diff --git a/docs/plans/2026-03-18-refactor-progress.md b/docs/plans/2026-03-18-refactor-progress.md
index 0e45f5e..b105fb8 100644
--- a/docs/plans/2026-03-18-refactor-progress.md
+++ b/docs/plans/2026-03-18-refactor-progress.md
@@ -51,48 +51,72 @@ Extracted sniff infrastructure from `core/hf_iso15.py` (615→130 lines) into tw
 
 **65/65 tests passing** (35 sniff/trace tests work through re-exports, no test changes needed).
 
-## Phase 3 — Scaffold `transponders/`
+## Phase 3 — Transponder models in `transponders/`
 
-**Status: Complete (scaffolded)**
+**Status: Complete**
 
-Created full directory tree per design:
-- `transponders/hf/iso14443a3/nxp/` — MIFARE Classic, Ultralight, NTAG
-- `transponders/hf/iso14443a4/nxp/` — DESFire
-- `transponders/hf/iso15693/nxp/` — ICODE SLIX2, NTAG 5
-- `transponders/hf/iso15693/st/` — ST25TV
-- `transponders/lf/atmel/` — T55xx
-- `transponders/lf/em/` — EM4100, EM4x05
+Moved 23 IC-specific files from `sim/` into `transponders/` organized by standard/manufacturer:
 
-All directories have `__init__.py`. Model migration from sim worktree is a separate effort — the sim framework has ~7.8k LOC with deep inheritance chains (`Transponder` → `Tag15693` → `NxpIcodeTag` → `IcodeSlix2Tag`, etc.) and auth mixins (`NxpPasswordAuth`, `NxpAesAuth`). Base class extraction needs to happen alongside model migration.
+```
+transponders/
+  hf/
+    iso14443a/
+      base.py              # Tag14443A, Tag14443A_3/4, Reader14443A
+      ndef.py              # NfcType2Tag, NfcType4Tag
+      nxp/
+        crypto1.py         # Crypto1
+        mifare_classic.py  # MifareClassicTag, MifareClassicReader
+        desfire.py         # DesfireTag, DesfireReader
+    iso15693/
+      base.py              # Tag15693, Reader15693
+      type5.py             # NfcType5Tag, ndef_text/uri/mime
+      nxp/
+        auth_password.py   # NxpPasswordAuth
+        auth_aes.py        # NxpAesAuth
+        nxp_icode.py → icode_slix → icode_slix2 → icode3, icode_dna
+        ntag5_platform → ntag5_switch, ntag5_link → ntag5_boost
+      st/                  # future ST25TV
+  lf/
+    base.py                # TagLF, ReaderLF, Modulation
+    em/em4100.py           # EM4100Tag, EM4100Reader
+    hid/hid.py             # HIDProxTag, HIDReader
+    atmel/t5577.py         # T5577Tag, T5577Reader
+  implants.py              # xEM, xNT, xM1, FlexDF, NExT
+```
 
-## Phase 4 — Scaffold `reader/` and `sim/`
+Backward-compat shims left in `sim/` — `from pm3py.sim import IcodeSlix2Tag` still works. `sim/__init__.py` imports from canonical `transponders/` locations. **751 tests passing, zero test changes.**
 
-**Status: sim/ migrated, reader/ scaffolded**
+## Phase 4 — sim/ infrastructure + reader/ scaffold
 
-### sim/ migration (complete)
+**Status: Complete**
 
-Migrated full sim framework from `.worktrees/sim-framework/` to `pm3py/sim/`:
-- 43 source files, ~7.8k LOC
-- 23 test files, 686 tests
-- Import fixes: 4 source files (..protocol/..transport → ..core.*), 1 source file (pm3py.hf_15 → pm3py.trace.ndef), 2 test files (flat → core.*)
-- Added sim Cmd entries to `core/protocol.py` (EML_SETMEM, SIM_TABLE_*)
-- Added deps to venv: `pycryptodome`, `bitarray`
-- **751 total tests passing** (686 sim + 65 core)
+### sim/ (migrated + cleaned)
+
+Sim framework migrated from `.worktrees/sim-framework/`, then transponder models extracted to `transponders/`. sim/ now contains only simulation infrastructure:
+- Core: `frame.py`, `memory.py`, `transponder.py` (ABC), `reader.py` (ABC), `medium.py`
+- Sessions: `sim_session.py`, `dual_session.py`
+- Tools: `table_compiler.py`, `trace_fmt.py`, `fuzzer.py`, `relay.py`, `replay.py`, `pm3medium.py`
+- MCU: `mcu_bridge.py`, `mcu_protocol.py`
+- Access control: `access_control/`
+- Backward-compat shims for all moved transponder files
 
 ### reader/ (scaffolded)
 
-Created directory trees per design:
 - `reader/hf/nxp/` — NXP reader ICs (CLRC663, PN5xx)
 - `reader/hf/st/` — ST reader ICs
 - `reader/lf/`
 - `reader/modes/` — inventory, programming, access control workflows
 
-All reader directories have `__init__.py` stubs.
+## DX improvements
+
+- `source activate` — core imports (Proxmark3, Cmd)
+- `source activate sim` — + SimSession, all transponder models
+- `source activate sniff` — + SniffSession, trace decoders
+- `source activate all` — everything
 
 ## Next Steps
 
-- Reorganize transponder models from `sim/` into `transponders/` hierarchy (optional — sim/ works as-is)
 - Reader modes: implement inventory, programming, access workflows in `reader/modes/`
 - Unify `sim/trace_fmt.py` with `trace/` package (dedup 15693 decoders, move 14443-A decoders)
 - Sniff: add `decode_iso14a.py` using decoders from `sim/trace_fmt.py`
-- Sim worktree cleanup: verify parity, then remove `.worktrees/sim-framework/`
+- Sim worktree cleanup: verify parity with master, then remove `.worktrees/sim-framework/`