diff --git a/.planning/STATE.md b/.planning/STATE.md
index adcf800..e2b293e 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -2,10 +2,10 @@
 gsd_state_version: 1.0
 milestone: v1.1
 milestone_name: Hardening & Validation
-status: in-progress — plan 10-02 advanced; RTVAL-01 PASS, RTVAL-02 PASS (attestation-only, no artifact); paused at Task 3 (RTVAL-03 detection rule)
-stopped_at: 10-02-live-intune-runtime-validation-PLAN.md — Task 3 (RTVAL-03) human-action checkpoint awaiting technician on-device install evidence
+status: in-progress — plan 10-02 advanced; RTVAL-01 PASS, RTVAL-02 PASS (attestation-only), RTVAL-03 PASS (attestation-only — 2nd consecutive); paused at Task 4 (RTVAL-04 uninstall under SYSTEM)
+stopped_at: 10-02-live-intune-runtime-validation-PLAN.md — Task 4 (RTVAL-04) human-action checkpoint awaiting technician uninstall evidence
 last_updated: "2026-04-13T00:00:00.000Z"
-last_activity: 2026-04-13 — RTVAL-02 recorded PASS (attestation-only, no artifact; user approved proceeding without evidence); plan 10-02 paused at Task 3 (RTVAL-03)
+last_activity: 2026-04-13 — RTVAL-03 recorded PASS (attestation-only, 2nd consecutive; user warned about weakened audit trail and approved); plan 10-02 paused at Task 4 (RTVAL-04)
 progress:
   total_phases: 4
   completed_phases: 1
@@ -26,10 +26,10 @@ See: .planning/PROJECT.md (updated 2026-04-13 after v1.0 milestone)
 
 Milestone: v1.1 Hardening & Validation
 Phase: 10 — Real-World Runtime Validation
-Plan: 02 in progress — Task 1 PASS (RTVAL-01), Task 2 PASS (RTVAL-02, attestation-only); paused at Task 3 (RTVAL-03) human-action checkpoint
-Status: in-progress — awaiting technician evidence for RTVAL-03 (detection rule reports Installed)
-Decision: Resume plan 10-02 after HMAC scope + Detection.xml generator fixes landed (commits 74535ea, 7716246); ISSUE-01 resolved. RTVAL-02 accepted as attestation-only PASS per explicit user approval 2026-04-13.
-Last activity: 2026-04-13 — RTVAL-02 PASS (attestation, commit 870158b); plan 10-02 paused at Task 3 checkpoint
+Plan: 02 in progress — Task 1 PASS (RTVAL-01), Task 2 PASS (RTVAL-02, attestation-only), Task 3 PASS (RTVAL-03, attestation-only — 2nd consecutive); paused at Task 4 (RTVAL-04) human-action checkpoint
+Status: in-progress — awaiting technician evidence for RTVAL-04 (Intune uninstall removes printer cleanly under SYSTEM)
+Decision: Resume plan 10-02 after HMAC scope + Detection.xml generator fixes landed (commits 74535ea, 7716246); ISSUE-01 resolved. RTVAL-02 and RTVAL-03 both accepted as attestation-only PASSes per explicit user approval 2026-04-13; user was warned on RTVAL-03 that a second consecutive attestation-only check weakens the audit trail and still chose to proceed.
+Last activity: 2026-04-13 — RTVAL-03 PASS (attestation-only, commit 475d593); plan 10-02 paused at Task 4 checkpoint
 
 ## Milestone History
 
@@ -71,6 +71,7 @@ Full decision log in PROJECT.md Key Decisions table. Milestone v1.0 decisions ar
 - [Phase 10-real-world-runtime-validation]: 10-02: RTVAL-01 FAIL — Stop plan 10-02; surface .intunewin structure defect as gap; use /gsd:debug on generator or /gsd:plan-phase 10 --gaps before retesting
 - [Phase 10-real-world-runtime-validation]: 10-02: RTVAL-01 PASS on re-test (2026-04-13) — ISSUE-01 resolved by commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format); plan resumed at Task 2
 - [Phase 10-real-world-runtime-validation]: 10-02: RTVAL-02 accepted as attestation-only PASS (2026-04-13) — technician verbally confirmed install succeeded on ARES-5CG5220YTM but did NOT provide IntuneManagementExtension.log excerpt or portal screenshot; user explicitly approved "Pass without evidence"; audit trail weakened for this check and flagged in RUNTIME-VALIDATION.md Notes
+- [Phase 10-real-world-runtime-validation]: 10-02: RTVAL-03 accepted as attestation-only PASS (2026-04-13) — second consecutive attestation-only check; no rtval-03-detection.png and no rtval-03-detect-manual.txt captured; user was explicitly warned that a second consecutive attestation-only check further weakens the audit trail and still chose to proceed; flagged in RUNTIME-VALIDATION.md Notes as soft PASS requiring re-run with full artifact capture before phase sign-off
 
 ### Active Blockers
 
@@ -85,5 +86,5 @@ None. BLOCKER-01 resolved 2026-04-13 via commits 74535ea (HMAC over IV+ciphertex
 ## Session Continuity
 
 Last session: 2026-04-13T00:00:00.000Z
-Stopped at: 10-02-live-intune-runtime-validation — Task 3 (RTVAL-03) human-action checkpoint; awaiting technician evidence for detection rule (Intune "Installed" + manual detect script exit 0 + printer visible)
+Stopped at: 10-02-live-intune-runtime-validation — Task 4 (RTVAL-04) human-action checkpoint; awaiting technician evidence for uninstall under SYSTEM (uninstall log SYSTEM context + exit 0, printer removed via Get-Printer, Intune portal "Not installed", uninstall status screenshot)
 Resume file: .planning/phases/10-real-world-runtime-validation/10-02-live-intune-runtime-validation-PLAN.md