diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index dd8df3c..c2ce9f4 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -36,11 +36,11 @@ plain `main` checkout always tells the truth about where the work is.**
 
 | | |
 |---|---|
-| Working on | **HS** — SYSRET canonical-RIP guard |
+| Working on | **H3** — SMAP (the last phase) |
 | Branch carrying it | `feat/security-group-4` (pushed to origin) |
 | On `main` | everything through P4c — groups 1, 2 and 3 merged |
-| Awaiting merge | H2 — lands with the group 4 merge |
-| Suite | 112 cases, all passing |
+| Awaiting merge | H2, HS — land with the group 4 merge |
+| Suite | 113 cases, all passing |
 | Last updated | 2026-08-01 |
 
 A checkbox below means the phase met its definition of green and was
@@ -81,7 +81,20 @@ group boundary.
   refusal paired with a control; suite 111/111)
 - [x] **merge** group 3 → main, push
 - [x] **H2** — SMEP on every core (shared CPUID helper; CR4 bit 20 set in the per-CPU bring-up both the BSP and every AP run, asserted per core by the smp case; ring-0-executes-user-pages audit clean incl. the pre-paging window on the loader's tables; fail-open with a posture line; `-cpu max` added to the harness since QEMU's default model has neither bit; new `fault-smep` case; suite 112/112)
-- [ ] **HS** — SYSRET canonical-RIP guard
+- [x] **HS** — SYSRET canonical-RIP guard (the syscall exit sign-extends the
+  return RIP from bit 47 and returns through `iretq` when that changes it —
+  four register ALU ops and a never-taken branch on the hot path, no load; the
+  fallback un-pops the rip slot so `iretq` consumes the frame entry already
+  built, reloads R11 from the rflags slot, and keeps the `swapgs` in the same
+  place relative to the ring change. 4-level is not an assumption but a fact:
+  nothing sets CR4.LA57, and the comment says what a 5-level port must change.
+  Ring 3 **can** reach the hazard — `syscall` as the last two bytes of the last
+  canonical page returns to `user_half_end` — so the new `sysret-canonical`
+  case is a real ring-3 probe doing exactly that, and dies of a ring-3 #GP at
+  `0x0000800000000000` while the kernel runs on. Its teeth are the refusal
+  counter, not the outcome: measured with the guard's branch removed, TCG does
+  not model Intel's ring-0 #GP and every outcome check still passed. Suite
+  113/113)
 - [ ] **H3** — SMAP + boot-patched `clac`; `-cpu max` in the harness; negative tests
 - [ ] **merge** group 4 → main, push
 
@@ -518,6 +531,8 @@ put the text in `expect`, per `qemu_test.py:189`). Suite 112.
 **Test:** kernel unit case driving a thread whose return RIP is forged
 non-canonical via the syscall path if constructible cheaply; otherwise the
 review-level proof plus the existing fault cases regression. Suite 112.
+*(Landed: it was constructible, and from ring 3 rather than by forgery — the
+`sysret-canonical` case, suite 113.)*
 
 ## H3 — SMAP
 
@@ -532,7 +547,7 @@ review-level proof plus the existing fault cases regression. Suite 112.
 **Test:** new QEMU case `fault-smap`: ring-0 deliberate read of a mapped
 user page; expect vector 14 + `error code : 0x1` + kernel IP. And the
 whole suite becomes the tripwire — any missed straggler now fails loudly.
-Suite 113.
+Suite 114 (HS added one).
 
 ---