180). Regex and MEDIUM grade unchanged; remediation now asks
+  the reviewer to confirm the user authorized the key. See `docs/PI079-EVIDENCE.md`.
+- CI upkeep: scanner caching in tests, PERF-01 budget 200 → 400 ms for the larger library (#188).
 
-**Measured at close-out (HEAD `1d8642e`, 2026-10-09):** full suite `cargo test --locked` **467 passed, 0 failed (38 test-result lines, exit 0, redirected to a file and the exit code read; never piped)**; `cargo fmt --check` and
-`cargo clippy --all-targets -D warnings` clean; whole-category GATE-03 delta **0 additions, 0 removals** over 26,407 files in both
-directions (`05-SWEEP.md`); GATE-04 proven by a quoted diff (one pattern file); `Cargo.toml`, `Cargo.lock` and `src/` untouched, so no ADR.
-Self-scan outside `examples/ patterns/ tests/ tools/` is exactly the two standing `PATTERN-CATALOGUE.md` findings (`PI001`, `PI031`) and
-nothing new.
+## Open work
 
-**The one BLOCKING finding, #183, is RESOLVED (2026-10-09) — the phase is not shipping it open.** The pre-PR code-review gate found that
-`PI070`'s widened objects and verbs made third-person `will` vendor-feature sentences fire HIGH (13 of 17 probes new relative to the
-pre-phase pattern; the sweep was silent because no such sentence is in a real file on this machine). The 9b determiner remedy could not
-discriminate — the class fires on `the` as readily as `your`. The maintainer chose to drop `will` from the modal set, keeping `may now`
-(a claim that a control is off is attack framing, not product description). Measured cost: **zero** attack-corpus and **zero** held-out
-detections, so held-out stays 2/12 and development 103/115; no sibling pattern shows the class. The permanent guard is a new clean
-specimen, `tests/corpus/clean/persistence-vendor-release-notes.md`, mutation-tested at shipped 0 / `will`-restored 6. `PI070` stays HIGH
-because the benign sentence class was removed rather than the grade waived. See `05-REVIEW.md` 'BL-01: RESOLVED'.
-
-**Filed at close-out:** #164-#183 (all milestone v0.3.0 except #183, which is v0.2.0), full accounting in
-`.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md`. The #35 close-out comment (the severity deviation and the
-slot arithmetic) is https://github.com/UnityInFlow/injection-scanner/issues/35#issuecomment-6080268901, with an addendum for #183.
-
-> **This section has drifted before — verify it before planning from it.** It once named a merged PR as the open blocker for closing
-> Phase 4, and carried a test count and two pinned line numbers that had all moved. Settle such claims with `gh pr view <N> --json state`
-> (is a PR actually open), `git log --merges --oneline origin/main` (the merge-commit count) and a full `cargo test` (the test count). The
-> live answer beats this file whenever the two disagree. State at close-out: Phase 5 is on branch `feat/35-persistence-lifecycle-hijack`,
-> **no PR is open yet**, and `main` is where Phase 4 left it. Last verified: 2026-10-09.
-
-### Four things from Phase 5 worth not rediscovering
-
-**(1) A development corpus overstates a detector; ship a sealed set before the patterns exist.** The category looked like 7/12 and is
-2/12 on payloads nobody tuned against. The development payloads cleared the derivation check *lexically*, but their shapes had been restated
-to the pattern authors, so the check could not see structural dependence. The held-out set (authored blind, hashed first, opened once)
-is the only number here that is independent. `tools/corpus-derivation-check.py` proves "no wording was lifted", never "GATE-01 satisfied" (#166).
-
-**(2) "A modal keeps vendor prose out" is false for `will`, and a clean sweep is absence of evidence.** Every HIGH prose arm that accepts a
-product name as a declarative subject fired on vendor documentation: `PI071` twice, `PI076` once, and `PI070` (#183, fixed by removing `will`). The 26,407-file
-sweep was empty every time because no such sentence existed in a real file on this machine. The only thing that found each one was an
-adversarial probe with synthesized vendor-voice sentences. Run one (the one in `05-REVIEW.md`) before trusting a green sweep on a HIGH
-prose arm. The discriminator for `PI071`/`PI076` was the second-person possessive, not the deictic word; `PI070`'s bare-object-path case
-needs a different one.
-
-**(3) The both-directions specimen test beat the sweep.** `PI078` was dropped because swapping the bound event, the host's registrable
-domain and the URL between the attack payload and the audit specimen moved nothing. The dotted-host draft produced 0 hits on the 263-file
-hooks sweep, so the sweep half of the old criterion alone would not have disqualified it. A pattern that cannot separate the attack from a
-compliance control is not shipped, however clean the sweep.
-
-**(4) The structural pass matches one projected line at a time, and `--compare` is path-keyed.** No structural regex can require two leaves
-to co-occur; `locate()` collapses repeated keys onto the first line (#165); a download-then-run hook is outside `PI077`'s pipe-to-interpreter
-arm and all four held-out hook files use it (#176). For the sweep: capture the baseline from the checkout later plans run in, sweep repo-local
-inputs by the main checkout's literal absolute paths, point `--compare` only at `.planning/local/`, and plant a deletion to prove the
-comparison is not vacuous (#182).
-
-## The milestone in one paragraph
-
-v0.1.0 made the scanner detect the attacks its README already claimed — recall **10/60 -> 56/60**.
-It did not add a single new *kind* of attack. All 48 patterns target payloads aimed at a **chat
-model reading prose**. None target payloads aimed at an **agent with tools**: a wildcard permission
-grant in frontmatter, an instruction hidden in an MCP tool `description` the user never sees, a
-lifecycle hook that reinstalls the attacker's instructions after the file is cleaned.
-**v0.2.0 teaches the scanner to read agent configuration, not just agent prose.**
-
-## Phases
-
-| Phase | Requirement | Issue | Status |
-|---|---|---|---|
-| 1 | ENG-01 structural frontmatter engine | #32 | **Done** — PR #104 |
-| 2 | ENG-02 recursive decoder | #30 | **Done** — PR #108, also closed #6 and #7 |
-| 3 | CAT-01 tool & permission abuse `PI050-059` | #33 | **Done** — PR #109 |
-| 4 | CAT-02 MCP & tool-description poisoning `PI060-069` | #34 | **Done** — PR #120 + PR #136 |
-| 5 | CAT-03 persistence & lifecycle hijack `PI070-079` | #35 | **Complete, merged as PR #185** (48 commits, rebase-merged, linear history held; #35 closed 2026-10-09) — 9 patterns, held-out recall 2/12, development 103/115; #183 fixed before the PR (`will` dropped from `PI070`) with its own cost filed as #184 |
-
-Engines first, and the dependency is real rather than tidiness: #32 states it is the prerequisite
-for `PI050-059` and `PI060-069`, and both categories carry frontmatter-shaped patterns
-(`allowed-tools: *`, `Bash(*)`, `mcpServers`) that regex cannot address without the false positives
-#32 exists to remove. #30 is second because it is the only item that moves the **published** recall
-number, 56/60 -> 59/60.
-
-## Standing gates — these are what made v0.1.0 trustworthy
-
-| Gate | Rule |
-|---|---|
-| GATE-01 | 12 corpus payloads per new category, written **from the threat model**, never derived from the patterns |
-| GATE-02 | Recall pinned **exactly**, not as a floor — an improvement fails the build too |
-| GATE-03 | ~1,300-file third-party sweep on every pattern change; the 18-file clean corpus is not sufficient evidence |
-| GATE-04 | No reviewable unit widens more than one category — widening four at once is an unreviewable FP blast radius |
-| GATE-05 | The false-positive control is mutation-tested — two of four v0.1.0 widenings had a control the corpus was not holding |
-
-Also standing: `main` stays strictly linear. A pattern's `name` is a **consumer contract** —
-`pattern_name` ships in the JSON `spec-ci-plugin` reads, so widen the `description`, never rename.
-
-## Detection recall — the published number
-
-Re-synced with `tests/recall_test.rs` and the README on 2026-10-09 (plan 05-07, HEAD `1d8642e`). The authority is `EXPECTED` in
-`tests/recall_test.rs`; if the two disagree, that array wins. The held-out rows are pinned in `EXPECTED` too but are **totalled
-separately** (the test report prints both totals) and are never part of the 115.
-
-| Category | Detected | Recall |
-|---|---|---|
-| Data Exfiltration | 13/13 | 100% |
-| Instruction Injection | 15/15 | 100% |
-| Jailbreaks | 12/12 | 100% |
-| Tool & Permission Abuse | 17/17 | 100% |
-| Role Override | 11/12 | 92% |
-| Encoding/Obfuscation | 11/12 | 91.7% |
-| Multilingual (Czech; German misses) | 8/10 | 80% |
-| MCP & Tool-Description Poisoning | 9/12 | 75% (all ten CAT-02 patterns shipped; the remaining structural rug-pull misses need D-05's deferred structural cross-reference work, issue #131) |
-| Persistence & Lifecycle Hijack (development corpus) | 7/12 | 58.3% (prose 4/7, structural 3/5; 3 deliberate misses, 2 recorded gaps) |
-| **Total (development corpus)** | **103/115** | **89.6%** |
-| **Persistence & Lifecycle Hijack, held-out set** (the published v0.2.0 CAT-03 number) | **2/12** | **16.7%** (prose 2/8, structural 0/4) |
-
-Reached **58/60** on 2026-08-30 when ENG-02 landed.
-
-**Corrected 2026-08-30.** This said 59/60, "closing the three base64 misses". Only ONE of the three
-is base64. The second is reversed text (a different transform, now in ENG-02's scope); the third is
-fully despaced text, which is the *documented non-goal* in `normalize.rs` — `i g n o r e a l l`
-collapses to `ignoreall` and every pattern joins words with `\s+`, so closing it means rewriting
-the pattern set rather than the input. Two misses therefore remain, both for stated reasons.
-
-## Tracking
-
-- **GitHub milestone:** `v0.2.0 — Agent-shaped attacks` (milestone #6) — 5 issues
-- **Project board:** https://github.com/orgs/UnityInFlow/projects/4 — org-wide, 63 items, with
-  `Phase` and `Priority` fields populated for this milestone
-
-- **Deferred:** the `v0.3.0` milestone holds 10 issues — pattern categories #36-#40 plus #31, #41,
-  #10, #11, #4
-
-- **Filed at Phase 4 close-out (04-07, #34):** #129 (JSONC parse gap, silent — **resolved**: fixed
-  by quick task `260915-spt` / `4cddc99`, issue closed), #130 (decoded-layer
-  pass skips structural patterns), #131 (D-05 structural cross-reference for tool shadowing),
-  #132 (`docs/DETECTION-BACKLOG.md` self-match, PR #110-origin), #133 (WR-02, structural corpus
-  README backfill). Full accounting in
-  `.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md`.
-
-- **Already tracked, not duplicated:** #115 (Phase 3 planning artifacts — restored to `main` at
-  this close-out from commit `752ac98`/`db2a575` rather than left referenced-only; re-verify #115
-  is still needed for anything beyond that), #116 (stale planning counters — this close-out
-  reconciled ROADMAP/STATE's library and recall projections but did not audit every counter in
-  every file), #117 (GATE-04 contradiction between STATE.md and REQUIREMENTS.md — this phase's
-  own GATE-04 diff check passed cleanly, but the requirement-text contradiction #117 names is
-  unresolved by that; still open).
-
-## Quick Tasks Completed
-
-| # | Description | Date | Commit | Directory |
-|---|-------------|------|--------|-----------|
-| 260902-jhy | Fix CR-01 negation blindness in PI053/PI056/PI057; fold in WR-01 `PATTERNS.md` category row | 2026-09-02 | `db2a575` | [260902-jhy-fix-cr-01-negation-blindness-in-pi053-pi](./quick/260902-jhy-fix-cr-01-negation-blindness-in-pi053-pi/) |
-| 260903-fast | Fix char-boundary panic in frontmatter projection (detection bypass via oversized multi-byte scalar) | 2026-09-03 | `d28dfd0` | — |
-| 260915-spt | Fix #129 — JSONC-commented config silently skipped the structural pass; adds the stderr diagnostic *and* offset-preserving JSONC tolerance | 2026-09-15 | `4cddc99` | [260915-spt-fix-129-jsonc-commented-config-silently-](./quick/260915-spt-fix-129-jsonc-commented-config-silently-/) |
-| 260915-u3j | Fix #128 — the manufactured-boundary gate: a match whose edge falls inside a separator-joined compound token (`sh-lint`, `on-call`) is withheld as an artefact, library-wide across all passes | 2026-09-16 | `c47194e` | [260915-u3j-fix-128-separator-normalizer-folds-sh-li](./quick/260915-u3j-fix-128-separator-normalizer-folds-sh-li/) |
-| 260915-u3j | Fix #128 — a pattern-agnostic manufactured-boundary gate stops `sh-lint`/`on-call`/`DAN-mode-switch` from firing PI028/PI030/PI031 as artefacts, across all five scanner passes; adds ADR-006 | 2026-09-16 | `66351c8`..`b31b110` (+ Task 4) | [260915-u3j-fix-128-separator-normalizer-folds-sh-li](./quick/260915-u3j-fix-128-separator-normalizer-folds-sh-li/) |
-| 260916-sz4 | Amend GATE-04 to a review-unit rule — "No reviewable unit widens more than one category"; the old "its own PR" wording was never once satisfiable as written (#117) | 2026-09-16 | `7c8e99e` | [260916-sz4-amend-gate-04-to-no-reviewable-unit-wide](./quick/260916-sz4-amend-gate-04-to-no-reviewable-unit-wide/) |
-| 260916-sz4b | Fold the GATE-04 amendment into `.continue-here.md` — a fourth, tracked copy of the standing-gates table still read "One category per PR" (#117) | 2026-09-17 | `20ae586` | — |
-| 260922-st9 | Put the `LEGACY_UNTESTED` ratchet note in past tense — #138 emptied the list, so the present-tense "they are listed in" doc read as a disabled check rather than the ratchet at full strictness (#89) | 2026-09-22 | `b85a536` | [260922-st9-update-stale-legacy-untested-module-doc-](./quick/260922-st9-update-stale-legacy-untested-module-doc-/) |
-| 260923-dbv | Reconcile the stale `CLAUDE.md` Status block — it named a release two versions behind, presented the archived Production Readiness milestone as current, and asserted "CI has been dead since 2026-06-24. Nothing merges" while five PRs were merging through green CI | 2026-09-23 | `4ffbee7` | [260923-dbv-reconcile-the-stale-claude-md-status-blo](./quick/260923-dbv-reconcile-the-stale-claude-md-status-blo/) |
-| 261006-tq8 | Reconcile five stale claims in this file — merged PR #110 still named as the open blocker for closing Phase 4, `0 merge commits`, `357 tests`, two drifted catalogue line numbers, and #129 shown as open; adds the anti-drift blockquote | 2026-10-06 | `465526a` | [261006-tq8-reconcile-stale-claims-in-state-md-110-i](./quick/261006-tq8-reconcile-stale-claims-in-state-md-110-i/) |
-
-## Milestone hygiene done 2026-08-30
-
-Four milestones were open that should not have been. `v0.0.1`, `v0.0.3` and `v0.1.0` had all
-shipped — and `v0.1.0` still held issue #4 (Aho-Corasick), which **shipped without it**. A bare
-`v0.2.0` milestone already existed and a second was created before checking; the old one is now
-renamed `v0.2.0 (early draft — superseded by milestone #6)` and closed. Issues #4, #31 and #11
-moved to `v0.3.0`. All four shipped milestones are closed.
-
-## Open decisions
-
-**#41 library split — deliberately not in this milestone.** It claims three blocked consumers and
-has **zero**: `kore-runtime` is public and shipped but contains no reference to this tool,
-`agent-sandbox` has no repo, `safe-scrape` has no repo. `spec-ci-plugin` shells out to the verified
-binary in production and that path is hardened. Do the split when a real consumer is blocked — the
-API shape will be guessed wrong otherwise. The *other* half of #41 (crates.io, binstall metadata,
-Homebrew) has real users and is cheap; the `.pre-commit-hooks.yaml` sub-item in it already shipped
-and is stale.
-
-**Windows binary (#9), narrowed 2026-08-30.** v0.1.0 ships 4 of the 5 targets #9 asked for; only
-Windows x86_64 is missing, and it *is* a documented root-`CLAUDE.md` constraint. Read the `mcp-hub`
-HUB-V2-02 precedent first — unguarded `cfg(unix)` deps that would not link.
-
-## Session Notes
-
-- 2026-08-30 (Phase 2): **ENG-02 shipped — recall 56/60 -> 58/60.** Three things found by
-  measuring rather than assuming, and all three would have shipped silently.
-  (1) **A panic in production code that 16 green unit tests missed.** `tail[..12]` sliced at a
-  fixed byte offset, which crashes on any file with a multi-byte char near an `&` — a `·` in this
-  repo's own source was enough. Found only by running the binary over the repo. **Unit tests do
-  not substitute for the sweep**; the sweep is what exercises real bytes.
-  (2) **Reversal is an involution**, so recursing on it produced `reversed -> reversed -> base64`
-  for what is simply base64. Restricted to top level.
-  (3) **Reversal was 137ms of a 143ms regression** — 84% of the cost for one payload in sixty,
-  because every line's reversal was handed to all 48 patterns. A generic function-word gate on the
-  reversed text cut the overhead from 28% to 3.3%. The gate uses **generic** words, never payload
-  vocabulary: keying it on `ignore` would mean a new pattern silently needs a decoder change to be
-  reachable.
-  Also: `tests/decode_test.rs` needed `ignore-file` — the decoder makes its own fixtures visible
-  for the first time, which is the tool correctly detecting its own test data.
-
-- 2026-08-30 (Phase 1): **ENG-01 shipped.** The design worth carrying: rather than a rule DSL in
-  the pattern schema, parsed config is **projected to canonical `path = value` text** and the
-  existing regex engine runs against it, gated by a new `scope: frontmatter` field. One schema
-  field instead of a second matching language, and structural rules earn confidence 1.0 because a
-  parser resolved a real key — not because a sentence looked suspicious.
-  **Three things worth not rediscovering.**
-  (1) **The "silent on prose" test is vacuous without a control.** A scope test passes equally if
-  the regex simply fails to match. `a_prose_scoped_rule_would_have_fired_on_that_same_prose` fires
-  the *same sentence* through a prose-scoped rule to prove the silence is scope. This is GATE-05
-  applied to a mechanism rather than a pattern.
-  (2) **The structural pass is inert without a frontmatter-scoped pattern**, by design — the
-  scanner skips parsing entirely. My first YAML-bomb test "passed" in 0.02s because of this and
-  measured nothing. Any test of this pass must load a probe via `--patterns`.
-  (3) **Behaviour-unchanged was proven, not asserted**: the published v0.1.0 binary and this build
-  both report 728 findings on this repo, identical. That is the strongest form of GATE-03 — no
-  pattern changed, so nothing could move.
-  Also: a self-scan finding landed in `src/` for the first time (a doc-comment illustration of a
-  pipe-to-shell payload). Suppressed inline with rationale rather than weakened, and `tests/`
-  needed `ignore-next-line`, not `ignore` — the directive applies to the line it sits on.
-
-- 2026-08-30: **v0.2.0 opened.** Scope decided on evidence, not instinct: the library is 48
-  patterns, so three agentic categories is +30 (1.6x) against +80 (2.7x) for all eight, and the
-  corpus cost is 36 new threat-model payloads against 96. GATE-04 (one category per PR) is what
-  makes eight categories in one milestone unreviewable. #6 and #7 closed as genuinely superseded by
-  #30. Previous milestone archived to `.planning/archive/milestone-v0.1.0/`.
-
-- **Three lessons carried forward** from the archived milestone, because they will bite again:
-  **(1)** A moving alias tag makes "merged", "released" and "reaching users" three different states,
-  and only the third counts — `spec-ci-plugin`'s `v1` sat one commit behind and the fix reached
-  nobody while every gate showed green.
-  **(2)** `gh attestation verify` fails locally on `gh` 2.55.0 with
-  `unsupported tlog public key type: PKIX_ED25519`. It is the client, not the release — proven by
-  running it against a known-good v0.0.3 binary.
-  **(3)** `cargo build --locked` cannot refresh `Cargo.lock` after a version bump; `--locked` exists
-  to refuse exactly that. Run `cargo check --offline` first, then the locked build to verify.
-
-- 2026-09-07 (Phase 4 close-out, 04-07): **CAT-02 closed — see the "Current Phase" section above
-  for the full detail (kept there, alongside 04-04/04-05/04-06's own entries, rather than
-  duplicated here).** Four measurements Phase 5 inherits: (1) the `relaxed_pattern` ratchet's
-  `id >= 50` predicate already covers `PI070`+, already fixed in 04-01; (2) the structural corpus
-  collector and both clean-corpus enumerations are non-recursive (`fs::read_dir` one level deep);
-  (3) the decoded-layer pass runs only prose-scoped patterns, so a `scope: frontmatter` pattern
-  never sees a decoded value (#130); (4) `scripts/gate03-sweep.sh --compare` silently loads an
-  empty baseline against this repository's own committed (JSON-less) sweep directories — always
-  point it at `.planning/local/`. Four issues filed (#129-#132) plus one for a carried-over Phase
-  3 gap (#133, WR-02, waived in `.planning/WINDOWS.md`). The Phase 3 planning directory, lost to
-  the rebase-merge that closed #33, was restored to `main` from `752ac98`/`db2a575`.
-
-- 2026-09-16 (quick task 260915-u3j): **#128 closed — the research's locked mechanism did
-  not survive measurement, worth not rediscovering.** The plan was originally built on
-  "gate the normalized pass": measured against `27e4d49`, that fixes at most 2 of the 6
-  false positives. `-` is a non-word character, so `sh\b`/`on\b` are satisfied by a hyphen
-  directly, with **no fold involved** — `PI028` (all four `sh-lint` variants) and `PI030`
-  (`on-call`) are **raw-pass** findings, and the raw-pass-runs-first dedup means a
-  normalized-pass-only gate never gets a say on them. Only `PI031` (`DAN-mode-switch`) is
-  genuinely normalized-pass. The shipped gate is therefore **pass-independent**:
-  `normalize::span_edge_is_manufactured(text, start, end)`, called at all five scanner
-  passes against each pass's own haystack (the normalized pass via a new `original_span`
-  helper so the gated span and the quoted text can never disagree). Withheld artefacts are
-  filed to a new `manufactured_boundary` array on `ScanReport` — recorded, not discarded,
-  same principle as `suppressed`/`low_confidence`/`baselined` — but deliberately carries
-  **no promotion flag**, because a flag that restored a known artefact would re-enable the
-  bug. Gate set is `-`/`_` only (a strict subset of the fold set, pinned by a test); `.`/`/`
-  excluded because they join paths/domains where a match edge before the separator is
-  routinely legitimate. Eleven patterns audited as exposed to the same short-token-`\b`
-  shape (acceptance criterion 4); full writeup in
-  `docs/adr/ADR-006-manufactured-boundary-gate.md`. GATE-02 pin unmoved
-  (`tests/recall_test.rs::EXPECTED` byte-identical to `27e4d49`); GATE-03 swept 23,037
-  real files before and after — manifest/summary byte-identical, `--compare` empty in both
-  directions (see `260915-u3j-SWEEP.md`). Issue #128's acceptance criterion 3 was corrected
-  in the issue itself: `ig-nore pre-vious in-structions` was never detected on `main`,
-  before or after this fix — intra-word hyphenation is a separate, still-open evasion.
+- Detection gaps and debt from the v0.2.0 close-out: #164-#184 on GitHub milestone **v0.3.0**
+  (unplanned). The one P1 is #176 (download-then-run lifecycle hook, 4/4 held-out structural misses).
+- Live list: `gh issue list --repo UnityInFlow/injection-scanner`. It beats this file.
 
 ## Session Continuity
 
-Last session: 2026-10-09
-Stopped at: Completed 05-07-PLAN.md (Phase 5 close-out); #183 resolved in-phase (`will` dropped from `PI070`'s modal set) — ready for the single phase PR
-Resume file: None
-
----
-*Last updated: 2026-10-09*
-
-## Performance Metrics
-
-| Plan | Duration | Tasks | Files |
-|------|----------|-------|-------|
-| Phase 04 P01 | ~15min (commit span) | 3 tasks | 44 files |
-| Phase 04 P05 | 69min | 3 tasks | 16 files |
-| Phase 04 P06 | 6h 40min (includes ~50min of judged predecessor draft) | 3 tasks | 9 files |
-| Phase 04 P07 | ~27min (commit span) | 3 tasks | 15 files |
-
-## Decisions
-
-- [Phase 04]: GATE-03 sweep excludes ~/.cursor/extensions and ~/.vscode/extensions (vendored bundle noise, direct cause of a reproduced src/frontmatter.rs:219 panic); their config-relevant subdirectories are swept instead
-- [Phase 04]: relaxed_pattern's PI050+ GATE-05 requirement is now an open-ended predicate (id >= 50), fixing a closed 50-59 range that would have exempted every CAT-02/PI060+ pattern
-- [Phase ?]: PI063's external-object set is closed and enumerated (filesystem path, environment variable, concealment framing), chained onto the subject with no gap the verb could be reached across -- keeps all four measured Q3 near-misses silent without special-casing any of them
-- [Phase ?]: GATE-03 comparisons target a fresh binary built from the branch's own fork point in a separate git worktree (never git stash) once main has moved multiple generations past the last committed baseline
-- [Phase 04]: PI066/PI067's heuristic discriminators require a tool-shaped object (backtick code span, snake_case identifier, or identifier+`()`) on both sides of the trigger grammar, not trigger words alone -- vocabulary-only heuristics on common English contrasts (never/always, when/if) produce real false positives at scale (26 hits across ~23,900 files before the fix)
-- [Phase 04]: PI068/PI069's rug-pull bound is stated in the pattern file's own header comment, not only in plan/state records -- a catalogue or README claiming these arms mitigate the rug-pull class would be a false security claim in the repo's own voice
-- [Phase 04]: `scripts/gate03-sweep.sh --compare` must be pointed at `.planning/local/<sweep-dir>/` (the gitignored raw JSON), never at this repository's own committed sweep directories -- the committed copies have zero `*.json` files by design (`dad56d1`/`e54be72`), so `--compare` silently loads an empty baseline and reports every real finding as a false addition
-- [Phase 04]: the Phase 3 planning directory (`.planning/phases/03-tool-permission-abuse-cat-01-33/`) and the CR-01 quick-task directory (`.planning/quick/260902-jhy-.../`), both lost to the rebase-merge that closed #33, are restored to `main` at 04-07's close-out from commits `752ac98`/`db2a575` on the still-live `feat/cat-01-tool-permission-abuse` branch -- future phase-closing rebase-merges must not repeat this loss
+Last session: 2026-10-23 — merged #197 and #200, archived v0.2.0.
+Resume with: `gh pr list` for contributor PRs; otherwise no planned work in this repo.
diff --git a/.planning/REQUIREMENTS.md b/.planning/archive/milestone-v0.2.0/REQUIREMENTS.md
similarity index 100%
rename from .planning/REQUIREMENTS.md
rename to .planning/archive/milestone-v0.2.0/REQUIREMENTS.md
diff --git a/.planning/archive/milestone-v0.2.0/ROADMAP.md b/.planning/archive/milestone-v0.2.0/ROADMAP.md
new file mode 100644
index 0000000..a39723b
--- /dev/null
+++ b/.planning/archive/milestone-v0.2.0/ROADMAP.md
@@ -0,0 +1,226 @@
+# Roadmap: injection-scanner v0.2.0 — Agent-shaped attacks
+
+**Opened:** 2026-08-30 · **Previous milestone:** Production Readiness (v0.0.3 + v0.1.0), shipped
+2026-08-29, archived at `.planning/archive/milestone-v0.1.0/`
+
+## Why this order
+
+The two engines come first, and not for tidiness — the dependency is real and confirmed from both
+sides. #32 states it is "the prerequisite for the `PI050`–`PI059` and `PI060`–`PI069` categories",
+and #33/#34 both list frontmatter-shaped patterns (`allowed-tools: *`, `Bash(*)`, `mcpServers`
+entries) that regex cannot address without the false positives #32 exists to remove.
+
+Each of #33 and #34 does split into a **prose half** that today's engine could match and a
+**structured half** that cannot. Shipping the prose halves first is possible — and rejected:
+it means touching each category twice and taking exactly the false-positive risk the structured
+parser eliminates.
+
+**#30 sits second rather than last** because it is the only item in the milestone that moves the
+*published* recall number — 56/60 → 59/60 — so it converts into a visible claim immediately,
+and it retires #6 and #7, already closed against it.
+
+## Phases
+
+- [x] **Phase 1: Structural frontmatter engine (ENG-01, #32)** — Parse YAML/TOML/JSON frontmatter
+      with a real parser; inspect `allowed-tools`, `tools`, `permissions`, `mcpServers`, `hooks`,
+      `model`/`system` as data. Unblocks Phases 3 and 4.
+
+- [x] **Phase 2: Recursive decoder (ENG-02, #30)** — base64, hex, URL, HTML entities, `\u` escapes,
+      applied recursively with a decode-bomb bound. Takes recall to 59/60.
+
+- [x] **Phase 3: Tool & permission abuse (CAT-01, #33)** — `PI050`–`PI059`.
+- [x] **Phase 4: MCP & tool-description poisoning (CAT-02, #34)** — `PI060`–`PI069`.
+- [x] **Phase 5: Persistence & lifecycle hijack (CAT-03, #35)** — `PI070`–`PI079`.
+
+## Phase details
+
+### Phase 1: Structural frontmatter engine — ENG-01 (#32)
+
+**Goal:** the scanner reads configuration as configuration.
+
+**Success criteria**
+
+- YAML, TOML and JSON frontmatter parse with a real parser; a malformed document is skipped
+  loudly and never aborts the scan (the FIX-03 rule, applied to a new input class)
+
+- Structured findings carry a distinct `context` so they are separable in JSON/SARIF output
+- Zero new findings on `tests/corpus/clean/` **and** on the third-party sweep
+- A structured finding can sit at CRITICAL because its shape is unambiguous — proven by a test,
+  not asserted
+
+**Watch for**
+
+- `.mdc`, `.cursorrules` and extensionless agent files are already in the default set; frontmatter
+  detection must not assume `.md`
+
+- Parser choice is a supply-chain decision — this crate parses untrusted input by definition
+
+### Phase 2: Recursive decoder — ENG-02 (#30)
+
+**Goal:** an encoded payload is no longer a bypass, however many layers deep.
+
+**Success criteria**
+
+- Recall reaches **59/60**; `tests/recall_test.rs` updated to the new exact count
+- Decode depth and output size are bounded; a decode bomb is refused, not OOM'd
+- A decoded finding reports the **original** byte offsets, not offsets into the decoded text
+- `matched_text` still carries original bytes — the `--baseline` digest depends on it, and
+  normalizing it would turn every baselined finding into a free pass for its obfuscation family
+
+**Watch for**
+
+- #6 and #7 are closed as superseded by this; make sure both cases are actually covered
+- Separator normalization already rewrites `-` as whitespace before matching — decoded text
+  enters the same pipeline
+
+### Phase 3: Tool & permission abuse — CAT-01 (#33)
+
+**Goal:** `PI050`–`PI059`. Injection whose payload widens the agent's own authority.
+
+**Success criteria**
+
+- Twelve new corpus payloads written from the threat model; pattern count is not a target — it is
+  whatever the threat model requires within `PI050`–`PI059`, and the resulting number is recorded
+  after the fact
+
+- Both halves covered: structured (wildcard grants via ENG-01) and prose
+  (`--dangerously-skip-permissions`, "no need to ask", "add this to your settings.json")
+
+- A frontmatter-scoped `PI05x` pattern **does** fire on a file's own wildcard grant, accepting
+  overlap with `spec-linter` S005 — the boundary is provenance, not phrasing: S005 lints a spec you
+  wrote, in your own repo, at authoring time; this scanner is pointed at untrusted input, so the
+  same `allowed-tools: *` is a lint finding in your own CLAUDE.md and an attack in a skill someone
+  shipped you
+
+> Both corrections above come from `03-CONTEXT.md` D-11 (the S005-boundary criterion) and D-16 (the
+> "10 patterns" criterion). CONTEXT.md is authoritative where it conflicts with this roadmap — do
+> not re-derive or re-inherit the superseded wording.
+
+**Plans:** 7/7 plans executed
+
+Plans:
+
+- [x] 03-01-PLAN.md — Corpus, recall harness and the measured pre-pattern baseline (D-01..D-05)
+- [x] 03-02-PLAN.md — Five false-positive control specimens in `tests/corpus/clean/` (D-06, D-06a, D-06b)
+- [x] 03-03-PLAN.md — GATE-03 sweep script, recorded pre-pattern sweep, ROADMAP correction (D-10, D-11, D-16)
+- [x] 03-04-PLAN.md — Relaxed-control schema field, mutation-pairing gate, PI050+ ratchet (D-07, D-08, D-09)
+- [x] 03-05-PLAN.md — Structural patterns PI050-PI052, CRITICAL, `scope: frontmatter` (D-12, D-13)
+- [x] 03-06-PLAN.md — Prose patterns PI053-PI057, HIGH (D-14, D-15, D-17)
+- [x] 03-07-PLAN.md — GATE-03 delta sweep, number reconciliation, deferral issues, pre-PR gate
+
+### Phase 4: MCP & tool-description poisoning — CAT-02 (#34)
+
+**Goal:** `PI060`–`PI069`. The attack the user never sees.
+
+**Success criteria**
+
+- 10 patterns; 12 new corpus payloads
+- Imperative language inside a tool `description`; unpinned `npx -y` and `http://` servers;
+  cross-tool shadowing; version/date-conditional rug-pull markers
+
+- **Highest false-positive risk in the milestone** — a legitimate MCP manifest is full of
+  imperative description text. The `Show the current system prompt` precedent applies: the
+  possessive requirement is what keeps PI021 off real manifests. Expect to need a similar
+  narrowing rule, and sweep real MCP manifests specifically, not just documentation
+
+**Plans:** 7/7 plans executed
+
+Plans:
+
+- [x] 04-01-PLAN.md — Pre-edit GATE-03 baseline, per-category structural corpus collector, GATE-05 range repair
+- [x] 04-02-PLAN.md — 12 threat-model payloads, wrapper-shape projection control, measured pre-pattern baseline (GATE-01)
+- [x] 04-03-PLAN.md — Clean-corpus boundary specimens, vendored registry sample with provenance (D-06)
+- [x] 04-04-PLAN.md — PI060-PI062 config hygiene, MEDIUM, `scope: frontmatter` (D-03)
+- [x] 04-05-PLAN.md — PI063-PI065 tool-description poisoning, HIGH, prose (D-01, D-02)
+- [x] 04-06-PLAN.md — PI066-PI069 shadowing and rug-pull heuristics, MEDIUM, prose (D-04)
+- [x] 04-07-PLAN.md — Whole-category sweep, number reconciliation, deferral issues, phase close
+
+### Phase 5: Persistence & lifecycle hijack — CAT-03 (#35)
+
+**Goal:** `PI070`–`PI079`. Payloads that survive the obvious cleanup.
+
+**Success criteria**
+
+- 9 patterns in `PI070`-`PI079` (`PI078` deliberately unallocated, amended by D-07 in plan 05-06); 12 new corpus payloads
+- Self-rewriting instructions, hook and lifecycle abuse, memory-file poisoning
+- At least one pattern detects an instruction to write *into* a file the agent will re-read
+
+> **`05-CONTEXT.md` is authoritative where it sharpens these criteria — do not re-derive the
+> superseded readings.** Three things were settled there after measurement. (1) The range has **9**
+> free slots, not 10: `PI070` already shipped via PR #110, so the phase plans `PI071`–`PI079` and
+> the "10 patterns" line above counts the whole range rather than the phase's own additions (D-07);
+> `PI078`/`PI079` are provisional and the criterion is amended in the same change if either is
+> dropped. (2) The 12 corpus payloads **replace** the 6 inherited with PR #110, which were
+> GATE-01-tainted — payload 1 was byte-identical to `PI070`'s own `example` — so the pinned recall
+> row is expected to fall below its published 6/6 and that is the gate working (D-01). (3) Issue
+> #35's "CRITICAL across the board" is **not** followed: `PATTERNS.md` rule 3 governs severity and
+> nothing in this range ships in that tier (D-06).
+>
+> **Amended in plan 05-06 under D-07's authority.** `PI078` (remote-lifecycle-hook-endpoint) was
+> measured and dropped, so the range ships 9 patterns (`PI070`-`PI077` and `PI079`) and the id
+> `PI078` stays unallocated. The measurement: a dotted-host remote-endpoint rule fires on the
+> structural attack payload 04 and on the clean `persistence-corporate-audit-endpoint.json`
+> specimen alike, and swapping the bound event, the host's registrable domain and the URL between
+> the two documents moved nothing. `PI079` was kept (MEDIUM) on its own measured criterion.
+
+**Plans:** 7/7 plans executed
+
+Plans:
+
+- [x] 05-01-PLAN.md — GATE-03 pre-edit baseline, 12 blind-written payloads, measured pre-pattern pins (D-01, D-03, D-05)
+- [x] 05-02-PLAN.md — Nine clean-corpus specimens and the two mutation proofs that make D-03's amendment and D-04's conjuncts load-bearing (D-02, D-03, D-04)
+- [x] 05-03-PLAN.md — `PI070` object/verb widening and `PI071` agent-persistence-nonmodal, HIGH, prose (D-06)
+- [x] 05-04-PLAN.md — `PI072` self-propagation, `PI074`/`PI075` memory arms, and the self-matching backlog bullets (D-02, D-05, D-06)
+- [x] 05-05-PLAN.md — `PI073` instruction-file-write-directive (MEDIUM) and `PI076` agent-hook-registration-directive (D-04, D-06)
+- [x] 05-06-PLAN.md — `PI077` structural lifecycle arm, plus `PI078`/`PI079` resolved on measured criteria (D-03, D-06, D-07)
+- [x] 05-07-PLAN.md — Whole-category GATE-03 delta, number reconciliation, deferral issues, #35 close-out, pre-PR gates
+
+## Gates applied to every phase
+
+| Gate | Rule |
+|---|---|
+| GATE-01 | 12 corpus payloads per category, from the threat model, never derived from patterns |
+| GATE-02 | Recall counts pinned **exactly** — an improvement fails the build too |
+| GATE-03 | ~1,300-file third-party sweep on every pattern change |
+| GATE-04 | No reviewable unit widens more than one category |
+| GATE-05 | The false-positive control is mutation-tested |
+
+Also standing: `main` stays strictly linear (0 merge commits); a pattern's `name` is a consumer
+contract (`pattern_name` ships in the JSON `spec-ci-plugin` reads) — widen the `description`, never
+rename.
+
+## Progress
+
+| Phase | Requirement | Issue | Status |
+|---|---|---|---|
+| 1. Structural frontmatter engine | ENG-01 | #32 | **Done** — PR #104 |
+| 2. Recursive decoder | ENG-02 | #30 | **Done** — PR #108 |
+| 3. Tool & permission abuse | CAT-01 | #33 | **Done** — PR #109 |
+| 4. MCP & tool-description poisoning | CAT-02 | #34 | **Done** — PR #120 + PR #136 |
+| 5. Persistence & lifecycle hijack | CAT-03 | #35 | **Complete.** 7/7 plans; 9 patterns `PI070`-`PI077` and `PI079`, `PI078` unallocated. Held-out recall 2/12 published as the CAT-03 number, development 7/12, library-wide 103/115. Merged as PR #185 (48 commits, rebased); #35 closed. The blocking review finding #183 was fixed before the PR, not deferred, and its own cost filed as #184 |
+
+**Library (Phase 5 close, plan 05-07):** **79 patterns**, measured directly from the loader and asserted by
+`test_total_pattern_count`: the 71 at Phase 4's close plus CAT-03's eight new patterns (`PI071`-`PI077` and `PI079`; `PI070`
+had shipped from PR #110 and is not a new count). `PI078` is deliberately unallocated, so the range ships 9 patterns, not
+the 10 its id span names.
+**Recall (Phase 5 close, plan 05-07):** **103/115 (89.6%)** on the development corpus, up from 102/109 at Phase 4's close.
+The denominator moved by +6, not by the 12 CAT-03 payloads alone, because the 6 inherited and GATE-01-tainted CAT-03
+payloads were replaced (D-01) and the category's pre-pattern baseline was 97/115. CAT-03's own development rows are
+**7/12 (58.3%)** (prose 4/7, structural 3/5). **The published CAT-03 number is the sealed held-out set's: 2/12 (16.7%)**
+(prose 2/8, structural 0/4), reported beside the development score and **never summed into the 115**. The projection
+this milestone opened with did not anticipate a held-out set, and the gap between 58.3% and 16.7% is the finding.
+
+**Library:** **71 patterns** as of Phase 4's close (04-07), measured directly from the loader —
+corrected from the ~78 projected when the milestone opened. CAT-02 (`PI060`-`PI069`) added
+exactly its planned 10; the difference from the projection is other, un-milestoned pattern work
+that landed on `main` during the same window (PR #110's `PI058`/`PI070`/`PI110`-`PI113`, plus
+subsequent widenings), independent of this phase's own count. CAT-03 (`PI070`-`PI079`, Phase 5)
+is already partially seeded by `PI070` from that same PR.
+**Recall:** **102/109 (93.6%)** as of Phase 4's close (04-07), corrected from the 76/84 (90.5%)
+projection recorded as of 04-02. The denominator grew to 109, not the originally projected 84 —
+25 payloads beyond CAT-02's own 12 landed from other PRs during the same window (#110's
+multilingual range, #122's widenings, and independent corpus growth in encoding/role-override).
+CAT-02's own row is now **9/12 (75%)**, up from its measured pre-pattern baseline of 6/12 — the
+remaining three misses are the two rug-pull structural payloads (D-05's deferred structural
+cross-reference; see `deferred-items.md`) and one deliberately-undetected unpinned-registry-install
+payload (D-03's accepted cost).
diff --git a/.planning/archive/milestone-v0.2.0/STATE.md b/.planning/archive/milestone-v0.2.0/STATE.md
new file mode 100644
index 0000000..edd6134
--- /dev/null
+++ b/.planning/archive/milestone-v0.2.0/STATE.md
@@ -0,0 +1,341 @@
+---
+gsd_state_version: 1.0
+milestone: v0.2.0
+milestone_name: Agent-shaped attacks
+status: in_progress
+stopped_at: "Phase 5 COMPLETE and merged (PR #185, 48 commits, rebase-merged; #35 closed). All 5 phases of v0.2.0 done and the milestone has 0 open issues. Patterns frozen at 79; held-out CAT-03 recall 2/12 published, development 103/115. #183 fixed pre-PR, its cost filed as #184. NEXT: release v0.2.0 (tag-triggered, GitHub-hosted release.yml), then complete/archive the milestone, then agent-memory v0.1.0 per the scope freeze."
+last_updated: "2026-10-09T13:20:00.000Z"
+state_head: f0e2308
+progress:
+  total_phases: 5
+  completed_phases: 5
+  total_plans: 23
+  completed_plans: 23
+  percent: 100
+---
+
+# State: injection-scanner
+
+## Project Reference
+
+See: `.planning/PROJECT.md`
+**Core value:** Catch prompt injection attacks before they reach production
+**Milestone:** **v0.2.0 — Agent-shaped attacks** (opened 2026-08-30)
+
+> Full history for the previous milestone — 412 lines of session notes — is archived at
+> `.planning/archive/milestone-v0.1.0/STATE.md`, alongside its REQUIREMENTS, ROADMAP and phases.
+
+## Current Phase
+
+**Phase 5 — Persistence & lifecycle hijack (CAT-03, #35)** · **7/7 plans executed** (closed out 2026-10-09 by plan 05-07).
+The phase-complete marker and the pull request are the orchestrator's; the last phase of this milestone. Phases 1-4 are
+complete (Phase 4: PR #120 + PR #136).
+
+**What shipped:** 9 patterns in `PI070`-`PI079` — `PI070` (already on `main` from PR #110, widened here) plus eight new
+(`PI071`-`PI077` and `PI079`). **`PI078` is deliberately unallocated** (D-07: a remote-lifecycle-hook-endpoint rule fires on the
+attack payload and on the clean corporate-audit specimen alike). The range had **9** free slots, not 10, because `PI070` had already
+shipped. Six are HIGH (`PI070`, `PI071`, `PI072`, `PI075`, `PI076`, `PI077`) and three MEDIUM (`PI073`, `PI074`, `PI079`);
+**nothing is CRITICAL** (D-06, recorded on #35). Library: **79 patterns**.
+
+**The headline number is the held-out one, and it is much lower.** The category scores **7/12 (58.3%)** on its development corpus
+(prose 4/7, structural 3/5) but **2/12 (16.7%)** on a sealed, blind-authored held-out set (prose 2/8, structural 0/4) that was hashed
+before any `PI071`+ pattern existed and opened once, after the patterns were frozen. Neither held-out detection is a pattern this phase
+wrote (`PI025`, `PI070`). Per `heldout-set.md` rule 4 the ten misses were reported, not tuned away. Library-wide development recall is
+**103/115 (89.6%)**; the held-out rows are totalled separately and never summed into it.
+
+**Measured at close-out (HEAD `1d8642e`, 2026-10-09):** full suite `cargo test --locked` **467 passed, 0 failed (38 test-result lines, exit 0, redirected to a file and the exit code read; never piped)**; `cargo fmt --check` and
+`cargo clippy --all-targets -D warnings` clean; whole-category GATE-03 delta **0 additions, 0 removals** over 26,407 files in both
+directions (`05-SWEEP.md`); GATE-04 proven by a quoted diff (one pattern file); `Cargo.toml`, `Cargo.lock` and `src/` untouched, so no ADR.
+Self-scan outside `examples/ patterns/ tests/ tools/` is exactly the two standing `PATTERN-CATALOGUE.md` findings (`PI001`, `PI031`) and
+nothing new.
+
+**The one BLOCKING finding, #183, is RESOLVED (2026-10-09) — the phase is not shipping it open.** The pre-PR code-review gate found that
+`PI070`'s widened objects and verbs made third-person `will` vendor-feature sentences fire HIGH (13 of 17 probes new relative to the
+pre-phase pattern; the sweep was silent because no such sentence is in a real file on this machine). The 9b determiner remedy could not
+discriminate — the class fires on `the` as readily as `your`. The maintainer chose to drop `will` from the modal set, keeping `may now`
+(a claim that a control is off is attack framing, not product description). Measured cost: **zero** attack-corpus and **zero** held-out
+detections, so held-out stays 2/12 and development 103/115; no sibling pattern shows the class. The permanent guard is a new clean
+specimen, `tests/corpus/clean/persistence-vendor-release-notes.md`, mutation-tested at shipped 0 / `will`-restored 6. `PI070` stays HIGH
+because the benign sentence class was removed rather than the grade waived. See `05-REVIEW.md` 'BL-01: RESOLVED'.
+
+**Filed at close-out:** #164-#183 (all milestone v0.3.0 except #183, which is v0.2.0), full accounting in
+`.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md`. The #35 close-out comment (the severity deviation and the
+slot arithmetic) is https://github.com/UnityInFlow/injection-scanner/issues/35#issuecomment-6080268901, with an addendum for #183.
+
+> **This section has drifted before — verify it before planning from it.** It once named a merged PR as the open blocker for closing
+> Phase 4, and carried a test count and two pinned line numbers that had all moved. Settle such claims with `gh pr view <N> --json state`
+> (is a PR actually open), `git log --merges --oneline origin/main` (the merge-commit count) and a full `cargo test` (the test count). The
+> live answer beats this file whenever the two disagree. State at close-out: Phase 5 is on branch `feat/35-persistence-lifecycle-hijack`,
+> **no PR is open yet**, and `main` is where Phase 4 left it. Last verified: 2026-10-09.
+
+### Four things from Phase 5 worth not rediscovering
+
+**(1) A development corpus overstates a detector; ship a sealed set before the patterns exist.** The category looked like 7/12 and is
+2/12 on payloads nobody tuned against. The development payloads cleared the derivation check *lexically*, but their shapes had been restated
+to the pattern authors, so the check could not see structural dependence. The held-out set (authored blind, hashed first, opened once)
+is the only number here that is independent. `tools/corpus-derivation-check.py` proves "no wording was lifted", never "GATE-01 satisfied" (#166).
+
+**(2) "A modal keeps vendor prose out" is false for `will`, and a clean sweep is absence of evidence.** Every HIGH prose arm that accepts a
+product name as a declarative subject fired on vendor documentation: `PI071` twice, `PI076` once, and `PI070` (#183, fixed by removing `will`). The 26,407-file
+sweep was empty every time because no such sentence existed in a real file on this machine. The only thing that found each one was an
+adversarial probe with synthesized vendor-voice sentences. Run one (the one in `05-REVIEW.md`) before trusting a green sweep on a HIGH
+prose arm. The discriminator for `PI071`/`PI076` was the second-person possessive, not the deictic word; `PI070`'s bare-object-path case
+needs a different one.
+
+**(3) The both-directions specimen test beat the sweep.** `PI078` was dropped because swapping the bound event, the host's registrable
+domain and the URL between the attack payload and the audit specimen moved nothing. The dotted-host draft produced 0 hits on the 263-file
+hooks sweep, so the sweep half of the old criterion alone would not have disqualified it. A pattern that cannot separate the attack from a
+compliance control is not shipped, however clean the sweep.
+
+**(4) The structural pass matches one projected line at a time, and `--compare` is path-keyed.** No structural regex can require two leaves
+to co-occur; `locate()` collapses repeated keys onto the first line (#165); a download-then-run hook is outside `PI077`'s pipe-to-interpreter
+arm and all four held-out hook files use it (#176). For the sweep: capture the baseline from the checkout later plans run in, sweep repo-local
+inputs by the main checkout's literal absolute paths, point `--compare` only at `.planning/local/`, and plant a deletion to prove the
+comparison is not vacuous (#182).
+
+## The milestone in one paragraph
+
+v0.1.0 made the scanner detect the attacks its README already claimed — recall **10/60 -> 56/60**.
+It did not add a single new *kind* of attack. All 48 patterns target payloads aimed at a **chat
+model reading prose**. None target payloads aimed at an **agent with tools**: a wildcard permission
+grant in frontmatter, an instruction hidden in an MCP tool `description` the user never sees, a
+lifecycle hook that reinstalls the attacker's instructions after the file is cleaned.
+**v0.2.0 teaches the scanner to read agent configuration, not just agent prose.**
+
+## Phases
+
+| Phase | Requirement | Issue | Status |
+|---|---|---|---|
+| 1 | ENG-01 structural frontmatter engine | #32 | **Done** — PR #104 |
+| 2 | ENG-02 recursive decoder | #30 | **Done** — PR #108, also closed #6 and #7 |
+| 3 | CAT-01 tool & permission abuse `PI050-059` | #33 | **Done** — PR #109 |
+| 4 | CAT-02 MCP & tool-description poisoning `PI060-069` | #34 | **Done** — PR #120 + PR #136 |
+| 5 | CAT-03 persistence & lifecycle hijack `PI070-079` | #35 | **Complete, merged as PR #185** (48 commits, rebase-merged, linear history held; #35 closed 2026-10-09) — 9 patterns, held-out recall 2/12, development 103/115; #183 fixed before the PR (`will` dropped from `PI070`) with its own cost filed as #184 |
+
+Engines first, and the dependency is real rather than tidiness: #32 states it is the prerequisite
+for `PI050-059` and `PI060-069`, and both categories carry frontmatter-shaped patterns
+(`allowed-tools: *`, `Bash(*)`, `mcpServers`) that regex cannot address without the false positives
+#32 exists to remove. #30 is second because it is the only item that moves the **published** recall
+number, 56/60 -> 59/60.
+
+## Standing gates — these are what made v0.1.0 trustworthy
+
+| Gate | Rule |
+|---|---|
+| GATE-01 | 12 corpus payloads per new category, written **from the threat model**, never derived from the patterns |
+| GATE-02 | Recall pinned **exactly**, not as a floor — an improvement fails the build too |
+| GATE-03 | ~1,300-file third-party sweep on every pattern change; the 18-file clean corpus is not sufficient evidence |
+| GATE-04 | No reviewable unit widens more than one category — widening four at once is an unreviewable FP blast radius |
+| GATE-05 | The false-positive control is mutation-tested — two of four v0.1.0 widenings had a control the corpus was not holding |
+
+Also standing: `main` stays strictly linear. A pattern's `name` is a **consumer contract** —
+`pattern_name` ships in the JSON `spec-ci-plugin` reads, so widen the `description`, never rename.
+
+## Detection recall — the published number
+
+Re-synced with `tests/recall_test.rs` and the README on 2026-10-09 (plan 05-07, HEAD `1d8642e`). The authority is `EXPECTED` in
+`tests/recall_test.rs`; if the two disagree, that array wins. The held-out rows are pinned in `EXPECTED` too but are **totalled
+separately** (the test report prints both totals) and are never part of the 115.
+
+| Category | Detected | Recall |
+|---|---|---|
+| Data Exfiltration | 13/13 | 100% |
+| Instruction Injection | 15/15 | 100% |
+| Jailbreaks | 12/12 | 100% |
+| Tool & Permission Abuse | 17/17 | 100% |
+| Role Override | 11/12 | 92% |
+| Encoding/Obfuscation | 11/12 | 91.7% |
+| Multilingual (Czech; German misses) | 8/10 | 80% |
+| MCP & Tool-Description Poisoning | 9/12 | 75% (all ten CAT-02 patterns shipped; the remaining structural rug-pull misses need D-05's deferred structural cross-reference work, issue #131) |
+| Persistence & Lifecycle Hijack (development corpus) | 7/12 | 58.3% (prose 4/7, structural 3/5; 3 deliberate misses, 2 recorded gaps) |
+| **Total (development corpus)** | **103/115** | **89.6%** |
+| **Persistence & Lifecycle Hijack, held-out set** (the published v0.2.0 CAT-03 number) | **2/12** | **16.7%** (prose 2/8, structural 0/4) |
+
+Reached **58/60** on 2026-08-30 when ENG-02 landed.
+
+**Corrected 2026-08-30.** This said 59/60, "closing the three base64 misses". Only ONE of the three
+is base64. The second is reversed text (a different transform, now in ENG-02's scope); the third is
+fully despaced text, which is the *documented non-goal* in `normalize.rs` — `i g n o r e a l l`
+collapses to `ignoreall` and every pattern joins words with `\s+`, so closing it means rewriting
+the pattern set rather than the input. Two misses therefore remain, both for stated reasons.
+
+## Tracking
+
+- **GitHub milestone:** `v0.2.0 — Agent-shaped attacks` (milestone #6) — 5 issues
+- **Project board:** https://github.com/orgs/UnityInFlow/projects/4 — org-wide, 63 items, with
+  `Phase` and `Priority` fields populated for this milestone
+
+- **Deferred:** the `v0.3.0` milestone holds 10 issues — pattern categories #36-#40 plus #31, #41,
+  #10, #11, #4
+
+- **Filed at Phase 4 close-out (04-07, #34):** #129 (JSONC parse gap, silent — **resolved**: fixed
+  by quick task `260915-spt` / `4cddc99`, issue closed), #130 (decoded-layer
+  pass skips structural patterns), #131 (D-05 structural cross-reference for tool shadowing),
+  #132 (`docs/DETECTION-BACKLOG.md` self-match, PR #110-origin), #133 (WR-02, structural corpus
+  README backfill). Full accounting in
+  `.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md`.
+
+- **Already tracked, not duplicated:** #115 (Phase 3 planning artifacts — restored to `main` at
+  this close-out from commit `752ac98`/`db2a575` rather than left referenced-only; re-verify #115
+  is still needed for anything beyond that), #116 (stale planning counters — this close-out
+  reconciled ROADMAP/STATE's library and recall projections but did not audit every counter in
+  every file), #117 (GATE-04 contradiction between STATE.md and REQUIREMENTS.md — this phase's
+  own GATE-04 diff check passed cleanly, but the requirement-text contradiction #117 names is
+  unresolved by that; still open).
+
+## Quick Tasks Completed
+
+| # | Description | Date | Commit | Directory |
+|---|-------------|------|--------|-----------|
+| 260902-jhy | Fix CR-01 negation blindness in PI053/PI056/PI057; fold in WR-01 `PATTERNS.md` category row | 2026-09-02 | `db2a575` | [260902-jhy-fix-cr-01-negation-blindness-in-pi053-pi](./quick/260902-jhy-fix-cr-01-negation-blindness-in-pi053-pi/) |
+| 260903-fast | Fix char-boundary panic in frontmatter projection (detection bypass via oversized multi-byte scalar) | 2026-09-03 | `d28dfd0` | — |
+| 260915-spt | Fix #129 — JSONC-commented config silently skipped the structural pass; adds the stderr diagnostic *and* offset-preserving JSONC tolerance | 2026-09-15 | `4cddc99` | [260915-spt-fix-129-jsonc-commented-config-silently-](./quick/260915-spt-fix-129-jsonc-commented-config-silently-/) |
+| 260915-u3j | Fix #128 — the manufactured-boundary gate: a match whose edge falls inside a separator-joined compound token (`sh-lint`, `on-call`) is withheld as an artefact, library-wide across all passes | 2026-09-16 | `c47194e` | [260915-u3j-fix-128-separator-normalizer-folds-sh-li](./quick/260915-u3j-fix-128-separator-normalizer-folds-sh-li/) |
+| 260915-u3j | Fix #128 — a pattern-agnostic manufactured-boundary gate stops `sh-lint`/`on-call`/`DAN-mode-switch` from firing PI028/PI030/PI031 as artefacts, across all five scanner passes; adds ADR-006 | 2026-09-16 | `66351c8`..`b31b110` (+ Task 4) | [260915-u3j-fix-128-separator-normalizer-folds-sh-li](./quick/260915-u3j-fix-128-separator-normalizer-folds-sh-li/) |
+| 260916-sz4 | Amend GATE-04 to a review-unit rule — "No reviewable unit widens more than one category"; the old "its own PR" wording was never once satisfiable as written (#117) | 2026-09-16 | `7c8e99e` | [260916-sz4-amend-gate-04-to-no-reviewable-unit-wide](./quick/260916-sz4-amend-gate-04-to-no-reviewable-unit-wide/) |
+| 260916-sz4b | Fold the GATE-04 amendment into `.continue-here.md` — a fourth, tracked copy of the standing-gates table still read "One category per PR" (#117) | 2026-09-17 | `20ae586` | — |
+| 260922-st9 | Put the `LEGACY_UNTESTED` ratchet note in past tense — #138 emptied the list, so the present-tense "they are listed in" doc read as a disabled check rather than the ratchet at full strictness (#89) | 2026-09-22 | `b85a536` | [260922-st9-update-stale-legacy-untested-module-doc-](./quick/260922-st9-update-stale-legacy-untested-module-doc-/) |
+| 260923-dbv | Reconcile the stale `CLAUDE.md` Status block — it named a release two versions behind, presented the archived Production Readiness milestone as current, and asserted "CI has been dead since 2026-06-24. Nothing merges" while five PRs were merging through green CI | 2026-09-23 | `4ffbee7` | [260923-dbv-reconcile-the-stale-claude-md-status-blo](./quick/260923-dbv-reconcile-the-stale-claude-md-status-blo/) |
+| 261006-tq8 | Reconcile five stale claims in this file — merged PR #110 still named as the open blocker for closing Phase 4, `0 merge commits`, `357 tests`, two drifted catalogue line numbers, and #129 shown as open; adds the anti-drift blockquote | 2026-10-06 | `465526a` | [261006-tq8-reconcile-stale-claims-in-state-md-110-i](./quick/261006-tq8-reconcile-stale-claims-in-state-md-110-i/) |
+
+## Milestone hygiene done 2026-08-30
+
+Four milestones were open that should not have been. `v0.0.1`, `v0.0.3` and `v0.1.0` had all
+shipped — and `v0.1.0` still held issue #4 (Aho-Corasick), which **shipped without it**. A bare
+`v0.2.0` milestone already existed and a second was created before checking; the old one is now
+renamed `v0.2.0 (early draft — superseded by milestone #6)` and closed. Issues #4, #31 and #11
+moved to `v0.3.0`. All four shipped milestones are closed.
+
+## Open decisions
+
+**#41 library split — deliberately not in this milestone.** It claims three blocked consumers and
+has **zero**: `kore-runtime` is public and shipped but contains no reference to this tool,
+`agent-sandbox` has no repo, `safe-scrape` has no repo. `spec-ci-plugin` shells out to the verified
+binary in production and that path is hardened. Do the split when a real consumer is blocked — the
+API shape will be guessed wrong otherwise. The *other* half of #41 (crates.io, binstall metadata,
+Homebrew) has real users and is cheap; the `.pre-commit-hooks.yaml` sub-item in it already shipped
+and is stale.
+
+**Windows binary (#9), narrowed 2026-08-30.** v0.1.0 ships 4 of the 5 targets #9 asked for; only
+Windows x86_64 is missing, and it *is* a documented root-`CLAUDE.md` constraint. Read the `mcp-hub`
+HUB-V2-02 precedent first — unguarded `cfg(unix)` deps that would not link.
+
+## Session Notes
+
+- 2026-08-30 (Phase 2): **ENG-02 shipped — recall 56/60 -> 58/60.** Three things found by
+  measuring rather than assuming, and all three would have shipped silently.
+  (1) **A panic in production code that 16 green unit tests missed.** `tail[..12]` sliced at a
+  fixed byte offset, which crashes on any file with a multi-byte char near an `&` — a `·` in this
+  repo's own source was enough. Found only by running the binary over the repo. **Unit tests do
+  not substitute for the sweep**; the sweep is what exercises real bytes.
+  (2) **Reversal is an involution**, so recursing on it produced `reversed -> reversed -> base64`
+  for what is simply base64. Restricted to top level.
+  (3) **Reversal was 137ms of a 143ms regression** — 84% of the cost for one payload in sixty,
+  because every line's reversal was handed to all 48 patterns. A generic function-word gate on the
+  reversed text cut the overhead from 28% to 3.3%. The gate uses **generic** words, never payload
+  vocabulary: keying it on `ignore` would mean a new pattern silently needs a decoder change to be
+  reachable.
+  Also: `tests/decode_test.rs` needed `ignore-file` — the decoder makes its own fixtures visible
+  for the first time, which is the tool correctly detecting its own test data.
+
+- 2026-08-30 (Phase 1): **ENG-01 shipped.** The design worth carrying: rather than a rule DSL in
+  the pattern schema, parsed config is **projected to canonical `path = value` text** and the
+  existing regex engine runs against it, gated by a new `scope: frontmatter` field. One schema
+  field instead of a second matching language, and structural rules earn confidence 1.0 because a
+  parser resolved a real key — not because a sentence looked suspicious.
+  **Three things worth not rediscovering.**
+  (1) **The "silent on prose" test is vacuous without a control.** A scope test passes equally if
+  the regex simply fails to match. `a_prose_scoped_rule_would_have_fired_on_that_same_prose` fires
+  the *same sentence* through a prose-scoped rule to prove the silence is scope. This is GATE-05
+  applied to a mechanism rather than a pattern.
+  (2) **The structural pass is inert without a frontmatter-scoped pattern**, by design — the
+  scanner skips parsing entirely. My first YAML-bomb test "passed" in 0.02s because of this and
+  measured nothing. Any test of this pass must load a probe via `--patterns`.
+  (3) **Behaviour-unchanged was proven, not asserted**: the published v0.1.0 binary and this build
+  both report 728 findings on this repo, identical. That is the strongest form of GATE-03 — no
+  pattern changed, so nothing could move.
+  Also: a self-scan finding landed in `src/` for the first time (a doc-comment illustration of a
+  pipe-to-shell payload). Suppressed inline with rationale rather than weakened, and `tests/`
+  needed `ignore-next-line`, not `ignore` — the directive applies to the line it sits on.
+
+- 2026-08-30: **v0.2.0 opened.** Scope decided on evidence, not instinct: the library is 48
+  patterns, so three agentic categories is +30 (1.6x) against +80 (2.7x) for all eight, and the
+  corpus cost is 36 new threat-model payloads against 96. GATE-04 (one category per PR) is what
+  makes eight categories in one milestone unreviewable. #6 and #7 closed as genuinely superseded by
+  #30. Previous milestone archived to `.planning/archive/milestone-v0.1.0/`.
+
+- **Three lessons carried forward** from the archived milestone, because they will bite again:
+  **(1)** A moving alias tag makes "merged", "released" and "reaching users" three different states,
+  and only the third counts — `spec-ci-plugin`'s `v1` sat one commit behind and the fix reached
+  nobody while every gate showed green.
+  **(2)** `gh attestation verify` fails locally on `gh` 2.55.0 with
+  `unsupported tlog public key type: PKIX_ED25519`. It is the client, not the release — proven by
+  running it against a known-good v0.0.3 binary.
+  **(3)** `cargo build --locked` cannot refresh `Cargo.lock` after a version bump; `--locked` exists
+  to refuse exactly that. Run `cargo check --offline` first, then the locked build to verify.
+
+- 2026-09-07 (Phase 4 close-out, 04-07): **CAT-02 closed — see the "Current Phase" section above
+  for the full detail (kept there, alongside 04-04/04-05/04-06's own entries, rather than
+  duplicated here).** Four measurements Phase 5 inherits: (1) the `relaxed_pattern` ratchet's
+  `id >= 50` predicate already covers `PI070`+, already fixed in 04-01; (2) the structural corpus
+  collector and both clean-corpus enumerations are non-recursive (`fs::read_dir` one level deep);
+  (3) the decoded-layer pass runs only prose-scoped patterns, so a `scope: frontmatter` pattern
+  never sees a decoded value (#130); (4) `scripts/gate03-sweep.sh --compare` silently loads an
+  empty baseline against this repository's own committed (JSON-less) sweep directories — always
+  point it at `.planning/local/`. Four issues filed (#129-#132) plus one for a carried-over Phase
+  3 gap (#133, WR-02, waived in `.planning/WINDOWS.md`). The Phase 3 planning directory, lost to
+  the rebase-merge that closed #33, was restored to `main` from `752ac98`/`db2a575`.
+
+- 2026-09-16 (quick task 260915-u3j): **#128 closed — the research's locked mechanism did
+  not survive measurement, worth not rediscovering.** The plan was originally built on
+  "gate the normalized pass": measured against `27e4d49`, that fixes at most 2 of the 6
+  false positives. `-` is a non-word character, so `sh\b`/`on\b` are satisfied by a hyphen
+  directly, with **no fold involved** — `PI028` (all four `sh-lint` variants) and `PI030`
+  (`on-call`) are **raw-pass** findings, and the raw-pass-runs-first dedup means a
+  normalized-pass-only gate never gets a say on them. Only `PI031` (`DAN-mode-switch`) is
+  genuinely normalized-pass. The shipped gate is therefore **pass-independent**:
+  `normalize::span_edge_is_manufactured(text, start, end)`, called at all five scanner
+  passes against each pass's own haystack (the normalized pass via a new `original_span`
+  helper so the gated span and the quoted text can never disagree). Withheld artefacts are
+  filed to a new `manufactured_boundary` array on `ScanReport` — recorded, not discarded,
+  same principle as `suppressed`/`low_confidence`/`baselined` — but deliberately carries
+  **no promotion flag**, because a flag that restored a known artefact would re-enable the
+  bug. Gate set is `-`/`_` only (a strict subset of the fold set, pinned by a test); `.`/`/`
+  excluded because they join paths/domains where a match edge before the separator is
+  routinely legitimate. Eleven patterns audited as exposed to the same short-token-`\b`
+  shape (acceptance criterion 4); full writeup in
+  `docs/adr/ADR-006-manufactured-boundary-gate.md`. GATE-02 pin unmoved
+  (`tests/recall_test.rs::EXPECTED` byte-identical to `27e4d49`); GATE-03 swept 23,037
+  real files before and after — manifest/summary byte-identical, `--compare` empty in both
+  directions (see `260915-u3j-SWEEP.md`). Issue #128's acceptance criterion 3 was corrected
+  in the issue itself: `ig-nore pre-vious in-structions` was never detected on `main`,
+  before or after this fix — intra-word hyphenation is a separate, still-open evasion.
+
+## Session Continuity
+
+Last session: 2026-10-09
+Stopped at: Completed 05-07-PLAN.md (Phase 5 close-out); #183 resolved in-phase (`will` dropped from `PI070`'s modal set) — ready for the single phase PR
+Resume file: None
+
+---
+*Last updated: 2026-10-09*
+
+## Performance Metrics
+
+| Plan | Duration | Tasks | Files |
+|------|----------|-------|-------|
+| Phase 04 P01 | ~15min (commit span) | 3 tasks | 44 files |
+| Phase 04 P05 | 69min | 3 tasks | 16 files |
+| Phase 04 P06 | 6h 40min (includes ~50min of judged predecessor draft) | 3 tasks | 9 files |
+| Phase 04 P07 | ~27min (commit span) | 3 tasks | 15 files |
+
+## Decisions
+
+- [Phase 04]: GATE-03 sweep excludes ~/.cursor/extensions and ~/.vscode/extensions (vendored bundle noise, direct cause of a reproduced src/frontmatter.rs:219 panic); their config-relevant subdirectories are swept instead
+- [Phase 04]: relaxed_pattern's PI050+ GATE-05 requirement is now an open-ended predicate (id >= 50), fixing a closed 50-59 range that would have exempted every CAT-02/PI060+ pattern
+- [Phase ?]: PI063's external-object set is closed and enumerated (filesystem path, environment variable, concealment framing), chained onto the subject with no gap the verb could be reached across -- keeps all four measured Q3 near-misses silent without special-casing any of them
+- [Phase ?]: GATE-03 comparisons target a fresh binary built from the branch's own fork point in a separate git worktree (never git stash) once main has moved multiple generations past the last committed baseline
+- [Phase 04]: PI066/PI067's heuristic discriminators require a tool-shaped object (backtick code span, snake_case identifier, or identifier+`()`) on both sides of the trigger grammar, not trigger words alone -- vocabulary-only heuristics on common English contrasts (never/always, when/if) produce real false positives at scale (26 hits across ~23,900 files before the fix)
+- [Phase 04]: PI068/PI069's rug-pull bound is stated in the pattern file's own header comment, not only in plan/state records -- a catalogue or README claiming these arms mitigate the rug-pull class would be a false security claim in the repo's own voice
+- [Phase 04]: `scripts/gate03-sweep.sh --compare` must be pointed at `.planning/local/<sweep-dir>/` (the gitignored raw JSON), never at this repository's own committed sweep directories -- the committed copies have zero `*.json` files by design (`dad56d1`/`e54be72`), so `--compare` silently loads an empty baseline and reports every real finding as a false addition
+- [Phase 04]: the Phase 3 planning directory (`.planning/phases/03-tool-permission-abuse-cat-01-33/`) and the CR-01 quick-task directory (`.planning/quick/260902-jhy-.../`), both lost to the rebase-merge that closed #33, are restored to `main` at 04-07's close-out from commits `752ac98`/`db2a575` on the still-live `feat/cat-01-tool-permission-abuse` branch -- future phase-closing rebase-merges must not repeat this loss
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-01-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-01-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-01-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-01-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-01-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-01-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-01-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-01-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-02-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-02-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-02-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-02-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-02-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-02-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-02-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-02-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-03-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-03-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-03-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-03-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-03-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-03-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-03-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-03-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-04-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-04-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-04-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-04-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-04-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-04-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-04-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-04-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-05-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-05-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-05-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-05-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-05-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-05-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-05-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-05-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-06-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-06-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-06-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-06-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-06-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-06-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-06-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-06-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-07-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-07-PLAN.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-07-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-07-PLAN.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-07-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-07-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-07-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-07-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-08-GAP-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-GAP-SUMMARY.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-08-GAP-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-GAP-SUMMARY.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-manifest.tsv
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-manifest.tsv
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-summary.tsv b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-summary.tsv
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-08-gate03-summary.tsv
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-CONTEXT.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-CONTEXT.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-CONTEXT.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-CONTEXT.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-DISCUSSION-LOG.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-DISCUSSION-LOG.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-DISCUSSION-LOG.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-DISCUSSION-LOG.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-PATTERNS.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-PATTERNS.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-PATTERNS.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-PATTERNS.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-RESEARCH.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-RESEARCH.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-RESEARCH.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-RESEARCH.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-REVIEW.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-REVIEW.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-REVIEW.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-REVIEW.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-SWEEP.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-SWEEP.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-SWEEP.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-SWEEP.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/03-VALIDATION.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-VALIDATION.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/03-VALIDATION.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/03-VALIDATION.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/deferred-items.md b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/deferred-items.md
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/deferred-items.md
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/deferred-items.md
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/manifest.tsv
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/manifest.tsv
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/summary.tsv
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/summary.tsv
diff --git a/.planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/third-party-new-findings.tsv b/.planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/third-party-new-findings.tsv
similarity index 100%
rename from .planning/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/third-party-new-findings.tsv
rename to .planning/archive/milestone-v0.2.0/phases/03-tool-permission-abuse-cat-01-33/sweep-2026-09-02/third-party-new-findings.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-01-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-02-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-03-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-04-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-05-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-06-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-PLAN.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-PLAN.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-SUMMARY.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-07-SUMMARY.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-CONTEXT.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-CONTEXT.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-CONTEXT.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-CONTEXT.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-PATTERNS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-PATTERNS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-PATTERNS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-PATTERNS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-RESEARCH.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-RESEARCH.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-RESEARCH.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-RESEARCH.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW-FIX.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW-FIX.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW-FIX.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW-FIX.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-REVIEW.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-SWEEP.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-SWEEP.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-SWEEP.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-SWEEP.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-VERIFICATION.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-VERIFICATION.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/04-VERIFICATION.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/04-VERIFICATION.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-04-2026-09-06/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-05-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-06-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-04-review-fixes-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-after-122-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/panic-cursor-extensions.txt b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/panic-cursor-extensions.txt
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/panic-cursor-extensions.txt
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/panic-cursor-extensions.txt
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-baseline-2026-09-03/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-final-2026-09-03/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-04-2026-09-06/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-04-05-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-mainbase-122-2026-09-07/summary.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/RAW-REPORTS.md
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/checksums.sha256
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/checksums.sha256
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/manifest.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/manifest.tsv
diff --git a/.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/summary.tsv
similarity index 100%
rename from .planning/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/sweep-r2-122-2026-09-07/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-01-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-02-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-03-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-04-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-05-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-06-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-PLAN.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-PLAN.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-PLAN.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-SUMMARY.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-07-SUMMARY.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-CONTEXT.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-CONTEXT.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-CONTEXT.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-CONTEXT.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-RESEARCH.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-RESEARCH.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-RESEARCH.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-RESEARCH.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-REVIEW.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-REVIEW.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-REVIEW.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-REVIEW.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-SWEEP.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-SWEEP.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/05-SWEEP.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/05-SWEEP.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/heldout-set.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/heldout-set.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/heldout-set.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/heldout-set.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-03-2026-10-08/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-04-2026-10-08/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-05-2026-10-08/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-after-05-06-2026-10-08/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-baseline-05-01-2026-10-08/summary.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/RAW-REPORTS.md b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/RAW-REPORTS.md
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/RAW-REPORTS.md
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/RAW-REPORTS.md
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/checksums.sha256 b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/checksums.sha256
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/checksums.sha256
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/checksums.sha256
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/manifest.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/manifest.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/manifest.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/manifest.tsv
diff --git a/.planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/summary.tsv b/.planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/summary.tsv
similarity index 100%
rename from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/summary.tsv
rename to .planning/archive/milestone-v0.2.0/phases/05-persistence-lifecycle-hijack-cat-03-35/sweep-final-05-2026-10-08/summary.tsv
diff --git a/.planning/phases/phase-1/PLAN.md b/.planning/archive/milestone-v0.2.0/phases/phase-1/PLAN.md
similarity index 100%
rename from .planning/phases/phase-1/PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/phase-1/PLAN.md
diff --git a/.planning/phases/phase-1/SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/phase-1/SUMMARY.md
similarity index 100%
rename from .planning/phases/phase-1/SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/phase-1/SUMMARY.md
diff --git a/.planning/phases/phase-2/PLAN.md b/.planning/archive/milestone-v0.2.0/phases/phase-2/PLAN.md
similarity index 100%
rename from .planning/phases/phase-2/PLAN.md
rename to .planning/archive/milestone-v0.2.0/phases/phase-2/PLAN.md
diff --git a/.planning/phases/phase-2/SUMMARY.md b/.planning/archive/milestone-v0.2.0/phases/phase-2/SUMMARY.md
similarity index 100%
rename from .planning/phases/phase-2/SUMMARY.md
rename to .planning/archive/milestone-v0.2.0/phases/phase-2/SUMMARY.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e5f7617..ada7f4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -261,7 +261,7 @@ three pattern categories, taking the library from the 48 patterns across 5 categ
   LANGUAGE only — they cannot and do not mitigate the rug-pull class itself, since a single
   static scan cannot prove a server will not silently republish a different, poisoned
   description once a gating condition is met. Both limitations are measured and recorded, not
-  discovered in review; see `.planning/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md`
+  discovered in review; see `.planning/archive/milestone-v0.2.0/phases/04-mcp-tool-description-poisoning-cat-02-34/deferred-items.md`
   for the full accounting, including two engine-capability gaps found during this work and filed
   as follow-up issues: a JSONC-commented `mcp.json` silently skips the structural pass with no
   diagnostic (#129), and the decoded-layer pass does not re-run structural (`scope: frontmatter`)
diff --git a/CLAUDE.md b/CLAUDE.md
index f130597..6ff726d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,16 +10,16 @@ Static scanner for prompt injection attacks in skill files, CLAUDE.md, RAG docum
 
 ## Status
 
-**v0.1.0 is the latest release** (2026-08-29). Earlier tags — v0.0.1, v0.0.2 (2026-06-24, 6
-target-triple binaries, consumed by `spec-ci-plugin`), v0.0.3 (2026-08-22) — are history, not the
-current shipped state.
+**v0.2.0 is the latest release** (2026-10-10, "Agent-shaped attacks"). Earlier tags — v0.0.1,
+v0.0.2 (2026-06-24, 6 target-triple binaries, consumed by `spec-ci-plugin`), v0.0.3 (2026-08-22),
+v0.1.0 (2026-08-29) — are history, not the current shipped state.
 
-**Current milestone: v0.2.0 — Agent-shaped attacks** (opened 2026-08-30). Phases 1-3 are complete —
-structural frontmatter engine (ENG-01, #32), recursive decoder (ENG-02, #30), tool & permission
-abuse (CAT-01, #33). Phase 4 — MCP & tool-description poisoning (CAT-02, #34) — is in flight. Live
-planning: `.planning/ROADMAP.md`, `.planning/REQUIREMENTS.md`, `.planning/STATE.md`. Backlog beyond
-this milestone: `docs/DETECTION-BACKLOG.md`. Checklist: `TODO.md`. The superseded milestone's
-artifacts moved to `.planning/archive/milestone-v0.1.0/`; its audit remains at `docs/AUDIT-2026-08.md`.
+**No active milestone — maintenance-only** (since 2026-10-23, by the scope freeze; the ecosystem
+focus is agent-memory). v0.2.0's planning is archived at `.planning/archive/milestone-v0.2.0/`;
+`.planning/ROADMAP.md` and `.planning/STATE.md` say what maintenance-only covers. `main` carries 84
+patterns / 9 categories after the post-release community PR #197. Close-out detection gaps sit on
+the unplanned GitHub milestone v0.3.0; backlog: `docs/DETECTION-BACKLOG.md`. Earlier milestones are
+under `.planning/archive/`; the 2026-08 audit remains at `docs/AUDIT-2026-08.md`.
 
 **CI is green** and is the merge gate every PR goes through. It runs on a GitHub-hosted runner by
 deliberate choice, not the org's self-hosted fleet — see `## CI / Self-Hosted Runners` below for the
@@ -28,7 +28,7 @@ binding policy before touching any workflow.
 > **Verify status before planning from it.** This block has drifted before — it once named a
 > release two versions stale as current and presented an archived milestone as live. The live
 > answer is `gh release list --repo UnityInFlow/injection-scanner` and `gh run list --branch main`,
-> and it beats this file whenever the two disagree. Last verified: 2026-09-23.
+> and it beats this file whenever the two disagree. Last verified: 2026-10-23.
 
 ## Reference Documents
 
@@ -68,8 +68,9 @@ Read these before making architectural or scope decisions.
 
 > **These are the ORIGINAL v0.0.1 criteria, retained for history.** Three of them — SARIF output,
 > `install-hook`, and the <200ms budget — were never delivered, while `.planning/REQUIREMENTS.md`
-> assigned them to Phase 2. That contradiction is resolved in `.planning/REQUIREMENTS.md`; the live
-> requirement set for the current milestone lives there, not here.
+> assigned them to Phase 2. That contradiction was resolved in the v0.1.0 milestone's requirements,
+> archived at `.planning/archive/milestone-v0.1.0/REQUIREMENTS.md`; requirements live per milestone
+> under `.planning/archive/`, not here.
 
 ### v0.0.1 (historical)