diff --git a/PLAN.md b/PLAN.md
index 1196796..9c052a8 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -12,15 +12,15 @@ sessions, tools, and turn orchestration.
 
 | Area | Status | Available now | Still open |
 | --- | --- | --- | --- |
-| App shell | Implemented | Native multi-window Iced app, Codex-inspired layout, Chat/Stats segmented workspace, native Application/Edit/Window menus, Preferences panel, Model Manager, and streaming composer | Native app release packaging |
+| App shell | Implemented | Native multi-window Iced app, Codex-inspired layout, Chat/Stats segmented workspace, native Application/Edit/Window menus, Preferences panel, Model Manager, streaming composer, and an ad-hoc-signed development `.app` bundle | Production signing, hardened runtime, entitlements, notarization, and update delivery |
 | Projects and sessions | Implemented with transcripts and KV resume | Native folder picker, project-name dialog, create/select/delete projects and sessions, durable structured chat history, and per-session KV checkpoints | Rename/archive and model binding |
 | Persistence | Implemented for local chat | SQLite in Application Support, Diesel ORM, embedded migrations, constrained defaults, streamed message updates, reopen tests, context/speed state, and local KV rehydration | Downloaded-artifact metadata and session-runtime migrations; HTTP chats deliberately never enter SQLite |
 | Model runtime | DeepSeek Flash decode and batched prefill implemented | Rust-owned mmap/model/session graph, local Metal kernels, full configured sparse context, exact absolute-position chunk scheduling, cold and resumed layer-major prefill (including unaligned compressor/indexer frontiers), DS4 sampling, one process-wide UI/HTTP owner, cancellation, idle unloading, prefix continuation, KV checkpoint save/load, and lock-free runtime metrics | Remaining KV continuation/rewrite parity, DSpark/SSD/steering, GLM/Pro execution, and sampled per-kernel GPU timing if coarse phase metrics prove insufficient |
-| Local endpoint | Exact parity in progress | Configurable localhost listener, verified-on-disk model discovery, transient Chat/Completions/Messages/Responses routes, native JSON/SSE envelopes, exact tool schema/call/result replay, live tool continuation, and differential C/Rust fixtures for tool use, cache accounting, reasoning, cold 6k-token prefill, resumed unaligned prefill, and real Pi tool execution | Remaining `ds4_server.c` parser/tool recovery, KV-store policy, disconnect/cancellation, scheduling/lifecycle, and error/context-limit fixtures; enable/disable controls |
+| Local endpoint | Exact parity in progress | Configurable localhost listener, verified-on-disk model discovery, transient Chat/Completions/Messages/Responses routes, native JSON/SSE envelopes, exact tool schema/call/result replay, live tool continuation, canonical/short/plain DSML recovery, strict Responses replay validation, and differential C/Rust fixtures for tool use, cache accounting, reasoning, cold 6k-token prefill, resumed unaligned prefill, and real Pi tool execution | Remaining malformed-tool repair/error fallbacks, full KV-store policy, disconnect/cancellation, scheduling/lifecycle, and error/context-limit fixtures; enable/disable controls |
 | Agent | Solid local chat implemented | Multi-turn role rendering, structured reasoning disclosure, Markdown, automatic scrolling, context/speed display, durable transcript rehydration, KV-backed resume, and a live Stats dashboard | Tools, approvals, and compaction |
 | A2UI | Future extension | bDS2 provides the reference structured render-tool contract | Native inline surfaces for local chat after core chat and tools are stable |
 | Dev brain | Not started | No vault access | Obsidian vault selection, durable access, and agent knowledge/memory tools |
-| Release | Not started | Development binary builds and tests | `.app` packaging, signing, entitlements, and notarization |
+| Release | Development bundle implemented | Release-mode `.app` packaging and ad-hoc code signing run through `make bundle` as a commit gate | Distribution identity/signing, hardened runtime, entitlements, notarization, update delivery, and release automation |
 
 The application manages durable project/session metadata and model preferences.
 Its Model Manager downloads, validates, and deletes managed GGUF artifacts
@@ -33,8 +33,8 @@ attention, fixed-size cold/resumed batch chunks, unaligned compressor/indexer
 continuation, and durable local KV checkpoints. The shared HTTP service exposes
 every `ds4_server.c` route and passes the initial differential corpus for native
 tool use/continuation, cache accounting, reasoning, and Pi execution. Full
-reference parity remains in progress until the remaining parser, KV-store,
-cancellation, scheduling, and error fixtures are ported.
+reference parity remains in progress until malformed-output recovery, KV-store,
+cancellation, scheduling, lifecycle, and error fixtures are ported.
 
 ## Phase 0 — project and session shell
 
@@ -296,10 +296,13 @@ engine lifecycle.
 Status: **exact parity in progress**. The shared single-model runtime,
 verified-model discovery, configurable localhost port, all four generation
 routes, native JSON/SSE response envelopes, exact batched prefill, tool replay,
-and live continuation exist. Differential C/Rust fixtures cover tools,
-reasoning, usage/cache accounting, and real Pi execution. Full parser/tool
-recovery, KV-store, cancellation, scheduling, lifecycle, and error fixture
-parity remain open, so no route is considered complete yet.
+and live continuation exist. Canonical, short, and plain DSML tool output plus
+loose nested parameters are recovered in final and streaming responses, and
+Responses replay rejects unknown/partial state instead of silently dropping
+it. Differential C/Rust fixtures cover tools, reasoning, usage/cache
+accounting, and real Pi execution. Malformed-tool repair/error fallbacks, full
+KV-store, cancellation, scheduling, lifecycle, and error fixture parity remain
+open, so no route is considered complete yet.
 
 `../ds4/ds4_server.c` is normative for every externally observable HTTP
 behavior. “Compatible” approximations are not acceptable: routes, accepted
@@ -412,8 +415,9 @@ the same conversation without prefill when its KV payload is compatible.
 
 Status: **basic local chat implemented**. The conversation area streams
 multi-turn DeepSeek Flash output, persists and rehydrates structured reasoning
-and answers, and supports Stop; tool turns and the coding-agent runtime remain
-open.
+and answers, renders Markdown, follows new output, restores sessions at their
+latest message, reports context use and generation speed, and supports Stop.
+Tool turns and the coding-agent runtime remain open.
 
 Every chat feature must persist its semantic state and rehydrate it when a
 session is reopened in the same implementation slice. In-memory-only chat
@@ -421,10 +425,12 @@ features are incomplete by definition; disclosure state and other purely
 ephemeral presentation preferences are the only exception.
 
 1. **Partially implemented:** build the classic chat surface. Transcript,
-   structured reasoning disclosure, composer, streamed output, and Stop are
-   complete; tool-call cards, queued input, prefill progress, and generation
-   statistics remain. Local turns must call the same session registry and KV
-   path used by the HTTP endpoint.
+   structured reasoning disclosure, Markdown rendering, composer, automatic
+   scrolling, streamed output, context/generation-speed status, and Stop are
+   complete. The shared Stats dashboard provides 200 ms runtime, prefill,
+   decode, HTTP, and KV telemetry; tool-call cards, queued input, and inline
+   chat-prefill progress remain. Local turns must call the same session registry
+   and KV path used by the HTTP endpoint.
 2. Port the native agent turn loop from `ds4_agent.c`, including model-specific
    system prompts and DeepSeek DSML/GLM tool-call parsing.
 3. Implement the local tool set with the project directory as its boundary:
@@ -559,10 +565,14 @@ and all surfaces survive application restart with their message history.
 
 ## Verification and packaging
 
-Status: **partially implemented**. Formatting, Clippy, build, and unit-test
-commit gates are documented in `AGENTS.md`; database migration/CRUD constraints
-and the preferences shortcut have unit coverage. Model fixtures, integration
-tests, and release packaging remain open.
+Status: **partially implemented**. Formatting, Clippy, release build/application
+bundle, and unit-test commit gates are documented in `AGENTS.md` and pass.
+Database migration/CRUD, preferences, engine scheduling, metrics, request
+parsing, tool replay/recovery, and streaming behavior have focused unit
+coverage. Live C/Rust endpoint scripts cover tool calls, multi-turn
+continuation/cache accounting, reasoning, and real Pi execution. The complete
+automated `ds4_server.c` differential corpus and production release signing,
+notarization, and delivery remain open.
 
 - Keep unit coverage narrow: persistence round trips, format compatibility,
   DS4 KV prefix/rewrite/store/load parity, cross-surface session binding,