diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index 70e53ec..dd8df3c 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -36,11 +36,11 @@ plain `main` checkout always tells the truth about where the work is.**
 
 | | |
 |---|---|
-| Working on | **H2** — SMEP (group 4) |
-| Branch carrying it | `feat/security-group-4` (cut next) |
+| Working on | **HS** — SYSRET canonical-RIP guard |
+| Branch carrying it | `feat/security-group-4` (pushed to origin) |
 | On `main` | everything through P4c — groups 1, 2 and 3 merged |
-| Awaiting merge | nothing |
-| Suite | 111 cases, all passing |
+| Awaiting merge | H2 — lands with the group 4 merge |
+| Suite | 112 cases, all passing |
 | Last updated | 2026-08-01 |
 
 A checkbox below means the phase met its definition of green and was
@@ -80,7 +80,7 @@ group boundary.
   nobody holds. New `badge-scope` case, two processes of one fixture, every
   refusal paired with a control; suite 111/111)
 - [x] **merge** group 3 → main, push
-- [ ] **H2** — SMEP on every core
+- [x] **H2** — SMEP on every core (shared CPUID helper; CR4 bit 20 set in the per-CPU bring-up both the BSP and every AP run, asserted per core by the smp case; ring-0-executes-user-pages audit clean incl. the pre-paging window on the loader's tables; fail-open with a posture line; `-cpu max` added to the harness since QEMU's default model has neither bit; new `fault-smep` case; suite 112/112)
 - [ ] **HS** — SYSRET canonical-RIP guard
 - [ ] **H3** — SMAP + boot-patched `clac`; `-cpu max` in the harness; negative tests
 - [ ] **merge** group 4 → main, push