diff --git a/README.md b/README.md
index 5888f64..7c75d59 100644
--- a/README.md
+++ b/README.md
@@ -93,15 +93,17 @@ pointing at Gitea: that is where the plugin is developed and pushed first.
 
 ## Branches in `cloudcli/`
 
-Each feature branch is cut **from the upstream tag `v1.37.2`**, never from another
-feature branch — that is what keeps the three pull requests independent.
+Each feature branch is cut **from upstream `main`**, never from another feature
+branch — that is what keeps the three pull requests independent. They are kept
+current by merging `main` into them, so their base moves with upstream; today it
+sits at or just after the `v1.37.3` release.
 
 | Branch | Base | Purpose |
 |---|---|---|
 | `main` | tracks `upstream/main` | Upstream sync. Carries no commits of ours |
-| `feat/resizable-sidebar` | `v1.37.2` | PR-1 — resizable sidebar |
-| `feat/plugin-host-api` | `v1.37.2` | PR-2 — authenticated host API for plugins |
-| `feat/plugin-sidebar-surface` | `v1.37.2` | PR-3 — sidebar surface for plugins |
+| `feat/resizable-sidebar` | `upstream/main` | PR-1 — resizable sidebar |
+| `feat/plugin-host-api` | `upstream/main` | PR-2 — authenticated host API for plugins |
+| `feat/plugin-sidebar-surface` | `upstream/main` | PR-3 — sidebar surface for plugins |
 | `dev/taskwork` | merge of the three | Local run and debugging; the submodule is pinned here |
 
 `dev/taskwork` never takes part in a pull request and may be recreated at any time.
@@ -118,13 +120,13 @@ feature branch — that is what keeps the three pull requests independent.
 | Piece | State |
 |---|---|
 | Plugin | `v1.0.0`, pushed to Gitea; installs, builds and runs (`npm install --ignore-scripts` + `npm run build` in ~3 s) |
-| `feat/resizable-sidebar` | Pushed to the fork. PR-1 not opened yet; no issue needed |
-| `feat/plugin-host-api` | Pushed to the fork. Issue text in `spec/upstream/issue-1-plugin-host-api.md`, PR text in `plugin-taskwork/docs/upstream-pr-2.md` |
-| `feat/plugin-sidebar-surface` | Pushed to the fork. Issue text in `spec/upstream/issue-2-plugin-sidebar-surface.md`, PR text in `plugin-taskwork/docs/upstream-pr-3.md` |
+| `feat/resizable-sidebar` | PR-1 [#1189](https://github.com/siteboon/claudecodeui/pull/1189) **merged** into upstream `main` on 2026-09-21 (`6c51fcaa`), together with the chips folding into `…` |
+| `feat/plugin-host-api` | PR-2 [#1191](https://github.com/siteboon/claudecodeui/pull/1191) open (issue #1190); `main` merged in on 2026-09-28. PR text in `plugin-taskwork/docs/upstream-pr-2.md` |
+| `feat/plugin-sidebar-surface` | Pushed to the fork, `main` merged in on 2026-09-28. Not opened yet: issue text in `spec/upstream/issue-2-plugin-sidebar-surface.md`, PR text in `plugin-taskwork/docs/upstream-pr-3.md` |
 | `dev/taskwork` | Merge of the three plus one integration commit (host API in the sidebar surface) that never goes upstream; the `cloudcli` pin points here |
 
-Remaining before upstream contact (§19 of the spec): open issue #1, then PR-2;
-issue #2, then PR-3; PR-1 can go on its own. Also outstanding: the manual
+Remaining upstream: open issue #2, then PR-3 with `Closes #<issue>`; keep PR-2
+current until it is reviewed. Also outstanding: the manual
 acceptance checklist (§15.4), which needs a running host in a browser.
 
 ## Release
diff --git a/plugin-taskwork b/plugin-taskwork
index fdae524..7ecedc9 160000
--- a/plugin-taskwork
+++ b/plugin-taskwork
@@ -1 +1 @@
-Subproject commit fdae5240077e0c014f17ef50eb38b0b6748b63e7
+Subproject commit 7ecedc92b106393cae605d36f6a7c9ea9bf3ac63