diff --git a/PLAN.md b/PLAN.md
index 41499fe7db8d95f187f401f0a390d16971b9a8da..379060b91848564d263cedbad3c0f3ea4b7f0141 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -235,9 +235,10 @@
 
 ## Milestones
 
-Current status: C0 and C1 are implemented in the MOUSE image. The C1 proof
-service also exercises the C2 `supervise-daemon` and runtime-control path; C2
-remains open until its failure cases are covered as a distinct milestone.
+Current status: C0 through C2 are implemented in the MOUSE image. The C2 proof
+service covers restart exhaustion, failed-state reporting, administrative
+recovery, forced termination, runtime-only control, and shutdown. C3 remains
+open.
 
 ### C0: executable skeleton
 
diff --git a/README.md b/README.md
index 7ce4d1903764fd15553de84ebe79a7480c2e35f3..2e2af675be38803214b6c4f937eb3cb7d05c011f 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,11 @@
 # cheesed
 
-`cheesed` is MOUSE's PID 1 and boot coordinator. Milestones C0 and C1 from
+`cheesed` is MOUSE's PID 1 and boot coordinator. Milestones C0 through C2 from
 [`PLAN.md`](PLAN.md) are implemented: the static Linux init performs early
 bootstrap, strictly translates `/etc/rc.conf` into disposable OpenRC
 runlevels, runs the boot graph, reaps children during transitions and steady
-state, provides a recovery `tcsh`, and coordinates OpenRC shutdown before
-reboot or poweroff.
+state, delegates restart and stop policy to `supervise-daemon`, provides a
+recovery `tcsh`, and coordinates OpenRC shutdown before reboot or poweroff.
 
 ## Development checks