diff --git a/docs/milestones/M04/M04_plan.md b/docs/milestones/M04/M04_plan.md
new file mode 100644
index 000000000..e45b12bfb
--- /dev/null
+++ b/docs/milestones/M04/M04_plan.md
@@ -0,0 +1,55 @@
+# M04 Plan — Coverage / Security / Reproducibility Guardrails
+
+**Milestone:** M04  
+**Title:** Coverage / security / reproducibility guardrails  
+**Status:** Not started  
+**Depends on:** M03 (complete)
+
+---
+
+## 1. Intent / Target
+
+Harden Phase I guardrails before Phase II structural refactors:
+
+* Raise coverage gate toward 60%
+* Add pip-audit enforcement
+* Add dependency lock validation
+* Add deterministic build verification
+* Add CI artifact retention
+
+---
+
+## 2. Scope (Provisional)
+
+### In scope
+
+* Coverage gate: raise from 33% toward 60% (incremental)
+* pip-audit: make blocking (currently `|| true`)
+* Dependency lock validation
+* Deterministic build verification
+* CI artifact retention policy
+
+### Out of scope
+
+* Runtime behavior changes
+* New test logic (beyond coverage improvement)
+* Phase II refactors
+
+---
+
+## 3. Definition of Done
+
+* [ ] Coverage gate raised (per phase map)
+* [ ] pip-audit blocking
+* [ ] Lock validation in place
+* [ ] Build verification documented
+* [ ] Artifact retention configured
+* [ ] Ledger updated
+* [ ] M04 audit and summary
+
+---
+
+## 4. References
+
+* Phase map: docs/serena.md
+* M03 handoff: docs/milestones/M03/M03_summary.md
diff --git a/docs/milestones/M04/M04_toolcalls.md b/docs/milestones/M04/M04_toolcalls.md
new file mode 100644
index 000000000..240dcaa93
--- /dev/null
+++ b/docs/milestones/M04/M04_toolcalls.md
@@ -0,0 +1,9 @@
+# M04 Tool Calls
+
+Milestone: M04  
+Branch: (to be created)
+
+This file records Cursor tool calls performed during the milestone.
+
+| Timestamp | Tool | Purpose | Files/Target | Status |
+|-----------|------|---------|--------------|--------|
diff --git a/docs/serena.md b/docs/serena.md
index 4bd029f37..f2d11aac2 100644
--- a/docs/serena.md
+++ b/docs/serena.md
@@ -132,7 +132,7 @@ Core principles:
 | M00 | Program kickoff, baseline freeze, phase map, E2E verification | Completed | m00-kickoff-baseline-e2e | — | cdfe1285 | Linter 22794525690 ✓; Tests 22794525698 ✗ (pre-existing CLIP/pkg_resources) | Baseline 2.4/5 | 2025-03-07 |
 | M01 | CI truthfulness, SHA pinning, smoke path | Completed | m01-ci-truthfulness | — | 2f664049 | Linter 22814396752 ✓; Tests 22814850488 (server ✓, 17 pass, img2img/txt2img 500) | 4.7 / 5 | 2026-03-08 |
 | M02 | API CI truthfulness, local dev guardrails | Completed | m02-api-ci-truthfulness | — | 7484170d | Linter 22831756517 ✓; Tests 22831756504 ✓ (33/33 pass) | 4.9 / 5 | 2026-03-08 |
-| M03 | Test architecture (smoke / quality / nightly) | Completed | m03-test-architecture | #2 | 4ce5cde9 | Linter ✓; Smoke 22834384359 ✓ (33/33) | 5.0 / 5 | 2026-03-09 |
+| M03 | Test architecture (smoke / quality / nightly) | Completed | m03-test-architecture | #2 | 975dda4b | Linter ✓; Smoke 22834384359 ✓; Quality 22834861040 ✓ | 5.0 / 5 | 2026-03-09 |
 
 ---