diff --git a/docs/PLAN.md b/docs/PLAN.md
index 1ae42d7..9398bad 100644
--- a/docs/PLAN.md
+++ b/docs/PLAN.md
@@ -173,9 +173,10 @@ approval prompt. Hence:
   same host), with that skill's fake-success detection, returning provenance
   `snapshot` + timestamp. Every hop still goes through the SSRF guard. This moves the
   ladder's `curl` calls out of agent shells.
-- **User-Agent policy — Kyle to decide**: (a) honest `sift/<ver>` UA only, bot-walled sites
-  go to recover/browser; or (b) one retry with a browser UA. (b) removes more prompts but is
-  UA spoofing.
+- **User-Agent policy — decided (Kyle, 2026-09-22)**: default UA is `sift/<ver>`. A config
+  setting (`user_agent`) overrides it for the whole service; no per-request UA and no
+  automatic browser-UA retry. Revisit only if bot walls turn out to be common — measure it:
+  count `upstream 403/429 (likely bot-blocked)` results per host in `/metrics`.
 
 Phase placement: CLI `fetch --mode clean` + skill in **P1**; digest/context flags in P2;
 `search` in P3; `--recover` in P2 (it is what removes the titan-style prompts).