diff --git a/docs/specs/2026-08-17-radio1-5ghz6ghz-ap.md b/docs/specs/2026-08-17-radio1-5ghz6ghz-ap.md
index dbe8fd4..1b869c7 100644
--- a/docs/specs/2026-08-17-radio1-5ghz6ghz-ap.md
+++ b/docs/specs/2026-08-17-radio1-5ghz6ghz-ap.md
@@ -1,7 +1,7 @@
 # Radio1 5GHz/6GHz Rogue AP — Design Record
 
 - **Date:** 2026-08-17
-- **Status:** Implemented (Tasks 1–4), on-device verification pending
+- **Status:** Implemented and verified on-device (see §9)
 - **Owner:** Hak5 WiFi Pineapple Pager expansion project
 - **Scope:** Mark VIII WebUI (`http://172.16.52.1:8080/`) running a rogue AP on
   the Pager's second radio (`radio1` = MT7921U Wi-Fi 6E) on 5GHz and 6GHz, with
@@ -181,11 +181,37 @@ AP is enabled:
 
 ## 9. On-device verification
 
-On-device verification is **pending** (Task 5 of the implementation plan,
-deferred until it can be run against the user's Pager at `172.16.52.1` without
-colliding with other agents' deployed builds). Planned checks: 2.4GHz behavior
-unchanged (`wlan0open`/`radio0`/`wlan1mon` untouched), 5GHz Evil WPA
-(WPA3-SAE) bringing up `wlan1wpa` with `hop='0'`, stock Pager UI toggles
-continuing to work, 5GHz handshake capture, reboot persistence, disable path
-restoring hopping, and 5GHz Open AP. Results will be recorded here once
-complete.
+Run against the user's Pager at `172.16.52.1` (Pineapple Pager 24.10.1). All
+checks passed:
+
+- **2.4GHz unchanged:** Open AP save (channel 1) leaves `wlan0open`/`radio0`
+  intact and `pineapd.wlan1mon` untouched (`bands=2,5,6`, `hop=1`).
+- **5GHz Evil WPA (WPA3-SAE, channel 36, VHT80):** `radio1.band=5g`,
+  `channel=36`, `htmode=VHT80`; `wlan1wpa` (netdev named `wlan1wpa` via
+  `option ifname`) comes up beaconing `Test5G` / WPA3 SAE (CCMP);
+  `pineapd.wlan1mon.hop=0`. `get_ap` reports `wpa.enabled=true` (after the
+  `disabled=0` fix).
+- **Stock Pager UI coexistence:** the stock daemon's own `set_ap` (what the
+  pager UI uses to change the 2.4GHz Evil WPA) tears down the radio1 AP
+  netdev; the `wlan1wpa` UCI section survives and `get_ap` self-heals it with a
+  `wifi reload` (`/sys/class/net/<iface>` missing check). Under rapid reload
+  churn the `mt7921u` driver can transiently return EBUSY; a later reload
+  succeeds. The pager UI itself is unaffected.
+- **Handshake capture:** `Examine` on channel 36 returns success; handshake
+  logging (`loghandshake`/`logpartialhandshake`) confirmed on. A live WPA
+  handshake file requires a physical client (not exercised).
+- **Reboot persistence:** `wlan1wpa` UCI, `disabled=0`, `hop=0`, the procd
+  Mark VIII service, and the AP itself all survive reboot.
+- **Disable path:** removing the 5GHz AP deletes `wlan1wpa`, resets
+  `radio1.channel=auto`/`band=5g`, restores `hop=1`; `wlan1mon` hopping
+  resumes (observed 6GHz ch13 → ch221 in 30s).
+- **5GHz Open AP:** `wlan1open` (channel 44, open) brings up `Test5GOpen`
+  with `hop=0`.
+- **6GHz AP:** `radio1.band=6g`, `htmode=HE80`, WPA3 SAE on channel 181
+  (6.855 GHz) comes up.
+- **Cleanup:** disable restores the 2.4GHz baseline (`pager-open`, channel 1,
+  `hop=1`).
+
+Known follow-ups: the Clients tab lists only `wlan0*` interfaces, so 5GHz AP
+clients are not yet shown; live-client handshake capture is untested without a
+physical client.