diff --git a/BACKLOG.md b/BACKLOG.md
index d99bf7af..90659364 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -38,7 +38,9 @@ matching bullets below are superseded; only the noted follow-ups remain live:
 - **G** narration-lane lag — `eff8f8d`
 - **E** tui-go go.mod directive fix — `1e6699a`; markdown rendering — `da72ee5`; session list / resume view — `1f7a5d9`; per-event render-matrix golden tests — `2a99e15`; approval ergonomics (queue + tier-gated confirm) — `d5afcd3`
 
-**Not yet started (verifiable, Kotlin):** D batch fetch-approval; B §2 plan-derived diff manifest; H freestyle follow-ups.
+- **B §2** plan-derived diff manifest — `641051b`
+
+**Remaining (deeper / lower-verifiability):** D batch fetch-approval (approval-flow surgery); H freestyle follow-ups (graph re-route, child-session runner); the 5 dormant follow-up activations (A1 planner prompt, A3 producer, B§4 decision hook, egress sessionId, B§5 static_check stage); §E plan-comparison view + idea-board→profile.
 **§E tui-go remaining (UNBLOCKED — Go via `GOTOOLCHAIN=auto` go1.24.2):** plan comparison view; idea-board→profile promotion.
 **Still blocked in this sandbox:** F live-QA gates + D §6 web approval client (need local model / SearXNG / GPU).
 
diff --git a/RETRO.md b/RETRO.md
index feca94f4..6b9ba798 100644
--- a/RETRO.md
+++ b/RETRO.md
@@ -30,6 +30,7 @@ Nine tracks, each compiled + unit-tested green before commit.
 | `1f7a5d9` | tui-go session list / resume view: `R` overlay over `GET /sessions`, resume via `POST /sessions/{id}/resume` onto the existing global stream | E |
 | `2a99e15` | tui-go per-event render-matrix golden tests (37 cases) + a coverage guard that parses `protocol.go` so any new event type without a golden fails | E §2 |
 | `d5afcd3` | tui-go approval ergonomics: navigable pending-approval queue (no modal stacking) + `y/n/e` keys + tier-gated T3+ arm/confirm | E §3 |
+| `641051b` | Plan-derived diff manifest: `PlanStage.writes` + `PlanDerivedManifest.deriveAllowedWrites`/`combine`, unioned into `StageConfig.writeManifest` at compile, enforced by the existing containment matcher | B §2 |
 
 ### Follow-ups created this pass (refiled into BACKLOG)
 - **C-A1 activation** — `planner.md` must emit a `brief_echo` block and `role_pipeline.toml` must set `briefEcho="true"` / `briefEchoSource` for the gate to fire live (model-dependent → live-QA).