diff --git a/PLAN.md b/PLAN.md
index c66aab4..9cec7d4 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -44,16 +44,16 @@ and exposes connected controllers as HID gamepads.
 - Phase 3 (MT76 chip): register/EFUSE access, firmware load, radio init
   (registers, crystal, MAC/BSSID, channel eval, beacon), pairing mode,
   controller association, GIP handshake + auth. Verified end-to-end on
-  hardware: live controller input is shown in the app (RX data path).
+  hardware: live controller input is shown in the app (RX data path) and
+  rumble TX works from the app's Rumble button.
 - C API + Swift app: async session (fast probe; firmware + radio on a worker
   thread), state display (idle/starting/ready/error), controller list with
   live input monitor, battery level, and a rumble test button.
 
-Host to controller TX over the data path (rumble) is implemented; the dongle
-LED is driven at chip level for pairing and client lifecycle. Phase 3 is
-complete pending hardware confirmation of rumble. Next: Phase 4 (HID) and
-Phase 5 (app polish); exposing the controller as a macOS HID gamepad is the
-main user-visible gap.
+The dongle LED is driven at chip level for pairing and client lifecycle.
+Phase 3 is complete. Next: Phase 4 (virtual HID gamepad) and Phase 5 (app
+polish); exposing the controller as a macOS HID gamepad is the main
+user-visible gap.
 
 ## Directory Layout
 
diff --git a/README.md b/README.md
index 5845563..6d9a295 100644
--- a/README.md
+++ b/README.md
@@ -89,10 +89,10 @@ Strike through or check off as each is resolved.
 - [x] **Frame encapsulation**: Resolved: TX/RX chip headers handled per the
       Linux driver (`send_wlan` / `process_wlan`). Association, pairing, and
       encryption-enable management frames verified against hardware.
-- [ ] **QoS data frames**: RX path verified: controller input QoS frames are
+- [x] **QoS data frames**: RX path verified: controller input QoS frames are
       decrypted, fed to the GIP layer, and shown live in the app. Host to
-      controller TX (rumble) is implemented via the app's Rumble button,
-      pending hardware verification.
+      controller TX (rumble) verified on hardware via the app's Rumble
+      button.
 
 ### 5. AES-CCMP Encryption