diff --git a/docs/bench-log.md b/docs/bench-log.md
index 086cefca1..a7f83c951 100644
--- a/docs/bench-log.md
+++ b/docs/bench-log.md
@@ -951,3 +951,35 @@ the machine stopped; the two PCs, the seed and the cloud network carried the cha
 block the observer later stored carried its original header time). The lag-proofing stays (it is right on its own), the
 restart loop stays, and the public-face watch now runs from the same machine, so it also sleeps when the Mac does; the
 fix is the charger and keep-awake, not software. The cloud scripts now re-exec under `caffeinate -i`.
+
+## 2026-10-04 (afternoon)  the app's prover loop end to end on the Mac (Igneum Miner engine, packaged binaries, private test network)
+
+Machine: Apple M5 Max, load 2 to 31 through the runs (other agents' builds and a Linux cross-build of the SP1 host ran alongside). Network: `tools/proving-v0/run.mjs --network-only` (3 proving nodes on 29800+, igneum-devnet-955, 60x fast time, activation 60, node 0 with the SP1 verifier, nodes 1 and 2 in trust mode, three vmine voters at 1 block/s). App: `app/igneum-app` engine (release, commit 77ea5b6) staged at /tmp/igneum-app-proving with `bin/` = the proving node and miner (`vendor/igneum-node-proving/target/release`), the Metal worker, `igneum-prove-host` and `igneum-prove-export` (`proving/igneum-prove/target/release`), and an `igneum-app.json` whose `node_override_params` is the fast-time profile with `skip_proof_of_work` and the activation height; environment `IGNEUM_APP_DEVNET_SUFFIX=955`, RPC 29850, peers 127.0.0.1:29811 and 29801. Driven through its own API (setup with a pasted address 0x4343..., start, `api/prove {on:true}`); the Proving tile read every 5 s from `api/state`.
+
+Run 1 (14:36 to 14:49 UTC, mining on the Metal worker at 12 to 20 MH/s): tile states as they happened:
+
+| Wall (UTC) | Tile | Note |
+|---|---|---|
+| 14:36:53 | idle, "no shard assigned to this machine in the last 60 blocks", 3 blocks accepted | the key needs 5 blue blocks in the 120-DAA window (dust) |
+| 14:37:49 | idle, 5 blocks accepted | eligible from here |
+| 14:37:59 | proving block 140 shard 0 (0 txs, 0 pgas), assigned 10, "proving on the CPU (slow)" | the first plan after eligibility assigned the key to 10 of the last 60 shards |
+| 14:40:02 | submitted (proved 1, submitted 1) | compressed proof 107.0 s; the app's node accepted the record (verify Off: the app's node has no verifier, it relays) |
+| 14:40:04 | (node log) chain block 259 paid 634,083,030,000,000,000 wei to 0x4343... | 2 s after the submission; carried by a trust-mode node's block |
+| 14:43:22, 14:46:12 | blocks 268 and 447 proved (143.1 s, 115.3 s) and paid the same way | the tile still said paid 0 |
+
+Defect found and fixed (efb2c2e): the tile looked for the payment in the 60-block work list, and a 2-minute CPU proof is 120 blocks, so every paid shard had scrolled out before the next poll. Second defect found and fixed (12df531): a proof in flight outlived the app on quit (the host kept running); the host and the exporter are now polled children killed on quit, on switch-off and at the limit (checked after run 3: no host process left).
+
+Run 2 (14:50 to 15:01): the difficulty had risen on the app's extra blocks (the controller holds 1 block/s, the voters supply that alone), the Metal worker found 2 blocks in 10 minutes, the key never reached 5 in the window, and the tile stayed idle: a machine without mining weight gets no assignment. Fixed by policy (77ea5b6): with nothing assigned, the loop takes an open shard (past its 10-DAA exclusive window, unpaid; spec 7.2 item 4 says anyone may prove it and is paid).
+
+Run 3 (15:02 to 15:04, the fix above), tile states as they happened:
+
+| Wall (UTC) | Tile |
+|---|---|
+| 15:02:22 | (engine up, node restarting) |
+| 15:02:27 | proving block 1579 shard 0 (0 txs, 0 pgas, open), "proving on the CPU (slow)" |
+| 15:03:38 | submitted (proved 1, submitted 1), "block 1579 shard 0 submitted; paid when a block carries it" |
+| 15:03:49 | proving block 1650 shard 0 (open), paid 1, 637,452,090,000,000,000 wei (0.637 IGN) |
+
+Block 1579 shard 0: 233,576 cycles, execute 0.025 s, compressed 60.2 s, 1,272,897 bytes; node 0 shows the record carried by chain block 1655 and paid; the payout address's balance on node 0 was 163.15 IGN at the end (4 shard payouts of about 0.635 IGN each plus the mining rewards of run 1). The app's node, restarted twice, replayed the chain from genesis each time and re-applied the same three payouts (its log at 15:49:53 lists chain blocks 433, 618 and 756 paying blocks 268, 447 and 569), which is the determinism the rule needs.
+
+Reading. The packaged loop works on a Mac with the CPU prover: 71 s from the tile saying proving to paid on the chain for the smallest shard. The two defects were in the tile's bookkeeping and the child's lifetime, not in the chain rules. The open-shard fallback is what makes a prover without mining weight useful; whether assignees should keep more of the pool is the O-5.1 question, untouched. Nothing here ran on Windows or on a GPU.
diff --git a/docs/plans/proving-v0.md b/docs/plans/proving-v0.md
index 7230bca08..de1eb8763 100644
--- a/docs/plans/proving-v0.md
+++ b/docs/plans/proving-v0.md
@@ -44,7 +44,8 @@ Implemented on the fork branch `proving` (`vendor/igneum-node-proving`, from dev
 | RPCs `igneum_getShardPlan`, `igneum_getProofRecords`, `igneum_submitProofRecord`, `igneum_getAssignedShards`, `igneum_getProvingStatus`; `igneum_exportSegments` carries payouts | Implemented | `igneum/exec/src/rpc.rs` |
 | Payouts in the shard statement (fixture, `ShardInput`, `execute_range`, the guest), the empty-segment plan fix, host modes `compressed` (execute + compressed, statement and proof hash in the results) and `verify` | Implemented; guest rebuilt (new shard vk) | `proving/igneum-prove` |
 | `igneum-miner vmine` (voting producer for PoW-less test networks, with an EVM payout address), `sign-record`, `key-hash` | Implemented | `igneum/miner/src/proving.rs` |
-| The app's prover service: `prove` setting (default off), the loop (work list, export, cut, prove, sign, submit), the Proving tile (assigned, proving, submitted, paid), WSL2 detection and Set up on Windows, CPU on macOS | Implemented; loop logic unit-tested; NOT run end to end inside the app yet | `app/igneum-app/src/prover.rs` |
+| The app's prover service: `prove` setting (default off), the loop (work list, export, cut, prove, sign, submit, open-shard fallback), the Proving tile (assigned, proving, submitted, paid), WSL2 detection and Set up on Windows, CPU on macOS | Implemented; run end to end inside the engine on the Mac with the packaged binaries against the 3-node test network (bench-log, 4 October 2026 afternoon, "the app's prover loop"): proving, submitted, paid in 71 s for the smallest shard; the Windows/WSL2 path has not run | `app/igneum-app/src/prover.rs` |
+| Packaging: the Mac DMG carries the host and the exporter; the Windows payload carries the Linux x86_64 host and exporter (cargo-zigbuild, glibc 2.36, sp1 `cuda` feature, 11 min 18 s on the Mac) under `wsl2/bin/` with the WSL2 scripts and the fixtures | Implemented; dry-run staged; no payload cut (0.3.3 is the coordinator's) | `packaging/mac/build-dmg.sh`, `packaging/windows/make-payload.sh` |
 | 3-node test network on 29800+ at 60x with activation 60 | Implemented, run; see the bench-log entry of 4 October 2026 (afternoon) for what it showed | `tools/proving-v0/run.mjs` |
 
 Decisions the implementation forced, all in spec 7.7: per-shard records instead of the aggregated record of design 5.4 (the aggregated record is the next step); the SP1 proof verified off the consensus path, the native statement being the consensus check; payouts as data in the shard statement beside the rewards; an empty segment is one shard ending at the root after rewards and payouts.