diff --git a/SprintPlanning.md b/SprintPlanning.md
index a5fc1bfd70f..3a4f944d684 100644
--- a/SprintPlanning.md
+++ b/SprintPlanning.md
@@ -145,7 +145,11 @@ first implementation tier.
 - [x] ~~**Rec 32 PR #32-2:** bump `-std=c++11` → `-std=c++14` in `decompile/cpp/Makefile`.~~ Shipped: [PR #310](https://github.com/CryptoJones/GayHydra/pull/310).
 - [x] ~~**Rec 32 PR #32-3:** bump to `-std=c++20`.~~ Shipped: rolled in with [PR #314](https://github.com/CryptoJones/GayHydra/pull/314); same three sites as #32-2 (`buildNatives.gradle` Gcc/Clang blocks, `decompile/cpp/Makefile`, `decompile/cpp/fuzz/Makefile.fuzz`), flag-only change. Toolchain floor recorded in `docs/decompiler/CPP20_ADOPTION.md` (gcc ≥10, clang ≥12, MSVC 2019 16.10+/2022).
 - [x] ~~**Rec 31 PR #31-2:** RAII Stage 1 — convert `address.cc`, `space.cc`, `range.cc` to `unique_ptr`. CI lint: no raw `new` in these files.~~ Shipped: the three foundation files were already raw-`new`-free in tree (only `new` mentions are in comments); the `gradle cppRaiiAudit` per-file gate was added to fail CI on any regression. Tree path uses `rangeutil.cc` (the file the audit named as `range.cc`).
-- [ ] **Rec 31 PR #31-3 + Rec 32 PR #32-4:** RAII Stage 2 (`marshal.cc`, `xml.cc`) paired with `std::span` adoption in their parameter pairs. Joint review.
+- [ ] **Rec 31 PR #31-3 + Rec 32 PR #32-4:** RAII Stage 2 (`marshal.cc`, `xml.cc`) paired with `std::span` adoption in their parameter pairs. Joint review. Status:
+  - **`marshal.cc` RAII (#31-3 marshal half)** — shipped [PR #46](https://github.com/CryptoJones/GayHydra/pull/46). ByteChunk now owns its buffer via `unique_ptr<uint1[]>`; `~PackedDecode` no longer walks `inStream` to manual-`delete[]` the entries. `marshal.cc` / `marshal.hh` added to `cppRaiiAudit`'s `PROTECTED_FILES` so any regression that reintroduces raw owning pointers in those files fails CI.
+  - **`marshal.cc` std::span (#32-4 marshal half)** — NOT shipped with #46. Deviation from the documented "same files, same PR" plan in `docs/decompiler/CPP20_ADOPTION.md`. Honest read: marshal's public API uses `[start, end)` pointer-pair ranges (`ByteChunk(uint1*, uint1*)`, `allocateNextInputBuffer` → `uint1*`), not the `(T*, size_t)` shape that `std::span` naturally replaces. The `std::span` adoption may not have an obvious site in marshal; revisit when the xml.cc half lands and decide whether to write a separate `std::span` migration PR for marshal or just accept that marshal didn't have a natural target.
+  - **`xml.y` / `xml.cc` RAII (#31-3 xml half)** — in flight as a multi-PR thread. [PR #51](https://github.com/CryptoJones/GayHydra/pull/51) migrates `XmlScan::lvalue` (per-token string buffer). [PR #52](https://github.com/CryptoJones/GayHydra/pull/52) (stacked on #51) migrates `xml_parse`'s `global_scan` lifetime. Remaining: `Element` tree ownership refactor, `Document` return-value migration, and the bison semantic-action sites (blocked on `%union` redesign).
+  - **`xml.cc` std::span (#32-4 xml half)** — open. Audit it alongside the bison semantic-action `%union` redesign.
 
 ---