diff --git a/.planning/phases/01-foundation-broker-spike/01-HUMAN-UAT.md b/.planning/phases/01-foundation-broker-spike/01-HUMAN-UAT.md
index 7bdcfab..6563c23 100644
--- a/.planning/phases/01-foundation-broker-spike/01-HUMAN-UAT.md
+++ b/.planning/phases/01-foundation-broker-spike/01-HUMAN-UAT.md
@@ -27,14 +27,14 @@ result: [pending]
 
 ### 4. SSE-over-Pangolin smoke test (de-risks Phase 4)
 expected: With a valid session cookie, `curl -N -H "Cookie: oidc-auth=<value>" https://familysync.<domain>/api/sse/heartbeat` streams a `heartbeat` event roughly every 10s and stays open for 5+ minutes without Pangolin cutting the stream. PASS = continuous heartbeats; FAIL = stream cut early (investigate Pangolin idle-timeout; note as Phase 4 constraint, ref issue #1034).
-result: [pending]
+result: PASS (2026-06-08) — GET /api/sse/heartbeat over familysync-dev.bergerhouse.net (Pangolin→Newt→api) with a valid session cookie held open ~6 min (01:37:53Z→01:43:54Z), 35 heartbeat events id 0→34 at ~10s cadence; response bytes grew 71→2535 (incremental delivery → Pangolin buffering OFF); no early cut. Phase 4 entry gate (D-14 / issue #1034) CLEARED. Caveat: proves no idle-timeout/buffering over ~6 min, not the absence of a max total connection-duration cap — residual risk covered by Phase 4 design (D-10/D-11/D-12 in 04-CONTEXT.md).
 
 ## Summary
 
 total: 4
-passed: 0
+passed: 1
 issues: 0
-pending: 4
+pending: 3
 skipped: 0
 blocked: 0
 
diff --git a/.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md b/.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
index 12e3ea8..6db979e 100644
--- a/.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
+++ b/.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
@@ -153,7 +153,7 @@ Mark each row PASS or FAIL and add notes. On failure, apply the indicated remedy
 
 | # | Ref | Check | Result | Notes |
 |---|-----|-------|--------|-------|
-| C1 | SSE | Hold stream open 5+ min without it being cut (see curl command below) | [ ] PENDING — operator | |
+| C1 | SSE | Hold stream open 5+ min without it being cut (see curl command below) | ✅ PASS (2026-06-08) | Held GET /api/sse/heartbeat open ~6 min over familysync-dev.bergerhouse.net (Pangolin→Newt→api) with a valid session cookie (01:37:53Z→01:43:54Z); 35 heartbeat events id 0→34 at ~10s cadence; response bytes grew 71→2535 (incremental → Pangolin buffering OFF); no early cut. Phase 4 entry gate (D-14 / issue #1034) CLEARED. Caveat: proves no idle-timeout/buffering over ~6 min, not the absence of a max total connection-duration cap — residual risk covered by Phase 4 design (D-10/D-11/D-12 in 04-CONTEXT.md). |
 
 ```bash
 # Get the session cookie from browser DevTools → Application → Cookies (oidc-auth=<value>)
@@ -195,7 +195,7 @@ Response body: {"ok":true,"db":"up"}
 | Operator infra setup | ✅ DONE (Authelia client + Pangolin/Newt live; OIDC login working) |
 | A — Auth / session / colors | ✅ A1, A2 (transparent SSO), A3 all PASS |
 | B — iOS standalone login (load-bearing) | ✅ B1–B4 PASS (install + standalone launch + standalone login); B5 (Android) deferred |
-| C — SSE smoke test | ⏳ DEFERRED — Phase 4 ENTRY gate (D-14), not a Phase 3 deliverable |
+| C — SSE smoke test | ✅ PASS (2026-06-08) — Phase 4 ENTRY gate (D-14 / issue #1034) CLEARED; held ~6 min, 35 heartbeats, incremental delivery, no proxy cut |
 | D — Fastmail write round-trips | ✅ D1–D6 PASS (create/all-day/recurring/edit/delete/conflict); recurring-series delete also verified |
 
 Gate 2 is complete when all rows are PASS. Record final status here: