diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index 38fbec6..6cba676 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -64,7 +64,7 @@ group boundary.
   the manifest gained a third permission, `supervise`, which names an authorized
   supervising task per contract and is deliberately **open-only**, leaving P2's
   bind attestation and every refusal it makes untouched (suite 109/109)
-- [ ] **merge** group 2 → main, push
+- [x] **merge** group 2 → main, push
 - [ ] **P4a** — clean protocols rebased onto `Define` (vfs, block, display, scanout, input)
 - [ ] **P4b** — misfit protocols rebased (device-manager, power, usb-transfer)
 - [ ] **P4c** — harness subscriber lift + badge-scoped per-client integers