docs: mark rumble TX as implemented

Update PLAN.md and README.md current status: host to controller TX
(rumble) is implemented and pending hardware confirmation; the dongle
LED is driven at chip level, so no data path LED work remains.

Co-Authored-By: qwen3.8-27b@q3_k_xl: updated status docs

README.md

@@ -91,7 +91,8 @@ Strike through or check off as each is resolved.
       encryption-enable management frames verified against hardware.
 - [ ] **QoS data frames**: RX path verified: controller input QoS frames are
       decrypted, fed to the GIP layer, and shown live in the app. Host to
-      controller TX (rumble, LED over the data path) is not implemented yet.
+      controller TX (rumble) is implemented via the app's Rumble button,
+      pending hardware verification.
 
 ### 5. AES-CCMP Encryption
 
@@ -191,9 +192,9 @@ Working end-to-end on hardware:
 - EFUSE read, radio init, channel evaluation, beacon TX
 - Pairing mode, controller association, GIP handshake + auth
 - Live controller input (buttons, sticks, triggers) in the Swift app
+- Rumble test button (host to controller TX over the GIP data path)
 
-Not done yet: host to controller TX over the data path (rumble, LED),
-virtual HID gamepad (Phase 4), headset audio (Phase 5).
+Not done yet: virtual HID gamepad (Phase 4), headset audio (Phase 5).
 
 `xone_cli` exercises the stack manually in a single dongle session: