diff --git a/docs/quiz-revamp-progress.md b/docs/quiz-revamp-progress.md
index 18360e0..4c520f2 100644
--- a/docs/quiz-revamp-progress.md
+++ b/docs/quiz-revamp-progress.md
@@ -49,7 +49,7 @@ Attempt mode is persisted server-side: a query flag cannot reveal active exam an
 
 Combined verification after review fixes and login removal: **25 backend tests passed in the deployed image; 53 frontend tests and production build passed.** Actual PostgreSQL mode/lab upgrade, repeated upgrade, downgrade and re-upgrade passed; existing scores were preserved and the real lab ORM defaults/publication/FK were checked.
 
-Independent review identified a failed-resume overwrite path, nullable review-setting serialization, and missing Alembic lab-model registration. Fixes add retry-only resume recovery, re-read saved progress for reused attempts, explicit cache failure responses, autosave warnings, blocked navigation when suspension cannot save, nullable/fail-closed course review handling, and model registration verified in a fresh process. New tests cover each case. Follow-up independent review is pending.
+Independent review identified a failed-resume overwrite path, nullable review-setting serialization, and missing Alembic lab-model registration. Fixes add retry-only resume recovery, re-read saved progress for reused attempts, explicit cache failure responses, autosave warnings, blocked navigation when suspension cannot save, nullable/fail-closed course review handling, and model registration verified in a fresh process. New tests cover each case. Follow-up independent review resolved all three findings and found no blocker in their affected paths; see [milestone-2-review.md](quiz-revamp/milestone-2-review.md). Milestone 2 is integrated at source level. Nothing has been deployed; linked articles/cards, AI authoring, discussions, and the existing related-content privacy release gate remain.
 
 Browser checks used a loopback-only fixture with synthetic accounts/questions and in-memory data, not production authentication. Desktop layout, provisional/confirmed answers, live fixture response counts, calculator arithmetic, honest empty lab references, and review confirmation were checked. At 390×844 the document width was exactly 390 and no question, option, image or toolbar overflowed; a taller narrow frame captures the full page. A browser-profile reset interrupted the check; re-login restored the saved attempt successfully.
 
diff --git a/docs/quiz-revamp/milestone-2-review.md b/docs/quiz-revamp/milestone-2-review.md
new file mode 100644
index 0000000..b7794db
--- /dev/null
+++ b/docs/quiz-revamp/milestone-2-review.md
@@ -0,0 +1,11 @@
+## Review
+
+- **Correct — Finding 1 (P1): Resolved.** Failed initial progress/detail retrieval now shows **Retry resume**, not Start (`frontend/src/pages/QuizPage.jsx:647–665,881`). Resume installs answers only after detail succeeds (`:591–615`). Start rechecks progress before initializing an empty answer map; lookup/resume failures exit before that write (`:672–714`). Autosave requires both attempt and mode (`:732–746`), preventing premature saves during recovery. Redis failures return 503 rather than empty progress or false success (`backend/app/routers/attempts.py:283–285,377–379`). Failed suspension retains the player and answers instead of navigating (`frontend/src/pages/QuizPage.jsx:1000–1024`). Behavioral coverage verifies failed-detail recovery, failed lookup, reused attempts, and suspension retry (`frontend/src/pages/QuizPage.test.jsx:58–106,120–136`; `backend/tests/test_study_tools.py:99–114`).
+
+- **Correct — Finding 2 (P2): Resolved.** `allow_review` now accepts NULL (`backend/app/schemas/quiz.py:63`), matching the ORM and existing DDL. Course startup treats anything other than `1` as review-disabled (`frontend/src/pages/QuizPage.jsx:285`); backend mode selection remains fail-closed (`backend/app/routers/attempts.py:49–51`). Review authorization is unchanged (`backend/app/utils/quiz_access.py:47–51`). Tests cover NULL listing/detail serialization, exam-only course startup, hidden answers, and denied study override (`backend/tests/test_study_tools.py:80–97`; `frontend/src/pages/QuizPage.test.jsx:108–118`).
+
+- **Correct — Finding 3 (P2): Resolved.** Importing `app.models` now registers `LabReference` (`backend/app/models/__init__.py:11`), so Alembic’s existing package import populates its target metadata (`backend/alembic/env.py:24–27`). The fresh-process regression checks registration without router-import contamination (`backend/tests/test_study_tools_migration.py:18–22`).
+
+- **Blocker:** None identified in the three fixes or their directly affected paths.
+
+- **Note:** Review was read-only. Test/build and PostgreSQL successes are parent-attested, not independently rerun. Existing tutor/private-image authorization issues remain a separate before-release task. This review makes no completion claim for later articles/cards/comments work.
\ No newline at end of file