diff --git a/local/docs/IMPROVEMENT-PLAN.md b/local/docs/IMPROVEMENT-PLAN.md
index 4d378337c3..a281d08da2 100644
--- a/local/docs/IMPROVEMENT-PLAN.md
+++ b/local/docs/IMPROVEMENT-PLAN.md
@@ -1,13 +1,14 @@
 # Red Bear OS — Current Improvement Plan
 
-**Date**: 2026-07-07
-**Status**: Authoritative — current state after USB/Wi-Fi/Bluetooth quality audits
+**Date**: 2026-07-08
+**Status**: Authoritative — P0-P1 complete (14/14), P2 7/8 (88%), total 24/27 (89%)
 **Source of truth**: Linux kernel 7.1 (`local/reference/linux-7.1/`)
 
-This plan is derived from three fresh quality audits conducted on 2026-07-07:
+This plan is derived from three fresh quality audits conducted on 2026-07-07,
+with systematic remediation carried out 2026-07-07 through 2026-07-08.
 
 1. **USB Subsystem** — 38 Rust files, ~15,000 LOC. 83 unwraps/expects/panics. 82 TODOs. 72 unsafe blocks. 4/7 class drivers with zero tests.
-2. **Wi-Fi Subsystem** — iwlwifi (4049 LOC) + wifictl (2786 LOC) + linux-kpi wireless (1900+ LOC). 273 unsafe blocks. 7 PCI device IDs vs. Linux's ~500+.
+2. **Wi-Fi Subsystem** — iwlwifi (4049→4312 LOC) + wifictl (2786 LOC) + linux-kpi wireless (1900+ LOC). 273 unsafe blocks. 37 PCI device IDs (was 7). Mini-MVM layer created.
 3. **Bluetooth + Adjacent** — btusb + btctl. Best-tested USB component (21 tests). 1.3 KB USB core module with 11 tests.
 
 ---
@@ -269,16 +270,16 @@ let (irq_reactor_sender, irq_reactor_receiver) = crossbeam_channel::bounded(1024
 
 If the channel fills, drop events with a warning (backpressure).
 
-### 4.5 iwlwifi: Expand PCI device ID table
+### 4.5 iwlwifi: Expand PCI device ID table ✅ DONE (2026-07-08)
 
 **File**: `recipes/drivers/redbear-iwlwifi/source/src/linux_port.c:348-357`
 **Severity**: HIGH for hardware support, MEDIUM for code quality
 
-Only 7 device IDs (BZ, AX210, AX201, 9462-9560, 9000-series, 8265). Linux 7.1 iwlwifi has ~500+.
+Expanded from 7 → 37 device IDs covering 8 generations: 5000-series, 6000-series,
+7000-series, 8000-series, 9000-series, 22000-series, AX2xx-series, BZ/SC/GL.
+Cross-referenced with Linux 7.1 `iwl-cfg.h` and `pcie/drv.c`.
 
-**Approach**: Port from Linux 7.1 `drivers/net/wireless/intel/iwlwifi/iwl-cfg.h` and `pcie/drv.c` device ID tables.
-
-### 4.6 iwlwifi: Document known gaps with TODO markers
+### 4.6 iwlwifi: Document known gaps with TODO markers ✅ DONE (2026-07-07)
 
 Current: Zero TODO/FIXME/HACK/XXX markers. This is both a strength (clean code) and a risk (gaps undocumented). Add markers for:
 - MVM layer missing (5,200 lines from Linux 7.1)
@@ -360,18 +361,34 @@ Linux 7.1 reference is in `local/reference/linux-7.1/`. Verify it's the latest p
 
 ## 6. Wi-Fi Subsystem Improvements
 
-### 6.1 iwlwifi: Add MVM layer (CRITICAL gap)
+### 6.1 iwlwifi: Add MVM layer (CRITICAL gap) ✅ MINI-MVM DONE (2026-07-08)
 
-**File**: `recipes/drivers/redbear-iwlwifi/`
-**Severity**: CRITICAL — entire MAC layer missing
+**File**: `recipes/drivers/redbear-iwlwifi/source/src/linux_mvm.{h,c}`
+**Severity**: CRITICAL — MAC virtualization layer now present
 
-Linux 7.1's iwlwifi has `iwl-mvm.c` (~5,200 lines) implementing the MAC Virtualization Mode. Red Bear has none. This is the single biggest functional gap.
+Mini-MVM created (~280 lines total): RX descriptor parsing (iwl_rx_mpdu_desc v1/v3),
+energy_a/energy_b → dBm signal extraction, 802.11 Frame Control heuristic for
+raw-frame vs descriptor detection, rb_iwl_mvm_rate_to_mcs() bounded rate lookup.
+Notification IDs defined: RX_PHY_CMD (0xc0), RX_MPDU_CMD (0xc1), BA_NOTIF (0xc5),
+RX_NO_DATA (0xc7). Cross-referenced line-by-line from Linux 7.1 iwl-mvm-rxmq.c
+and fw/api/rx.h.
 
-**Scope**: Port `iwl-mvm.c`, `iwl-mvm-ops.c`, `iwl-mvm-rs.c` (rate scaling) from Linux 7.1. Estimated 8,000+ lines of Rust.
+Still deferred: Minstrel rate adaptation (iwl-mvm-rs.c, ~3,000 lines),
+thermal management, WoWLAN, debug hooks. These require firmware statistics
+accumulation that cannot be verified without hardware.
 
-### 6.2 iwlwifi: Add firmware TLV/NVM parser
+### 6.2 iwlwifi: Add firmware TLV/NVM parser ✅ DONE (2026-07-08)
 
-**File**: `recipes/drivers/redbear-iwlwifi/source/src/linux_port.c:624-646`
+**File**: `recipes/drivers/redbear-iwlwifi/source/src/linux_mvm.c` (rb_iwl_mvm_parse_firmware)
+
+TLV parser walks Intel firmware blob sections cross-referenced from Linux 7.1
+fw/file.h (struct iwl_ucode_tlv). Extracts: IWL_UCODE_TLV_ENABLED_CAPABILITIES
+(type 30), IWL_UCODE_TLV_N_SCAN_CHANNELS (type 31), IWL_UCODE_TLV_FW_VERSION
+(type 36). TLV entries are 4-byte aligned per Intel firmware spec. Capabilities
+and version logged at info level during firmware load.
+
+Still deferred: full NVM section parsing (MAC address, calibration data,
+regulatory info from iwl-nvm-parse.c).
 **Severity**: HIGH
 
 Current firmware handling only checks magic number. Linux 7.1's `iwl-nvm-parse.c` parses NVM sections, EEPROM calibration data, SAR tables. ~2,000 lines.