diff --git a/android/PLAN.md b/android/PLAN.md
index 8fbcb06..b3b01a1 100644
--- a/android/PLAN.md
+++ b/android/PLAN.md
@@ -1070,6 +1070,27 @@ push, and Play (M6–M8) follow the designed app.
       already set, so the release run will call Play, and the signing choice is permanent. On the
       draft app, CI's commit is refused as expected; the first bundle is then uploaded by hand
       (step 2 above).
+
+      **Done 2026-10-30.** Before the cutover:
+      - **The signing key.** Play had generated its own app-signing key when the app was created
+        on 2026-08-19, not the one the Gitea APKs carry. The release keystore exists only as the
+        `ANDROID_KEYSTORE_BASE64` org secret. A keystore on the org lead's machine from the same
+        day turned out to hold a different key. So a one-shot workflow on a throwaway branch ran
+        PEPK in CI and uploaded the zip, encrypted to Google's key, as a one-day artifact. The
+        org lead uploaded it, and Play's key is now `59:7B:79:ED:…:0E:14:A4:82`, the same as
+        every release APK's. The branch and the artifact were then deleted.
+      - **The Console.** Sign-in details (`play-review` on `demo.runicgateway.com`), the
+        advertising ID (no), target audience (18 and over) and Data safety (from runicgateway.com's
+        `PLAY_DATA_SAFETY.md`) are saved. The store listing is saved too: text approved by the
+        org lead, runicgateway.com's app screenshots widened to Play's 2:1 limit, and the icon,
+        the feature graphic and the home screenshot labelled as AI-generated art.
+
+      The cutover is Android-app#65 (merge `02fb7d4`), tagged **v0.7.0** (versionCode 700,
+      target 36, signed `59:7B…`). The Gitea release has the APK, the bundle and `SHA256SUMS`.
+      The Play step stopped earlier than expected, with a 403: the Google Play Android Developer
+      API is not enabled in the service account's Cloud project. The token exchange itself
+      worked. Left for the org lead: enable that API, upload `runic-gateway-0.7.0.aab` by hand to
+      a test track, and pick countries. Then *Send app for review* opens.
 10. **M9 — Native SSO login** (post-v1, additive; independent of M8): in-app "Sign in with Google /
     Discord" via the **Mobile SSO Authorization Bridge** (§4.2). **Backend-first**, mirroring M7's
     split: