diff --git a/config.lua b/config.lua
index aea7aa9..c2ba6e4 100644
--- a/config.lua
+++ b/config.lua
@@ -6,6 +6,16 @@
 -- model-aware routing server-side (local models on boltzmann; cloud routes
 -- through OpenRouter using its own bearer auth — no client-side key here).
 -- Discovery: GET http://hossenfelder.fritz.box:8082/v1/models.
+--
+-- Phase 9 (docs/PHASE9.md): a `.aish.lua` in/above your cwd (walking up
+-- to $HOME) overlays this user config. First encounter prompts to trust;
+-- sha256-pinned in ~/.aish/trusted-projects. Use it for repo-specific
+-- model presets, permissions, hooks, etc.
+--
+-- IMPORTANT: shallow merge. If your `.aish.lua` sets a top-level block
+-- (models, permissions, cost, shell, ...), it REPLACES the user's
+-- entire block — list every entry you want available OR omit the block
+-- to keep the user's. Inspect the merge via `:config show` at runtime.
 
 local HOSSENFELDER = "http://hossenfelder.fritz.box:8082"
 
diff --git a/docs/PHASE9.md b/docs/PHASE9.md
index e7d3981..4c98c30 100644
--- a/docs/PHASE9.md
+++ b/docs/PHASE9.md
@@ -2,7 +2,7 @@
 
 **Project:** aish — AI-augmented conversational shell
 **Document:** Phase 9 Requirements, Architecture & Design Decisions
-**Status:** Plan + review fold-in (tree at `31e5de5`)
+**Status:** Implement (4 commits landed: e525063, 34b465d, 5b6ee55, this)
 **Date:** 2026-05-16
 
 **Review findings (Sonnet, 2026-05-16) — 0 BLOCKERs, 7 CONCERNs