diff --git a/local/docs/HARDWARE-VALIDATION-MATRIX.md b/local/docs/HARDWARE-VALIDATION-MATRIX.md
index 0e2ef1e11d..9edc9b46c1 100644
--- a/local/docs/HARDWARE-VALIDATION-MATRIX.md
+++ b/local/docs/HARDWARE-VALIDATION-MATRIX.md
@@ -20,7 +20,7 @@
 | xHCI host controller | ✅ | 🔲 | Interrupt-driven mode proven (test-xhci-irq-qemu.sh); 51-flag quirk table + HCCPARAMS2 gating (P2-A/B); 36-code error recovery (P2-C); not HW-validated |
 | EHCI/UHCI/OHCI controllers | 🔲 | 🔲 | Compile clean; runtime enumeration proofs planned (P8-B) |
 | USB storage (BOT) | ✅ | 🔲 | usbscsid autospawn + bounded sector readback proven (test-usb-storage-qemu.sh); guest-side write verify open |
-| USB hub (non-root) | 🔲 | 🔲 | P3-A enumeration core complete (debounce/reset-wait/U0-wait/wHubDelay, 14 unit tests); runtime hub proof pending (P8-B test-usb-hub-qemu.sh) |
+| USB hub (non-root) | ✅ | 🔲 | Hub enumeration chain proven in QEMU (test-usb-hub-qemu.sh): descriptor, EP1 change detection, initial scan, debounce, reset→enable; hub-child device enumeration (kbd→HID) blocked on xhcid TT/debug path |
 | **GPU/Display** | | | |
 | VESA | ✅ | 🔲 | QEMU framebuffer works |
 | virtio-gpu | ✅ | N/A | 2D only, QEMU |
diff --git a/local/docs/USB-IMPLEMENTATION-PLAN.md b/local/docs/USB-IMPLEMENTATION-PLAN.md
index b71b825ae3..e37807389b 100644
--- a/local/docs/USB-IMPLEMENTATION-PLAN.md
+++ b/local/docs/USB-IMPLEMENTATION-PLAN.md
@@ -371,6 +371,27 @@ U1/U2 LPM on hub ports (P7); interrupt-EP usage on USB 3 hubs without one
 **Exit met:** complete hub enumeration including power timing, USB 3 hub
 handling, and TT accumulation.
 
+**Runtime validation (2026-07-19, `test-usb-hub-qemu.sh` on QEMU
+`usb-hub` + `usb-kbd` behind it):** the full usbhubd chain is proven at
+runtime — hub descriptor read (8 ports), EP1 interrupt-driven change
+detection, initial full port scan, connection debounce, port reset with
+completion wait, and port enable all observed in the boot log. The proof
+also surfaced and we fixed five latent bugs: the xhcid scheme refused
+port-dir opens for unenumerated hub children (attach bootstrap
+deadlock), a status-bitmap off-by-one (bit N−1 vs spec's bit N), a
+missing initial scan (daemon could block on EP1 before ever polling),
+an unbounded EP1 wait (state changes during synchronous waits produce
+no new interrupt), and a debounce that could deadlock on a hung
+C_PORT_CONNECTION clear (stability is now judged on connection state,
+with the change bit cleared post-attach). QEMU's hub stalls
+ClearPortFeature on change indicators — handled gracefully by the P2-C
+stall recovery (best-effort, no crash). **Remaining gap:** the hub-child
+device (usb-kbd) reaches `enabled: true` but does not complete
+enumeration to a HID driver — xhcid's hub-child attach path progresses
+only at debug level and needs TT/route investigation with debug
+logging. Also observed: an intermittent xhcid IRQ-reactor startup race
+(one boot showed no reactor start; retry passed).
+
 ### P3-B: Hub interrupt-driven change detection ✅ COMPLETE (verified 2026-07-18)
 
 **Reference:** `linux-7.1/drivers/usb/core/hub.c:1000+` `hub_irq()`.