diff --git a/PLAN.md b/PLAN.md
index 5480d0b..b182536 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -10,44 +10,59 @@ is still open. For the full requirements, see [SPEC.md](SPEC.md).
       cross-platform build matrix (linux/darwin/windows x amd64/arm64) that
       attaches binaries to GitHub Releases on version tags.
 - [x] `install.sh` for Linux/macOS/WSL, downloading the latest release
-      asset.
+      asset, with clear diagnostics if no release exists yet or the GitHub
+      API is unreachable.
 - [x] `README.md`, `config.example.yaml`.
 
 ## Phase 1 — Core logic + navigation (done, initial version)
 
 - [x] `internal/kctl`: pure, unit-tested logic —
-      context-pair matching (`FindNextContext`) and namespace/label
-      filtering (`DistinctLabelValues`, `NamespacesForLabelValue`).
+      context-pair matching (`FindNextContext`), namespace/label filtering
+      (`DistinctLabelValues`, `NamespacesForLabelValue`), and secret diffing
+      (`DiffSecretValues`, `AnyMismatch`).
 - [x] `internal/config`: YAML config loading (`context_pairs`,
       `team_label_key`), with safe defaults when no config file exists yet.
 - [x] `internal/kubeexec`: thin wrappers around `kubectl`/`aws` CLI calls
-      (contexts, namespaces, deployments, rollout restart/status, secret
-      read, ExternalSecret annotation).
+      (contexts, namespaces, deployments, rollout restart/status, listing
+      AWS secrets, reading all fields of a Kubernetes secret, ExternalSecret
+      annotation).
 - [x] `cmd/kctl-tui` "full" mode: Bubble Tea navigation for
       context -> team -> namespace, with `Esc` correctly popping back one
       level at a time, defaults pre-selected from the currently active
       context/namespace.
 - [x] On confirming a namespace, "full" mode launches the 3-pane `tmux`
-      session (control pane + two `k9s` panes) via `tea.ExecProcess` and
-      resumes at the namespace screen once the session ends.
-- [x] `cmd/kctl-tui` "panel" mode: menu for Redeploy and the AWS/Kubernetes
-      secrets diff + force-sync wizard, with `Esc` closing the whole tmux
-      session (`tmux kill-session`).
+      session (control pane + two `k9s` panes, `even-vertical` layout,
+      `remain-on-exit` so a crashing control pane stays visible) via
+      `tea.ExecProcess` and resumes at the namespace screen once the
+      session ends.
+- [x] `cmd/kctl-tui` "panel" mode:
+      - Redeploy: pick a deployment from a list, confirm, then
+        `rollout restart` + `rollout status`.
+      - Secrets: pick an AWS region, then pick the actual secret from a
+        **list of all AWS Secrets Manager secrets** in that region (no more
+        manual secret-ID typing), enter the matching Kubernetes secret
+        name, and automatically diff **every field** of both secrets in one
+        table (key / AWS value / Kubernetes value / match status). If any
+        field differs, offer a single force-sync request for the **whole
+        secret** (one ExternalSecret annotation), not per individual field.
+      - `Esc` closes the whole tmux session (`tmux kill-session`).
 
 ## Phase 2 — Hardening (open)
 
-- [ ] Replace the hand-rolled AWS secret JSON parsing/`fmt.Sprintf` value
-      formatting with a proper typed decode, and handle secrets that are
-      plain strings rather than JSON.
+- [ ] Handle non-JSON AWS secrets and Kubernetes secrets with binary
+      (non-UTF8) values more gracefully in the diff table (currently
+      falls back to a single "value" key or may render oddly).
 - [ ] Add integration-style tests against a local `kind`/`k3d` cluster in
       CI for the `kubeexec` wrappers currently excluded from automated
       testing.
 - [ ] Input validation for the free-text steps in "panel" mode (empty
-      secret ID/region/name, invalid characters).
+      region/secret name, invalid characters).
 - [ ] Graceful handling when `tmux`, `k9s`, or `aws` are not installed
       (currently surfaces the raw exec error).
 - [ ] Structured logging / `--verbose` flag for troubleshooting failed
-      `kubectl` calls.
+      `kubectl`/`aws` calls.
+- [ ] Paginate/scroll the secrets diff table for secrets with many fields
+      instead of relying on terminal wrapping.
 
 ## Phase 3 — Windows-native support (open, secondary priority)
 
@@ -67,6 +82,9 @@ is still open. For the full requirements, see [SPEC.md](SPEC.md).
       kubeconfig.
 - [ ] Homebrew tap / `scoop` manifest as additional install options
       alongside `install.sh`.
+- [ ] Optional heuristic to suggest a matching Kubernetes secret name for
+      a chosen AWS secret (e.g. by common naming convention), instead of
+      always asking for it manually.
 
 ## Notes for contributors