diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index 3e79d61..e88ed5d 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -34,7 +34,7 @@ the logging/USB-lifecycle track).
 - [x] **Phase 0** — baseline: suite green on `main` (106/106, 2026-07-31; `zig build` + `zig build test` clean at 9a32380), plan committed
 - [x] **PM** — path-migration flag-day (`/etc`→`/system/configuration`, `/var/log`→`/system/logs`, `/mnt/usb`→`/volumes/usb`; vfs carve-out for the two writable `/system` subtrees, FAT's `/var` mount split in two; suite 106/106)
 - [x] **H1** — the `user-memory` module; nine stragglers converted; leaf U/S+W checks (plus physmap-coverage confirmation, so an `mmio_map`'d buffer cannot fault ring 0 — this also closes the same hazard on the IPC path; `fs_resolve`'s out-capacity bound made overflow-safe; suite 107/107)
-- [ ] **merge** group 1 → main, push
+- [x] **merge** group 1 → main, push (f3bc23c, 2026-07-31)
 - [ ] **P1** — envelope module + `Define`; vfs `NodeKind.protocol` + open-reply-capability; client `Channel`
 - [ ] **P2** — registry in init; `/protocol` reserved; ServiceId flag-day (11 binds, 17 lookups)
 - [ ] **P3** — open grants: `protocol.csv` enforcement, denial test