diff --git a/docs/PHASE0.md b/docs/PHASE0.md
index 863bc3c..5742c1f 100644
--- a/docs/PHASE0.md
+++ b/docs/PHASE0.md
@@ -183,7 +183,7 @@ Context = {
 }
 ```
 
-Token budget enforcement is approximate in Phase 0 (character count / 4). Accurate tokenization is a Phase 2 concern.
+Token budget enforcement is approximate in Phase 0 (character count / 4). Accurate tokenization is a Phase 3 concern.
 
 When `max_turns` is reached, the oldest two turns (one user + one assistant) are evicted silently. The user is notified with a status line: `[context] oldest 2 turns evicted`.
 
@@ -282,10 +282,11 @@ Config path resolution order:
 |---|---|
 | **0** | Blocking REPL, `io.popen` exec, single model, in-memory context, meta commands |
 | **1** | SSE streaming via libcurl FFI, PTY via `forkpty` FFI, session persistence (`sessions/*.jsonl`), readline custom bindings |
-| **2** | Chuck Norris autonomous mode, destructive op heuristic (static + model), HALT/confirm gate, planning loop |
-| **3** | `memory.jsonl` summarization, startup context injection from memory, `:history` management, pruning |
-| **4** | Multi-model routing by task type, cloud fallback, context summarization via fast model on eviction |
-| **5** | Tree-sitter syntax highlighting hooks, diff-aware code injection, project-level context (file tree summary) |
+| **2** | MCP client (`mcp.lua`): tool-calling via OpenAI-compatible `tools` field on `/v1/chat/completions`; MCP JSON-RPC 2.0 over HTTP/SSE transport (target: lmcp); tool-result turns in context; per-server config + runtime `:mcp` meta commands |
+| **3** | Chuck Norris autonomous mode, destructive op heuristic (static + model), HALT/confirm gate, planning loop (now able to use MCP tools as well as `CMD:` lines) |
+| **4** | `memory.jsonl` summarization, startup context injection from memory, `:history` management, pruning |
+| **5** | Multi-model routing by task type, cloud fallback, context summarization via fast model on eviction |
+| **6** | Tree-sitter syntax highlighting hooks, diff-aware code injection, project-level context (file tree summary) |
 
 ---
 
@@ -305,11 +306,14 @@ Security posture: aish trusts the local user. The destructive-op gate in Norris
 
 | # | Question | Impact | Target Phase |
 |---|---|---|---|
-| Q1 | Token counting: use model's `/tokenize` endpoint or keep char/4 heuristic? | Context eviction accuracy | Phase 2 |
-| Q2 | Norris mode: should the planner emit a numbered step list and track progress, or re-plan after each step? | Loop structure in safety.lua | Phase 2 |
-| Q3 | Summarization at session end: automatic on `:quit`, or explicit `:save`? | UX + history.lua API | Phase 3 |
+| Q1 | Token counting: use model's `/tokenize` endpoint or keep char/4 heuristic? | Context eviction accuracy | Phase 3 |
+| Q2 | Norris mode: should the planner emit a numbered step list and track progress, or re-plan after each step? | Loop structure in safety.lua | Phase 3 |
+| Q3 | Summarization at session end: automatic on `:quit`, or explicit `:save`? | UX + history.lua API | Phase 4 |
 | Q4 | Should `CMD:` extraction support multi-command blocks (here-doc style)? | executor.lua parser | Phase 1 |
-| Q5 | Cloud model routing: explicit `:model cloud` only, or automatic fallback on local timeout? | router.lua policy | Phase 4 |
+| Q5 | Cloud model routing: explicit `:model cloud` only, or automatic fallback on local timeout? | router.lua policy | Phase 5 |
+| Q6 | How do `CMD:` extraction (Phase 0) and MCP tool-calls (Phase 2) coexist — both, prefer tools, retire `CMD:`? | broker.lua + executor.lua + system prompt | Phase 2 |
+| Q7 | MCP server discovery: declared in `config.lua` only, runtime `:mcp connect <url>`, or both? | config.lua schema + repl.lua meta set | Phase 2 |
+| Q8 | Tool-call authorization gate: per-call confirm (like `confirm_cmd`), per-tool policy in config, or trust-list by server? | safety.lua + mcp.lua + Norris-mode interaction | Phase 2 (informs Phase 3) |
 
 ---