diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index 4151089..f3bac5f 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -65,3 +65,11 @@ MCP device bridge (Phase 10), benchmark suite (Phase 15), GPU command scripts (P
 ## Files to read next
 
 `project.md` (requirements) → `plan.md` (status/evidence) → `docs/engineering-log/` (dated decisions) → `app/config.py` (every knob).
+
+## Phase 1.6 — Live device path verified (2026-10-03)
+- Push infra fixed: `b00312c` + `e91d185` pushed to origin/main (Cloudflare issue cleared).
+- `uvicorn app.main:app` now loads config.yaml (module-level `app`); bind `0.0.0.0:8766`.
+- Live handshake VERIFIED via `wss://zhi.moreminimore.com/ws/xiaozhi`: hello→hello OK, device `xiaozhi-main` auth accepted.
+- Root cause of earlier auth rejections: stale server process (pre-config-fix code) holding port 8766.
+- Device token documented above; ESP32 device (muma) flashed to xiaozhi v2.5.0 factory bin via esptool (COM3, backup kept).
+- Next: point device OTA at `wss://zhi.moreminimore.com/ws/xiaozhi`, verify real firmware handshake (CON-004).
diff --git a/plan.md b/plan.md
index 8878a82..95f8b8e 100644
--- a/plan.md
+++ b/plan.md
@@ -57,3 +57,8 @@ imports that activate only on the voice-server.
 - Known bug found+fixed in review: `_SENT_END` originally split on Thai vowel marks (U+0E40/41/48) — would break every word; now ASCII punctuation + ฯ (U+0E3F) only.
 
 Status: **Phase 1 complete** — testable skeleton green. Next (voice-server): real STT/TTS/Opus backends, firmware protocol verification (CON-004), Cloudflare tunnel.
+
+## Phase 1.6 (2026-10-03)
+- Push fixed (Cloudflare cleared): b00312c + e91d185 on origin/main.
+- Module-level app + 0.0.0.0 bind; live wss://zhi.moreminimore.com handshake OK.
+- Device flashed (xiaozhi v2.5.0), COM3. OTA config → device next.