diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index 5c3dae5..58ca120 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -36,11 +36,11 @@ plain `main` checkout always tells the truth about where the work is.**
 
 | | |
 |---|---|
-| Working on | **P4a** — protocol rebase onto `envelope.Define` |
-| Branch carrying it | `feat/security-group-3` (cut next) |
+| Working on | **P4b** — device-manager, power, usb-transfer onto `Define` |
+| Branch carrying it | `feat/security-group-3` (local only — origin returned 503 at 06:1x, push pending) |
 | On `main` | Phase 0, PM, H1, P1, P2, P3 — groups 1 and 2 merged |
-| Awaiting merge | nothing |
-| Suite | 109 cases, all passing |
+| Awaiting merge | P4a — lands with the group 3 merge |
+| Suite | 110 cases, all passing |
 | Last updated | 2026-08-01 |
 
 A checkbox below means the phase met its definition of green and was
@@ -65,7 +65,7 @@ group boundary.
   supervising task per contract and is deliberately **open-only**, leaving P2's
   bind attestation and every refusal it makes untouched (suite 109/109)
 - [x] **merge** group 2 → main, push
-- [ ] **P4a** — clean protocols rebased onto `Define` (vfs, block, display, scanout, input)
+- [x] **P4a** — clean protocols rebased onto `Define` (vfs, block, display, scanout, input; display's one overloaded request split per-operation and its field abuse ended, scanout's bogus 64-byte maximum deleted, directory EOF re-spelled as a nameless entry, input moved onto the service harness; new `protocol-conformance` case asks every reachable provider for `describe` and requires `-ENOSYS` for an undefined verb; suite 110/110)
 - [ ] **P4b** — misfit protocols rebased (device-manager, power, usb-transfer)
 - [ ] **P4c** — harness subscriber lift + badge-scoped per-client integers
 - [ ] **merge** group 3 → main, push