diff --git a/.next-version b/.next-version
index 6201b5f..f374f66 100644
--- a/.next-version
+++ b/.next-version
@@ -1 +1 @@
-0.8.8
+0.9.1
diff --git a/.release-metadata.json b/.release-metadata.json
index 9b70ddf..15d50be 100644
--- a/.release-metadata.json
+++ b/.release-metadata.json
@@ -1,13 +1,11 @@
 {
   "issues": [
-    157,
-    158,
-    159,
-    160,
-    161,
-    162,
-    163
+    167,
+    168,
+    169,
+    170,
+    172
   ],
   "schema_version": "ocr-toolkit.release-authorization/v1",
-  "version": "0.8.7"
+  "version": "0.9.0"
 }
diff --git a/.release-source-date-epoch b/.release-source-date-epoch
index 37077ca..835b432 100644
--- a/.release-source-date-epoch
+++ b/.release-source-date-epoch
@@ -1 +1 @@
-1788255290
+1788423271
diff --git a/.release-version b/.release-version
index 1e9b46b..ac39a10 100644
--- a/.release-version
+++ b/.release-version
@@ -1 +1 @@
-0.8.7
+0.9.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 395dbaa..7420259 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,34 @@
+## 0.9.0 - 2026-09-03
+
+### 🚀 Features
+
+- Add `OCR_GITLAB_TARGET_PROTECTION_MODE=unprotected` as an explicit limited review path for an actually unprotected GitLab target. The secure `required` default is unchanged; limited runs retain normal result and finding publication but are always comment-only, reject privileged context and external MCP before OCR, omit protected-policy inputs, and bind immutable source, target, and actual protection state in receipt v8. ([#168](https://github.com/xeonvs/open-code-review-toolkit/issues/168))
+
+### 🐛 Bug Fixes
+
+- Use one strict effective reviewed-source SHA across review execution, pre-execution status diagnostics, posting, and later actions. Detached merge-request pipelines now use a valid `CI_COMMIT_SHA` only when the merge-request source SHA is absent or all zero, while malformed, conflicting, stale, and mismatched identities still fail closed. ([#167](https://github.com/xeonvs/open-code-review-toolkit/issues/167))
+- Reconcile OCR 1.11.2's attempted built-in evidence tool counts with private action receipt v3 while retaining completed actions as the only source of successful evidence use and approval authority; failed or malformed calls cannot satisfy the mandatory summary. Local reviews remain receipt-less instead of emitting receipt v8 with a non-GitLab protection state, while every present invalid receipt still fails closed. ([#169](https://github.com/xeonvs/open-code-review-toolkit/issues/169))
+
+### 🛠 Maintenance
+
+- Qualify checksum-verified Open Code Review 1.11.2 as the adjacent compatibility baseline for toolkit 0.9.0.
+
+  Changed: built-in language routing admits `.mjs` and `.cjs` under JavaScript Rules and `.cxx` and `.hxx` under C++ Rules; `.svh` remains excluded. Hosted Linux and independent Darwin qualification use checksum-verified release artifacts.
+
+  Unchanged: result and manifest schemas, inherited completion cap `16384`, explicit positive completion-cap transport, default `medium` effort, effective max-tools, private reasoning/session data, receipt v8, DLP, telemetry ownership, and approval authority.
+
+  Deployment: OCR 1.11.2 is qualification evidence, not a runtime fallback; install the final recommended OCR 1.11.3 directly. ([#170](https://github.com/xeonvs/open-code-review-toolkit/issues/170))
+- Promote checksum-verified Open Code Review 1.11.3 as the sole accepted runtime for toolkit 0.9.0, prevent inherited raw-provider capture, and preserve valid findings and summaries when additive failed-tool diagnostics are absent, malformed, non-zero, or contradictory. Install OCR 1.11.3 directly and verify the platform checksum from the compatibility manifest. ([#172](https://github.com/xeonvs/open-code-review-toolkit/issues/172))
+
+### 📖 Documentation
+
+- Document protected and limited unprotected-target setup, capability and failure boundaries, two-merge-request and supported one-merge-request rollout, and the complete review/publication decision process. The new canonical Mermaid maps distinguish error, warning, success, decision, and auxiliary states and are linked from the root agent instructions, documentation index, and toolkit strategy. ([#168](https://github.com/xeonvs/open-code-review-toolkit/issues/168))
+
+### 🧩 Rules
+
+- Route `.mjs` and `.cjs` through OCR 1.11.2's built-in JavaScript Rules and `.cxx` and `.hxx` through its C++ Rules; `.svh` remains excluded. ([#170](https://github.com/xeonvs/open-code-review-toolkit/issues/170))
+
+
 ## 0.8.7 - 2026-09-01
 
 ### 🚀 Features
diff --git a/PLANS.md b/PLANS.md
index d22727d..116f44f 100644
--- a/PLANS.md
+++ b/PLANS.md
@@ -5,196 +5,3 @@ before handoff or commit. Completed stable plans are indexed in
 [the execution-history archive](docs/engineering/execution_history/README.md).
 
 ## Active Work
-
-### Release 0.9.0: unprotected-target integrity and OCR 1.11.2/1.11.3
-
-Status: active
-Owner: Codex
-Last Updated: 2026-09-03
-Release classification: `release-required`
-Target stable version: `0.9.0`
-Milestone: `v0.9.0`
-Authorization issues: `#167`, `#168`, `#169`, `#170`, `#172`
-Feature branch: `codex/v0.9.0-unprotected-target-integrity`
-
-#### Goal
-
-Deliver safe limited OCR reviews for explicitly permitted unprotected GitLab targets while
-preserving immutable identity, comment-only approval boundaries, valid receipt/action
-attribution, detached-pipeline diagnostics, and adjacent OCR 1.11.2/1.11.3 compatibility.
-
-#### Locked scope and decisions
-
-- The release snapshot contains every issue open at activation: #167-#170. Later issues are
-  not added automatically. The owner explicitly authorized the late addition of qualification
-  issue #172 after OCR 1.11.3 was published, so #172 is part of this release without widening
-  scope to any other later issue. Consumer repositories, B2B, `core/common`, and shared CI
-  templates are outside scope.
-- Resolve one effective reviewed source SHA across review, posting, and pre-execution status
-  validation. Accept only lowercase 40-hex values, prefer a valid non-zero MR SHA, and fall
-  back to `CI_COMMIT_SHA` only for an absent or all-zero MR SHA. All malformed, conflicting,
-  stale, and mismatched identities remain fail-closed.
-- Preserve receipt v6's strict positive evidence-action attribution. Move receipt construction,
-  hostile parsing, and validation behind one internal owner. Missing, malformed, unwritable,
-  or mismatched private action receipts fail before normal atomic publication and cannot publish
-  findings or authorize approval. Advisories are evaluated only after receipt validity.
-- Add `OCR_GITLAB_TARGET_PROTECTION_MODE=required|unprotected`. Unset means `required`; an
-  explicit empty or unknown value fails closed. A protected target keeps current behavior under
-  either setting. An actually unprotected target is limited to comment-only review with context
-  `off` or bounded untrusted `metadata`; enriched context, adapters, protected-policy acquisition,
-  and direct or inherited external MCP are rejected before OCR. Built-in immutable repository
-  evidence remains available. Target Rules may be bounded model guidance, but accepted decisions
-  and structured project guidance are omitted in the first implementation.
-- Advance the public toolkit receipt to v7 with immutable target SHA and closed actual protection
-  state. Unprotected receipts are structurally approval-ineligible and alone authorize the static
-  italic limitation line after the primary status line for every normal receipt-backed outcome.
-  Legacy receipts are not reinterpreted.
-- Documentation is a same-release deliverable: README quick start, configuration, GitLab setup,
-  operations/troubleshooting, security/trust model, and synthetic public GitLab examples cover the
-  complete integration and failure model, including two-MR and supported one-MR setup paths.
-- Qualify OCR 1.11.2, promote tested/recommended pins, and make the language-rule probe verify
-  `.mjs`/`.cjs` JavaScript and `.cxx`/`.hxx` C++ routing while `.svh` remains excluded. Viewer,
-  remote-MCP documentation, localization, and Go module-boundary changes have no toolkit runtime
-  impact.
-- Qualify OCR 1.11.3 against the branch-qualified 1.11.2 baseline without another semantic OCR
-  run. Map its raw-traffic capture, failed-tool telemetry, SIGTERM handling, untracked-file error
-  propagation, and editor-only dependency changes to consumed toolkit boundaries. Raw provider
-  traffic must never be captured by a toolkit-owned OCR child, while bounded credential-redacted
-  failure details remain console/CI-job diagnostics only. The additive failure envelope is not
-  authoritative for the review result: absent, malformed, or contradictory diagnostics must not
-  discard or suppress a valid manifest, findings, summary, or posting transaction. Provider-backed
-  receipts retain only a closed diagnostic state and verified aggregate failed count; the
-  toolkit-owned action receipt remains authoritative for completed evidence. Non-zero or uncertain
-  diagnostics may block later approval authority, but never publication of an otherwise valid review
-  signal. Promote 1.11.3 only after deterministic/no-provider compatibility and hostile end-to-end
-  publication boundary tests pass.
-
-#### Delivery sequence
-
-1. [x] Create milestone `v0.9.0`, assign #167-#170, create this feature branch, and record the
-   complete release plan as the first signed commit.
-2. [x] Push only the plan commit and open a Draft PR with all issue links and the delivery plan;
-   do not use closing keywords because the stable Release workflow owns issue closure.
-3. [x] Implement #167 as a focused signed identity/status commit with its synthetic regression
-   matrix.
-4. [x] Implement #169 as a focused signed receipt/action-integrity commit. Positive evidence
-   usage now requires exact private action attribution before atomic publication, zero-call
-   results receive verified zero counts, and the shared neutral receipt owner validates every
-   generated MR receipt before any advisory can be attached. Security regressions cover missing,
-   malformed, unwritable, incomplete, type-confused, and per-tool-mismatched attribution.
-5. [x] Implement #168 provider/config/snapshot, receipt v7, and approval boundary as one complete
-   runtime commit. The exact closed setting preserves protected behavior, while an actually
-   unprotected target rejects privileged context and external MCP, omits structured target policy,
-   binds source/target/protection in receipt v7, renders the validated limitation, and cannot reach
-   the approval executor. Hostile, orchestration, DLP-summary, and immutable-target regressions
-   cover these boundaries.
-6. [x] Implement #168 summary projection, complete public documentation, and synthetic examples
-   as one complete documentation contract commit. The secure default, constrained capability matrix,
-   two-MR and one-MR setup paths, static limitation, fail-closed diagnostics, and separate GitLab
-   merge-policy boundary are now explicit and contract-tested.
-7. [x] Implement #170 qualification, OCR 1.11.2 pins, Rules probes, and `maintenance` plus `rules`
-   Towncrier entries. Hosted Linux workflow `33508349494` establishes the baseline qualification;
-   the independently checksum-verified Darwin arm64 rerun matches every baseline contract and its
-   expanded probe selects ten qualified extensions, binds `.mjs`/`.cjs` to exact JavaScript Rules
-   and `.cxx`/`.hxx` to exact C++ Rules, and keeps `.svh` excluded. Security coverage across
-   #167-#169 exercises the effective
-   SHA matrix, strict evidence-action receipt reconciliation, atomic receipt identity, unprotected
-   context/MCP rejection, static limitation provenance, and the unreachable approval executor.
-8. [x] Review every commit and the complete `origin/main..HEAD` range, run all deterministic local
-   gates, and fix supported findings in separately reviewed signed commits. The holistic source,
-   test, and documentation review found no runtime defect; it reconciled the current receipt-v7,
-   source/target identity, action-integrity, and constrained-target evidence/status contracts.
-   The complete suite passed with 1,438 tests and 397 subtests at 86.37% coverage; every scoped
-   risk floor passed. Compatibility, Towncrier draft, pinned Gitleaks, dependency audit, signatures,
-   diff checks, clean build/Twine, archive privacy, and separate wheel/sdist CLI smokes also passed.
-9. [x] Run exactly one Codex Security diff scan for `origin/main..HEAD`, validate attack paths, fix
-   supported findings, and repeat holistic review plus deterministic validation. Scan
-   `cecd81ce-bc01-42eb-bedf-a4a2a44a096c` completed with full changed-range coverage and no
-   reportable findings. Its two rejected candidates still identified useful fail-closed contract
-   hardening: surrounding whitespace must not normalize an inherited SHA, and summary/approval
-   identities must come only from a fully valid receipt. Both controls and hostile regressions are
-   included in the remediation commit. The post-remediation holistic review found no remaining
-   defect, and the repeated deterministic gates passed with 1,438 tests, 406 subtests, 86.35%
-   coverage, all scoped risk floors, compatibility, Towncrier, Gitleaks, dependency audit,
-   signatures, diff checks, clean build/Twine, archive privacy, and wheel/sdist CLI smokes green.
-10. [x] The checksum-verified PATH-effective OCR 1.11.2 installation and its rollback copy are
-    complete. The one permitted configured-provider review ran over exact range
-    `b9a0e54af7f39a1db21e2a8f4780761e74782bf8..cb9f4d9f39305e4cfdae5d4c91be7138edd0c4e3`
-    with context `off`, public Rules, and concurrency 2, then failed closed before publication because
-    OCR counts a dynamic MCP tool attempt before argument parsing/execution while private action
-    receipt v2 counted only completed calls. No publishable result or complete manifest survived, no
-    posting occurred. The owner subsequently authorized one repeat diagnostic OCR run with all raw
-    private artifacts retained; it must run only after the root fix and relevant deterministic gates.
-    The deterministic root remediation is complete with count-only action receipt v3: it authenticates
-    MCP-received attempts and completed counts separately, retains a closed unattributed-attempt
-    counter for malformed primary-tool actions and OCR-counted requests that fail argument parsing
-    before MCP dispatch, reconciles received counts as subsets of OCR's authoritative by-tool
-    attempts, requires a completed `summary` for mandatory evidence, and exposes only completed
-    actions as successful evidence use.
-    Hostile, malformed, failed-call, concurrency, receipt-readback, formatting, approval, and publication
-    regressions restore the complete #167-#169 chain and adversarially cover parser, persistence,
-    reconciliation, receipt, approval, and publication transitions. A completion is recorded only when
-    that same request durably recorded its attempt, so it cannot consume an unmatched attempt retained
-    from an earlier failed call. Normal posting now rejects every present incomplete or invalid receipt
-    before reading prior review state or publishing findings; only a genuinely absent receipt keeps the
-    compatible direct path. The complete deterministic suite passed with 1,468 tests and 407 subtests at
-    86.31% coverage; compatibility, Towncrier, Gitleaks, dependency audit, signatures, diff checks,
-    deterministic double build, Twine, archive privacy, and clean wheel/sdist CLI smokes are green. The
-    owner-authorized retained-artifact OCR repeat then completed the exact
-    `b9a0e54af7f39a1db21e2a8f4780761e74782bf8..782b205b8f8a2a5a2491c4f25b2b444a5e40c16b`
-    range with all 20 selected items completed, no failed/reused/waived items, 144 total tool calls,
-    and six exactly reconciled attempted/completed evidence summaries. No posting occurred and every
-    raw private artifact remains retained. Its two supported findings are corrected in the current
-    reviewed slice: generated OCR 1.11.1 language evidence and validation now share one canonical
-    sorted extension projection, and local reviews no longer serialize receipt v7 with a non-GitLab
-    `local` protection value. Local finalization still enforces result, action, and DLP contracts but
-    remains receipt-less and approval-ineligible; any present invalid receipt still fails closed. The
-    focused remediation and documentation matrix passes 253 tests, compatibility validation, Towncrier,
-    Ruff format/check, and diff checks. Owner-only offline finalization of an exact copied result and
-    action receipt confirmed the retained manifest range, terminal 20/20 coverage, six attempted and
-    six completed evidence summaries, zero unattributed actions, the retained private DLP projection,
-    a passed publication projection, and corrected receipt-less, approval-ineligible local output. The
-    finalizer made no network or posting attempt, and recursive before/after hashes confirmed all 15
-    files in the retained OCR directory remained byte-identical. No additional semantic OCR ran.
-11. [x] Implement #172 as a separately reviewed signed slice. Hosted workflow `33725971286`,
-    checksum-pinned schema-v3 evidence, adjacent-source audit, and independent Darwin arm64 readback
-    qualify OCR 1.11.3 against the branch-qualified 1.11.2 predecessor without another semantic OCR
-    run. Toolkit-owned preview and review children now remove inherited `OCR_RAW_LOGGING`; the strict
-    additive diagnostic parser keeps bounded credential-redacted detail in the local/CI console only,
-    strips detail and per-tool failure maps before finalization, and records only a closed receipt-v8
-    state plus a verified aggregate. Absent, malformed, hostile, non-zero, and action-receipt-conflicting
-    diagnostics preserve valid local and provider-backed findings, summary, manifest, DLP projection,
-    and actual posting transaction; toolkit action receipt v3 remains authoritative for completed
-    evidence, while uncertain or non-zero diagnostics independently block later approval authority.
-    The new canonical `docs/review-decision-flow.md` supplies three contract-tested Mermaid maps with
-    stable error, warning, success, auxiliary, and decision colors; the root `AGENTS.md`, strategy,
-    documentation index, runtime owners, hostile tests, and all affected public contracts link to and
-    agree with it. The complete deterministic suite passes with 1,486 tests and 408 subtests at 86.38%
-    coverage and every scoped risk floor green. Compatibility, Towncrier draft, pinned Gitleaks,
-    dependency audit, frozen Ruff format, signatures, diff checks, deterministic double build, Twine,
-    archive privacy, and separate clean wheel/sdist CLI smokes also pass. No additional semantic OCR or
-    Codex Security scan ran.
-12. [ ] Push the locally closed implementation, finish hosted checks and review with zero unresolved
-    threads, mark the Draft PR ready, and exact-head squash merge. Delete the feature branch.
-13. [ ] Verify the protected-main TestPyPI development publication, create `release/v0.9.0`, set
-    stable/next versions to `0.9.0`/`0.9.1`, record deterministic source epoch and authorization
-    issues `[167,168,169,170,172]`, render Towncrier, archive this plan, and finish the protected
-    release PR.
-14. [ ] Monitor stable publication and independently verify registry/workflow/Release byte equality,
-    PEP 740 and GitHub attestations, annotated tag target, immutable five-asset Release, release
-    receipt, Python 3.12-3.14 wheel/sdist installs, Actions-owned issue receipts, issue/milestone
-    closure, branch cleanup, and clean `main == origin/main == v0.9.0^{}`.
-
-#### Per-commit and final validation
-
-Before every commit, update this plan and affected status documents to post-commit truth, run focused
-tests, apply the repository formatter for Python and require frozen Ruff format, inspect the entire
-staged diff for correctness, hostile inputs, DLP/privacy, and scope, then run `git diff --check`.
-
-Final deterministic gates are `scripts/quality.sh check`, compatibility validation, Towncrier draft,
-Gitleaks, build/Twine, archive/privacy checks, and clean wheel/sdist CLI smoke. OCR exit zero is not
-completion without complete selected-item coverage and exact receipt/action reconciliation. The one
-owner-authorized repeat semantic OCR run and its private intermediates remain retained; it is complete
-and no additional semantic run is authorized. The completed Codex Security scan must not be rerun.
-OCR 1.11.3 qualification is deterministic/no-provider only. Stable delivery remains incomplete until
-external publication and independent reconciliation are complete.
diff --git a/changelog.d/169.bugfix.md b/changelog.d/169.bugfix.md
deleted file mode 100644
index 55b5a3a..0000000
--- a/changelog.d/169.bugfix.md
+++ /dev/null
@@ -1 +0,0 @@
-Reconcile OCR 1.11.2's attempted built-in evidence tool counts with private action receipt v3 while retaining completed actions as the only source of successful evidence use and approval authority; failed or malformed calls cannot satisfy the mandatory summary. Local reviews remain receipt-less instead of emitting receipt v8 with a non-GitLab protection state, while every present invalid receipt still fails closed.
diff --git a/changelog.d/170.maintenance.md b/changelog.d/170.maintenance.md
deleted file mode 100644
index 9952d5e..0000000
--- a/changelog.d/170.maintenance.md
+++ /dev/null
@@ -1,7 +0,0 @@
-Target checksum-verified Open Code Review 1.11.2 as the sole accepted runtime for toolkit 0.9.0.
-
-Changed: built-in language routing admits `.mjs` and `.cjs` under JavaScript Rules and `.cxx` and `.hxx` under C++ Rules; `.svh` remains excluded. Hosted Linux and independent Darwin qualification use checksum-verified release artifacts.
-
-Unchanged: result and manifest schemas, inherited completion cap `16384`, explicit positive completion-cap transport, default `medium` effort, effective max-tools, private reasoning/session data, receipt v8, DLP, telemetry ownership, and approval authority.
-
-Deployment: install OCR 1.11.2 directly and verify the platform checksum from the compatibility manifest; OCR 1.11.1 is historical comparison evidence, not a runtime fallback.
diff --git a/changelog.d/170.rules.md b/changelog.d/170.rules.md
deleted file mode 100644
index f3bbac8..0000000
--- a/changelog.d/170.rules.md
+++ /dev/null
@@ -1 +0,0 @@
-Route `.mjs` and `.cjs` through OCR 1.11.2's built-in JavaScript Rules and `.cxx` and `.hxx` through its C++ Rules; `.svh` remains excluded.
diff --git a/changelog.d/172.maintenance.md b/changelog.d/172.maintenance.md
deleted file mode 100644
index f3a10c8..0000000
--- a/changelog.d/172.maintenance.md
+++ /dev/null
@@ -1 +0,0 @@
-Promote checksum-verified Open Code Review 1.11.3, prevent inherited raw-provider capture, and preserve valid findings and summaries when additive failed-tool diagnostics are absent, malformed, non-zero, or contradictory.
diff --git a/docs/configuration.md b/docs/configuration.md
index b803677..ec81643 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -97,7 +97,7 @@ These names belong to `examples/gitlab/ocr-review.gitlab-ci.yml`; they are shell
 | --- | --- | --- | --- | --- |
 | **`OCR_VERSION`** | Example pipeline | Yes | `v1.11.3` | Checksum-pinned recommended OCR binary release for toolkit 0.9.0. |
 | **`OCR_SHA256`** | Example pipeline | Yes | `9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb` | Expected Linux AMD64 OCR binary digest. |
-| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.8.7` | Exact toolkit wheel release installed by the current published example. |
+| **`OCR_TOOLKIT_VERSION`** | Example pipeline | Yes | `0.9.0` | Exact toolkit wheel release installed by the current published example. |
 | **`OCR_TOOLKIT_CHECKSUMS_URL`** | Example pipeline | Yes | Release URL derived from `OCR_TOOLKIT_VERSION` | Toolkit `SHA256SUMS` URL. |
 | `OCR_TOOLKIT_WHEEL` | Example shell | Computed | `open_code_review_toolkit-${OCR_TOOLKIT_VERSION}-py3-none-any.whl` | Exact wheel filename selected from the release. |
 | `OCR_TOOLKIT_WHEEL_SHA256` | Example shell | Computed | Matching value from `SHA256SUMS` | Digest checked before installing the toolkit wheel. |
diff --git a/docs/engineering/execution_history/README.md b/docs/engineering/execution_history/README.md
index 3a0edbc..066336a 100644
--- a/docs/engineering/execution_history/README.md
+++ b/docs/engineering/execution_history/README.md
@@ -6,6 +6,7 @@
 
 | Stable tag | Primary archived plan | Related context in the same archive |
 | --- | --- | --- |
+| `v0.9.0` | [Unprotected-target integrity and OCR 1.11.2/1.11.3](releases.md#plan-toolkit-0-9-0) | Canonical reviewed-source identity, constrained unprotected-target reviews, action receipt v3 and receipt v8, additive diagnostic containment, OCR 1.11.2/1.11.3 qualification, complete Mermaid decision maps, retained semantic OCR remediation, Codex Security review, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.7` | [OCR 1.11.1, evidence integrity, and efficient built-in MCP](releases.md#plan-toolkit-0-8-7) | Evidence comparison integrity, bounded search and exact coverage tools, protected same-revision CI outcomes, OCR 1.11.1 qualification, three complete local reviews, controlled five-action MCP qualification, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.6` | [OCR 1.11.0 and precise security signals](releases.md#plan-toolkit-0-8-6) | Contextual injection classification, provider-private OCR-state containment, OCR 1.11.0 qualification and Rules, one complete local semantic review with remediation, feature merge, development artifact verification, and stable-delivery handoff. |
 | `v0.8.5` | [Provider diagnostics and OCR 1.10.2](releases.md#plan-toolkit-0-8-5) | Closed numeric provider diagnostics, unchanged GitLab/DLP/receipt/approval projections, OCR 1.10.2 qualification and Rules, compatibility scheduling, explicit local OCR provider-failure waiver, feature merge, development artifact verification, and stable-delivery handoff. |
diff --git a/docs/engineering/execution_history/releases.md b/docs/engineering/execution_history/releases.md
index b6ca3c2..7085b97 100644
--- a/docs/engineering/execution_history/releases.md
+++ b/docs/engineering/execution_history/releases.md
@@ -2,6 +2,90 @@
 
 This archive preserves completed execution plans moved out of the active registry; the release index associates each plan with the stable tag or release cycle it supported. `PLANS.md` remains the source for active or blocked repository work; historical receipts here remain part of the audit trail.
 
+<a id="plan-toolkit-0-9-0"></a>
+
+## Toolkit 0.9.0 — unprotected-target integrity and OCR 1.11.2/1.11.3
+
+Status: repository complete; external stable delivery pending
+Release classification: `release-required`
+Target stable version: `0.9.0`
+Repository completion date: 2026-09-03
+
+### Goal and delivered scope
+
+Toolkit 0.9.0 delivers the complete authorized scope of issues #167, #168, #169,
+#170, and #172. One strict effective reviewed-source SHA now binds review,
+pre-execution diagnostics, posting, and later actions, including the detached
+GitLab pipeline fallback. Explicitly permitted unprotected targets gain a
+separately constrained review path: normal findings and summaries remain
+publishable, but the run is always comment-only and cannot acquire protected
+policy, enriched context, adapters, accepted decisions, structured target
+guidance, or external MCP authority.
+
+Private action receipt v3 authenticates attempted and completed fixed evidence
+actions separately. Receipt v8 binds immutable source, target, and actual
+target-protection state and retains only a closed aggregate failed-tool state.
+Valid findings, summaries, manifests, and posting transactions survive absent,
+malformed, hostile, non-zero, or contradictory additive OCR diagnostics.
+Bounded credential-redacted failure details are console-only, and toolkit-owned
+OCR children remove inherited `OCR_RAW_LOGGING`.
+
+The release qualifies OCR 1.11.2 as adjacent compatibility evidence and promotes
+checksum-verified OCR 1.11.3 as the sole accepted and recommended runtime. The
+effective Rules contract adds `.mjs`/`.cjs` JavaScript and `.cxx`/`.hxx` C++
+routing while `.svh` remains excluded. The canonical
+`docs/review-decision-flow.md` supplies three contract-tested Mermaid maps and
+is linked from the root `AGENTS.md`, documentation index, and toolkit strategy.
+
+### Review, OCR, security, and test evidence
+
+- The completed local quality matrix passed 1,486 tests plus 408 subtests at
+  86.38% branch coverage; every scoped coverage floor passed. Compatibility,
+  Towncrier draft, frozen Ruff formatting, Gitleaks, dependency audit, signature
+  checks, deterministic double build, Twine, archive privacy, and separate clean
+  wheel/sdist CLI smokes also passed.
+- Codex Security diff scan `cecd81ce-bc01-42eb-bedf-a4a2a44a096c` covered the
+  complete changed range and reported zero reportable findings. It was not rerun.
+- The owner-authorized retained-artifact semantic OCR repeat completed all 20
+  selected items with zero failed, reused, or waived items and exactly reconciled
+  six attempted/completed evidence summaries. Its two supported findings were
+  corrected; offline finalization then proved valid receipt-less local output and
+  byte-identical retained diagnostics. No additional semantic OCR ran.
+- OCR 1.11.3 qualification used hosted run 33725971286, checksum-pinned evidence
+  SHA-256 `6ad0e1f607b2ddcbb9e7b25e4432d6102ec22d7ef6847c2858c8fb22d38cc0f2`,
+  independent Darwin arm64 readback, adjacent-source review, and deterministic
+  hostile boundary tests. It did not run another configured-provider review.
+
+### Repository and development-publication evidence
+
+- Feature PR #171 passed the complete hosted check set at reviewed head
+  `3441e8a77d71b026db89a896d6374f6cb0a09b99` and was exact-tree squash-merged
+  as `3c7e38c08a48c9af1d0b0c5e10ecf0ac8b5eacc3`.
+- Development workflow run 33732297187 published and independently verified
+  `0.8.8.dev83`. The TestPyPI wheel SHA-256 is
+  `706dfce3991a00b9e93aa65f19bb30baa6b323eab57d8c449d170310a63bbfaf`;
+  the sdist SHA-256 is
+  `b22e1fa5eacade47a130e21474442034aee28c93b5f6880a652981efb353de99`.
+  Workflow and registry bytes, PEP 740 provenance, hosted verifier installs, and
+  CLI smokes agree.
+
+### Stable delivery handoff
+
+The release PR is the final repository mutation. It sets
+`.release-version=0.9.0`, `.next-version=0.9.1`, deterministic source epoch
+`1788423271`, exact sorted issues `[167,168,169,170,172]`, generated Towncrier
+notes, the stable example pin, and this archive while returning `PLANS.md` to its
+inactive template.
+
+External closure remains pending until the exact reviewed release head is
+squash-merged and the protected workflow is independently reconciled across
+TestPyPI, PyPI, workflow artifacts, and the immutable GitHub Release. Closure
+requires byte equality, PEP 740 provenance and GitHub attestations, annotated
+`v0.9.0` tag and peeled target, immutable five-asset Release, validated
+`release-receipt.json`, clean wheel and sdist installs on Python 3.12–3.14,
+Actions-owned receipts, closed #167/#168/#169/#170/#172 and milestone `v0.9.0`,
+deleted release branch, and clean `main == origin/main == v0.9.0^{}`.
+
 <a id="plan-toolkit-0-8-7"></a>
 
 ## Toolkit 0.8.7 — OCR 1.11.1, evidence integrity, and efficient built-in MCP
diff --git a/examples/gitlab/ocr-review.gitlab-ci.yml b/examples/gitlab/ocr-review.gitlab-ci.yml
index d61f3ca..a2e0f37 100644
--- a/examples/gitlab/ocr-review.gitlab-ci.yml
+++ b/examples/gitlab/ocr-review.gitlab-ci.yml
@@ -7,7 +7,7 @@ default:
 
 variables:
   OCR_VERSION: "v1.11.3"
-  OCR_TOOLKIT_VERSION: "0.8.7"
+  OCR_TOOLKIT_VERSION: "0.9.0"
   OCR_TOOLKIT_CHECKSUMS_URL: "https://github.com/xeonvs/open-code-review-toolkit/releases/download/v${OCR_TOOLKIT_VERSION}/SHA256SUMS"
   OCR_SHA256: "9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb"
   OCR_POST_MODE: "draft"
diff --git a/tests/test_release_notes.py b/tests/test_release_notes.py
index 11fbc55..16eada6 100644
--- a/tests/test_release_notes.py
+++ b/tests/test_release_notes.py
@@ -274,6 +274,33 @@ def test_087_release_notes_cover_evidence_integrity_and_mcp_routing() -> None:
         assert phrase in notes
 
 
+def test_090_release_notes_cover_limited_targets_and_ocr_diagnostic_boundaries() -> None:
+    """Keep the trust, publication, and direct OCR migration boundaries explicit."""
+
+    changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+    notes = release.release_notes(changelog, "0.9.0")
+
+    for phrase in (
+        "OCR_GITLAB_TARGET_PROTECTION_MODE=unprotected",
+        "always comment-only",
+        "reject privileged context and external MCP before OCR",
+        "effective reviewed-source SHA",
+        "action receipt v3",
+        "receipt v8",
+        "Local reviews remain receipt-less",
+        "adjacent compatibility baseline",
+        "not a runtime fallback",
+        "sole accepted runtime for toolkit 0.9.0",
+        "Install OCR 1.11.3 directly",
+        "additive failed-tool diagnostics",
+        "canonical Mermaid maps",
+        ".mjs",
+        ".cxx",
+        ".svh",
+    ):
+        assert phrase in notes
+
+
 def test_extracts_only_the_exact_release_section() -> None:
     changelog = "# Changelog\n\n## 0.2.0 - later\n\nnew\n\n## 0.1.0 - now\n\nfirst\n"