diff --git a/PLAN.md b/PLAN.md
index 44243d1..b6139ae 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -167,15 +167,15 @@ maps a (note, velocity) to the correct sample/zone; the core takes and returns o
 plain data (no VST3/REAPER types) — enforced by the test target linking neither SDK.
 **Depends on:** S2 (consumes `rootNote` / loop points as core inputs).
 
-- [ ] Voice engine: polyphonic voice allocation (note-on/off, bounded voice stealing),
+- [x] Voice engine: polyphonic voice allocation (note-on/off, bounded voice stealing),
   per-voice state, mono-and-basic-polyphony sufficient for Tier 0.
-- [ ] Amplitude envelope (ADSR) math — asserted against a known signal.
-- [ ] Repitch/interpolation from root note (chromatic pitch ratio across the
+- [x] Amplitude envelope (ADSR) math — asserted against a known signal.
+- [x] Repitch/interpolation from root note (chromatic pitch ratio across the
   keyboard); loop-point-aware sustain for held notes.
-- [ ] Keymap model + resolution: key ranges/zones (Tier-1 shape) and the
+- [x] Keymap model + resolution: key ranges/zones (Tier-1 shape) and the
   (note, velocity) → sample/zone query; Tier-0 chromatic-from-single-root as the
   degenerate case.
-- [ ] Tests: voice allocation under polyphony + stealing; ADSR envelope shape;
+- [x] Tests: voice allocation under polyphony + stealing; ADSR envelope shape;
   repitch pitch-ratio correctness; keymap resolution (single-root chromatic + zoned);
   core boundary is plain-data-only (no VST3/REAPER types).
 
@@ -260,9 +260,10 @@ build:** the `IReaperUIEmbedInterface` contract + embed message/lifecycle agains
   factory-macro spellings, Windows module-export symbol names
   (`InitDll`/`ExitDll`/`GetPluginFactory`), and whether VSTGUI is bundled. Several are
   §1a experienced-estimates until S1 confirms them against the vendored SDK.
-- **VST-host bridge** — opcodes `0xdeadf00d` (resolve-by-name) / `0xdeadf00e` (host
-  context) and the exact call marshalling, against `reaper_plugin.h` /
-  `video_processor.h` / `reaper_plugin_functions.h`.
+- **VST-host bridge** — ~~opcodes `0xdeadf00d`/`0xdeadf00e`~~ **verified (S1):** VST3
+  path is `IReaperHostApplication::getReaperApi` (resolve-by-name) and
+  `getReaperParent(3)` (host context) via `reaper_vst3_interfaces.h`; the
+  `0xdeadf00d`/`0xdeadf00e` opcodes are VST2-only and do not apply.
 - **`IReaperUIEmbedInterface`** — embed contract + message/lifecycle, against
   `reaper_plugin_fx_embed.h` (needed only at S6).