diff --git a/plan/served.md b/plan/served.md
index 2397a68..640dc3e 100644
--- a/plan/served.md
+++ b/plan/served.md
@@ -1092,7 +1092,7 @@ Run from clients that hold only a URL and a credential: Claude Code started in `
 ### P11: One app for Windows, Mac and Linux (D-19, D-22, D-24)
 
 **Scope:**
-- **Choose the tooling first** (a spike, recorded in the change log): candidates Velopack (per-user Windows setup, macOS, self-updating AppImage, delta updates, a Rust SDK), cargo-packager (`.dmg`/`.app`, `.deb`, AppImage, pacman, NSIS and WiX `.msi`, with an updater crate; in public preview, no `.rpm`), and cargo-deb with cargo-generate-rpm for the distribution packages. Chosen against the rules below, not the other way round.
+- **Tooling: cargo-packager (D-25).** Its `cargo packager` builds `Wanderbooks.app` and the `.dmg`, the NSIS setup `.exe` (in its default `CurrentUser` mode: no admin, metadata under `HKCU`), the `.deb`, the AppImage, and the pacman `PKGBUILD` the AUR package starts from; `cargo-packager-updater` updates the formats that update themselves (`app`, `nsis`, `appimage`; `wix` too, if an `.msi` is ever made). It has no `.rpm`, so cargo-generate-rpm makes that. Both tools are pinned in `mise.toml`, like every tool. Checked 2026-10-18 against its source (packager 0.11.8, updater 0.2.3, both pre-1.0): the updater verifies each bundle's minisign (Ed25519) signature against one public key and by default takes only a newer semver than the running one. It has no expiry, no second key and no key rotation, so our signed release manifest (below) is checked first, and the bundle's own minisign signature after it; the primary release key is the minisign key. P11's first step is a short trial of all six formats on clean machines; anything it can't meet goes in the change log before we build around it.
 - **macOS:** a `.dmg` holding `Wanderbooks.app` (the one executable inside the bundle), signed with the company's Developer ID, notarized and stapled. Drag to Applications, or `~/Applications` for a standard user who can't write `/Applications`; no admin password. While macOS runs the app translocated (straight from the `.dmg` or Downloads), it says to move it first and refuses to connect agents, so no temporary path lands in Claude's or Codex's config. The app updates itself in place.
 - **Windows:** a per-user installer that asks for no admin password: a signed setup `.exe` into the user's app folder; an `.msi` only if a managed install ever needs one. The app updates itself. Signing through Azure Artifact Signing if the company or Stephen qualifies, else an OV certificate; SmartScreen warnings fade as the download builds a reputation.
 - **Linux:** Arch (an AUR `wanderbooks-bin` package), Debian/Ubuntu (`.deb` and our signed apt repository), Fedora (`.rpm` and our signed dnf repository), each installed and updated by the system's package manager (with `sudo`, as every package there is); and an AppImage that updates itself and needs no admin password, for every other distribution. The packages install the one executable, a `.desktop` entry and the icon.
@@ -1190,6 +1190,7 @@ The owner decisions of 2026-10-16 (at the top of this document) replace the form
 | D-22 | One app or several (owner, 2026-10-18: "My objective is simplifying installation and updates.") | **One app, one executable, separate processes.** `wanderbooks` is the only program installed; each role is a mode of it, run as its own process: the viewer (what opening the app shows), the books server and its host, the agent bridge (`wanderbooks mcp`), the archive process and the extractor. One thing to sign, notarize, ship and update. Mixed versions are still possible across a swap, so the host starts its children from its own executable and every handshake carries the version (3.9). The viewer's read-only rule never rested on a separate file: `ledger-gui` already links `ledger-store` and stays read-only through `Snapshot` and `tests/read_only.rs`. As its own process it keeps that, and on Linux it also confines itself read-only (Landlock). Each mode confines itself at start. The crates stay as they are; the executable is a thin dispatcher (P2). One exception: a server-only build (the `gui` feature off) for self-host (P9), so a headless machine carries no window libraries. |
 | D-23 | When the books are open (owner, 2026-10-18: "Also when an agent starts") | Amends D-21. The books are open while anything that opened them runs: the app, an agent session (its bridge opens them, windowless, for the session), a terminal running `wanderbooks serve`, or a CLI command. Each holds a lease on the host's lease-only socket, so a crashed holder lets go by itself; local agents speak to the server over a peer-checked local socket, never TCP (3.9). The first opener starts the one host; later ones attach; when the last lease ends the books close 10 s later, cleanly. "Close the books" ends every lease at once. Still no background service: nothing starts at login and nothing runs after the last holder. An agent session started with the books closed needs no reconnect (P2). |
 | D-24 | Installers and updates (owner, 2026-10-18: "A dmg for macOS, msi or whatever for windows, and packaged for Linux distributions. Win and Mac with updaters.") | macOS: a signed, notarized `.dmg`; the app updates itself. Windows: a signed per-user installer with no admin prompt (`.msi` only if a managed install needs one); the app updates itself. Linux: AUR, `.deb` with our apt repository, `.rpm` with our dnf repository (all updated by the package manager), and a self-updating AppImage. Every self-update is verified against our own release keys and the system's code signing; Linux packages are verified and updated by their package managers. An update restarts the books cleanly. A newer books format is the server's gate whatever the install: read-only until the owner consents, after a backup with the keys (3.9). "No admin password" holds for the dmg, the Windows installer and the AppImage; Linux packages use `sudo` as usual. Details and tooling in P11. |
+| D-25 | Packaging tool (owner, 2026-10-18: "Cargo packager looks good. Would like to use that.") | **cargo-packager** and its updater (crabnebula-dev, MIT/Apache-2.0) for the `.app`/`.dmg`, the per-user NSIS installer, `.deb`, AppImage and the AUR's `PKGBUILD`; cargo-generate-rpm for `.rpm`, which it lacks. Our release manifest (two keys, rotation, a version that only increases, an expiry) wraps its single-key minisign check (P11). |
 
 ### 10.2 Deferred