diff --git a/docs/release-plan-2026-10.md b/docs/release-plan-2026-10.md
index 60c3fc51..1b50d371 100644
--- a/docs/release-plan-2026-10.md
+++ b/docs/release-plan-2026-10.md
@@ -40,7 +40,7 @@ The Release 1 ledger leaves 65 manual workflows open, including native macOS/Lin
 
 ## Release 2: early stabilization
 
-**Current main checkpoint (2026-10-09, merge head `27e0a04`).** PRs #41–#63 are merged. Recent work includes broader Auto command execution with exact Deny rules, persisted conversation and child-session sidebar reordering, scoped profile path normalization, transcript search interaction coverage across Windows/Linux/macOS, and persisted hosted-provider reconnect preferences. PR #45's drag/drop feature passed Windows/Linux/macOS CI [#37957023785](https://github.com/jay23606/codev/actions/runs/37957023785) and the four-target packaged preview [#37957023813](https://github.com/jay23606/codev/actions/runs/37957023813). PR #48 made Markdown-only PRs skip packaged previews while retaining cross-platform CI; PRs #49–#52 recorded download, checkpoint, and release-note updates. PR #53 added a cross-group drop rejection test, PR #54 documented its boundary coverage, PR #55 normalized scoped profile read paths, and PR #56 added traversal-denial tests. PR #57's exact-head Windows/Linux/macOS CI [#37981218664](https://github.com/jay23606/codev/actions/runs/37981218664) and four-RID package preview [#37981218523](https://github.com/jay23606/codev/actions/runs/37981218523) passed; post-merge main CI [#37982990888](https://github.com/jay23606/codev/actions/runs/37982990888) passed. PR #58 refreshed this checkpoint; its seven Windows/Linux/macOS CI jobs [#37984193779](https://github.com/jay23606/codev/actions/runs/37984193779) and post-merge main CI [#37984535251](https://github.com/jay23606/codev/actions/runs/37984535251) passed. PR #59 strengthened before/after drag and reload-persistence tests across pinned, recent, and child rows; its Windows/Linux/macOS CI [#37986169061](https://github.com/jay23606/codev/actions/runs/37986169061) and post-merge main CI [#37986596692](https://github.com/jay23606/codev/actions/runs/37986596692) passed, and the test-only packaged-preview skip worked as designed. PR #60 records this regression evidence; PR #61 refreshed the documentation. PR #62 makes first-time hosted-provider reconnect default on while preserving a deliberate opt-out; its cross-platform tests [#37991522654](https://github.com/jay23606/codev/actions/runs/37991522654) and four-target packaged preview [#37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) passed. Post-merge main CI [#37992412448](https://github.com/jay23606/codev/actions/runs/37992412448) passed on merge head `ecacccb`. PR #63 updates the Release 2 notes for the hosted reconnect default and remembered opt-out; its Windows/Linux/macOS checks passed [#37992748146](https://github.com/jay23606/codev/actions/runs/37992748146). Post-merge Windows/Linux/macOS CI passed [#37993099948](https://github.com/jay23606/codev/actions/runs/37993099948); no local packaged smoke was run. No local packaged smoke was run. Clean-machine installation, physical accessibility, and native macOS/Linux interaction remain explicit limitations. Keep the October 11 freeze and October 13 Release 2 target below.
+**Current main checkpoint (2026-10-09, main `2f9ff4e`; Release 2 product code through `ecacccb`).** Product PRs #41–#62 are merged; PRs #63–#66 update the release notes, checkpoint, and validation evidence. Recent code changes include broader Auto execution with exact Deny rules, persisted sidebar ordering, scoped profiles, transcript search, and hosted-key reconnect preferences. PR #62 exact-head Windows/Linux/macOS CI [#37991522654](https://github.com/jay23606/codev/actions/runs/37991522654) and the four-target packaged preview [#37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) passed. That preview ran the reported destructive-plus-Git command in Auto and verified an exact Deny; Linux and both macOS packages also passed their Auto/local-chat interaction checks. Post-merge CI for PRs #63–#66 passed, most recently on `2f9ff4e` [#37995325127](https://github.com/jay23606/codev/actions/runs/37995325127). No local packaged smoke was run. Clean-machine installation, physical accessibility, and native macOS/Linux interaction remain explicit limitations. Keep the October 11 freeze and October 13 Release 2 target below.
 
 Target Release 2 for **Tuesday, October 13, 2026** (Day 5 after the October 8 publication; acceptable window: Day 3–5). On October 9–10 (Days 1–2), collect install reports, triage reproducible issues, and fix release blockers. On October 11 (Day 3), freeze the candidate and run exact-head Windows/Linux/macOS CI plus all four packaged desktop/CLI checks. The desktop-preview workflow runs for version tags, explicit candidate dispatches, and pull requests not limited to the skipped paths. PRs limited to Markdown documentation, test projects, or the release-preview workflow still run Windows/Linux/macOS CI but skip the four packaged interaction smokes. Regular merges to `main` do not repeat the packaged previews. Dispatch that workflow once against the frozen main commit before tagging. Use a local desktop smoke only if a release-critical interaction is not covered by hosted UI checks and focused tests; routine local runs stay disabled. Publish on October 12–13 only if exact-head checks pass, update the release notes for verified changes and remaining limitations, and confirm all eight README latest-download links. If a blocker moves the candidate, move Release 2 to Day 3–5 after the verified fix.