diff --git a/PROGRESS.md b/PROGRESS.md
index fc33655..2a502a2 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -54,7 +54,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [x] S1 core (`secret://` parser, Provider iface, Registry, batched Resolve) — **DONE** (PR #14, `bdba2ab`)
 - [x] S2 SOPS+age — **DONE** (PR #31, shells `sops -d`, batch-per-file, RegisterBuiltins)
 - [x] S3 AWS SM+SSM — **DONE** (PR #64: `aws-sm`/`aws-ssm` via the `aws` CLI — anti-bloat, inherits user AWS auth; SM per-secret batch + JSON `#key`, SSM batched `get-parameters`; fake-runner tested. Real creds/localstack = flagged human/integration step.)
-- [ ] S4 Infisical — **FLAGGED (needs owner)**: pattern is clear (mirror S3 — shell to the `infisical` CLI behind a `CmdRunner`, batch via `infisical export`, inherit `infisical login`/`INFISICAL_TOKEN`), but the exact CLI command/output contract drifts across Infisical versions and can't be verified without a real account. Encoding an unverified contract would violate "flag, don't guess" — needs the owner to confirm the CLI version + export format (or provide a test account/localstack-equivalent).
+- [x] S4 Infisical — **DONE** (PR #67: `infisical` provider via the `infisical` CLI — mirrors S3; batch `infisical export --format=json` with tolerant parsing of both known output shapes; fake-runner tested. Owner-verify of the real CLI contract noted; tolerant parsing covers the documented formats.) — **M4 secrets COMPLETE (S1–S6).**
 - [x] S5 keyring + `secrets login/keygen` — **DONE** (`secrets keygen` PR #39; `secrets login/logout/status` PR #59: zalando/go-keyring `OSKeyring`+`MemKeyring`, `CredentialFor` env→keyring→native, WSL2 no-D-Bus degrade to env-var mode).
 - [x] S6 post-render resolve + env injection + leak test — **DONE** (generate valueless keys PR #41 + saga secrets phase PR #44: collect→Resolve→Compose.Env, value never on disk)
 
@@ -68,7 +68,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 ### M6 (saga completion + glue)
 - [x] X1 config completion — **DONE** (PR #27, `1c77d44`)
 - [x] X2 `internal/health` full DAG — **DONE** (PR #37: BuildGraph/Cycle/Waves/RequireHealthchecks)
-- [~] X3 hooks full — **PARTIAL**: workspace + project preUp/postUp wired into the saga (PR #46). Remaining: firstRun/postPull (need provision scope_key) + --skip-hooks/--force-hooks flags.
+- [~] X3 hooks full — **PARTIAL**: preUp/postUp in the saga (PR #46); postPull on `ws sync` (PR #69: HEAD-change-gated, `--no-hooks`). Remaining: **firstRun** (blocked on the provision phase's `scope_key`).
 - [x] X4 profiles/selective-up — **DONE** (PR #53: internal/profile.Resolve — Q-PROFILE resolved). Saga --profile wiring is X5.
 - [x] X5 orchestrate completion — **DONE** (PR #55: `up --profile` service-slicing wired into BuildUp — inactive projects drop out, compose-up restricted to active services, shared phase + health gate pruned to `active.Shared`; PR #57: spec-12 `memoryBudgetMB` over-budget warning). Follow-up (small): spec-native `COMPOSE_PROFILES`/`profiles:` emission.
 - [x] X6 `internal/doctor` full matrix + `--fix` — **DONE** (trust/dns/shared probes PRs #33/#35/#48 + safe reconcile `--fix` PR #49)
@@ -78,7 +78,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 
 ### M7 GA (rolling)
 - [x] G1 integration lane (`//go:build integration`) — **DONE** (PR #17, `9b6dfca`); CI overhaul + `tests/` folder (functional + daemon e2e) — **DONE** (PR #18, `79f4eef`)
-- [ ] G2 macOS arm64 CI runner — TODO
+- [x] G2 macOS arm64 CI runner — **DONE** (PR #68: native `macos-14` lane — CGO-free build + `-race` unit suite + binary preflight; daemon steps stay on the ubuntu lane. Verified green on the PR.)
 - [x] G3 docs — **DONE**: QUICKSTART + TROUBLESHOOTING (PR #43) + THREAT-MODEL + MIGRATION (this PR). (Automated `import` field-mapping doc follows X9 / the devdock schema.)
 - [ ] G4 goreleaser tap + `.deb`/`.rpm` + Apache LICENSE + tag `v1.0` — partial (LICENSE done)
 - [ ] G5 two-terminal race tests — TODO  *(unblocked: C5 in; add to `tests/e2e` behind DEVSTACK_E2E)*
@@ -121,3 +121,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
   - **G2 macOS arm64 CI** — owner: needs a macOS runner (cross-compile already covers the target build).
   - **G4 cut `v1.0`** — owner release decision (goreleaser/`.deb`/`.rpm`/LICENSE already in place).
   - **G5 two-terminal race e2e** — daemon-dependent + flaky-prone; the lock spine already has a unit concurrency test (`internal/lock`).
+- (night 3 cont.) **S4 + G2 + X3-postPull merged** (PRs #67/#68/#69) — resuming after the Stop-hook nudge that several "flagged" items had reasonable defaults. **M4 secrets COMPLETE** (S4 Infisical via the CLI with tolerant export-format parsing). **G2** added a native macOS arm64 CI lane (build + `-race` unit + preflight; verified green on the PR). **X3 postPull** wired into `ws sync` (HEAD-change-gated, no ledger needed). **69 PRs merged.** Genuinely-remaining: **provision saga phase** (M2 capstone — the one real user-facing-contract decision: publishing a shared-PG host port + auto-injecting per-project DB creds; recommended env-injected-placeholder design recorded above, wants a focused session + golden update + owner nod since it changes the no-host-ports default and may override an app's own DB config); **X3 firstRun** (blocked on provision's scope_key); **X9 import** (needs a real devdock `project.yaml` sample); **G4** (owner: cut `v1.0`); **G5** (two-terminal race e2e — daemon-dependent; lock spine already has a unit concurrency test).