diff --git a/README.md b/README.md
index f247c7f8..d3633eec 100644
--- a/README.md
+++ b/README.md
@@ -94,9 +94,13 @@ python firmware/esp32-csi-node/provision.py --port COM9 \
 cd firmware/esp32-csi-node
 idf.py set-target esp32c6 && idf.py build
 idf.py -p COM6 flash
-# C6 boot extras (vs S3):  HE-LTF subcarrier tagging in ADR-018 bytes 18-19,
+# C6 boot extras (vs S3): HE-LTF subcarrier tagging in ADR-018 bytes 18-19,
 #   802.15.4 mesh time-sync on channel 15, TWT setup when the AP supports it,
 #   opt-in LP-core wake-on-motion for ~5 µA battery seed nodes.
+# v0.6.7 adds: real LP-core RISC-V motion-gate program (debounce + motion
+#   counter) and a Wi-Fi 6 soft-AP with TWT Responder so two C6 boards can
+#   benchmark real iTWT without buying an 11ax router. Both default off,
+#   flip CONFIG_C6_{LP_CORE,SOFTAP_HE}_ENABLE to turn them on.
 
 # Option 3: Full system with Cognitum Seed ($140)
 # ESP32 streams CSI → bridge forwards to Seed for persistent storage + kNN + witness chain
@@ -114,7 +118,7 @@ node scripts/mincut-person-counter.js --port 5006  # Correct person counting
 > |--------|----------|------|----------|-------------|
 > | **ESP32 + Cognitum Seed** (recommended) | ESP32-S3 + [Cognitum Seed](https://cognitum.one) | ~$140 | Yes | Presence, motion, breathing, heart rate, fall detection, multi-person counting, 17-keypoint pose (signed Cog binary), 105-cog catalog, persistent vector store, kNN search, witness chain, MCP proxy |
 > | **ESP32 Mesh** | 3-6× ESP32-S3 + WiFi router | ~$54 | Yes | Same capabilities as above without the persistent-memory features |
-> | **ESP32-C6 research node** ([ADR-110](docs/adr/ADR-110-esp32-c6-firmware-extension.md), [witness](docs/WITNESS-LOG-110.md), [reviewer guide](docs/ADR-110-REVIEW-GUIDE.md)) | ESP32-C6-DevKit ($6–10) | ~$10 | Yes (Wi-Fi 6 capable) | Same CSI pipeline as S3 with the dual-target firmware. **Wire format ready** for HE-LTF PPDU tagging in ADR-018 bytes 18-19 (firmware encoder + Rust + Python decoders verified end-to-end in 17 unit tests), ESP-NOW cross-node sync (4102 tx 0 fail cumulative across 120 s + 300 s soaks), and TWT graceful-NACK fallback (live exercised). **Hardware-gated**: HE-LTF live subcarrier capture needs an 11ax AP; ~5 µA LP-core hibernation needs an INA meter to measure; 802.15.4 RX is broken in IDF v5.4 (workaround: ESP-NOW transport for cross-node sync). See witness log for the empirical / claimed split. |
+> | **ESP32-C6 research node** ([ADR-110](docs/adr/ADR-110-esp32-c6-firmware-extension.md), [witness](docs/WITNESS-LOG-110.md), [reviewer guide](docs/ADR-110-REVIEW-GUIDE.md), [firmware v0.6.7](https://github.com/ruvnet/RuView/releases/tag/v0.6.7-esp32)) | ESP32-C6-DevKit ($6–10) | ~$10 | Yes (Wi-Fi 6 capable) | Same CSI pipeline as S3 with the dual-target firmware. **Wire format ready** for HE-LTF PPDU tagging in ADR-018 bytes 18-19 (firmware encoder + Rust + Python decoders verified end-to-end in 17 unit tests), ESP-NOW cross-node sync (4102 tx 0 fail cumulative across 120 s + 300 s soaks), and TWT graceful-NACK fallback (live exercised). **v0.6.7 adds** a real LP-core motion-gate RISC-V program (B4 code path) and a Wi-Fi 6 soft-AP with TWT Responder for two-board iTWT benches (B1/B2 unblock, no 11ax router required). **Hardware-gated for measurement**: HE-LTF live subcarrier capture needs the soft-AP bench or an 11ax AP; ~5 µA LP-core hibernation needs an INA meter to capture; 802.15.4 raw RX is broken in IDF v5.4 (workaround: ESP-NOW transport, shipped). See witness log for the empirical / claimed split. |
 > | **Research NIC** | Intel 5300 / Atheros AR9580 | ~$50-100 | Yes | Full CSI with 3x3 MIMO |
 > | **Any WiFi** | Windows, macOS, or Linux laptop | $0 | No | RSSI-only: coarse presence and motion (see [tutorial #36](https://github.com/ruvnet/RuView/issues/36)) |
 >
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 5161a9a2..8a1a61af 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -1118,7 +1118,8 @@ Pre-built binaries are available at [Releases](https://github.com/ruvnet/RuView/
 
 | Release | What It Includes | Tag |
 |---------|-----------------|-----|
-| [v0.5.0](https://github.com/ruvnet/RuView/releases/tag/v0.5.0-esp32) | **Stable (recommended)** — mmWave sensor fusion (MR60BHA2/LD2410 auto-detect), 48-byte fused vitals, all v0.4.3.1 fixes | `v0.5.0-esp32` |
+| [v0.6.7](https://github.com/ruvnet/RuView/releases/tag/v0.6.7-esp32) | **Latest** — real LP-core motion-gate RISC-V program (B4 code path complete) + Wi-Fi 6 soft-AP with TWT Responder for two-board iTWT benches (B1/B2 unblock), no router required. Both default off — no behavior change for v0.6.6 fleets ([ADR-110 P9](adr/ADR-110-esp32-c6-firmware-extension.md)) | `v0.6.7-esp32` |
+| [v0.5.0](https://github.com/ruvnet/RuView/releases/tag/v0.5.0-esp32) | **Stable (S3 mesh, recommended)** — mmWave sensor fusion (MR60BHA2/LD2410 auto-detect), 48-byte fused vitals, all v0.4.3.1 fixes | `v0.5.0-esp32` |
 | [v0.4.3.1](https://github.com/ruvnet/RuView/releases/tag/v0.4.3.1-esp32) | Fall detection fix ([#263](https://github.com/ruvnet/RuView/issues/263)), 4MB flash ([#265](https://github.com/ruvnet/RuView/issues/265)), watchdog fix ([#266](https://github.com/ruvnet/RuView/issues/266)) | `v0.4.3.1-esp32` |
 | [v0.4.1](https://github.com/ruvnet/RuView/releases/tag/v0.4.1-esp32) | CSI build fix, compile guard, AMOLED display, edge intelligence ([ADR-057](../docs/adr/ADR-057-firmware-csi-build-guard.md)) | `v0.4.1-esp32` |
 | [v0.3.0-alpha](https://github.com/ruvnet/RuView/releases/tag/v0.3.0-alpha-esp32) | Alpha — adds on-device edge intelligence (ADR-039) | `v0.3.0-alpha-esp32` |
@@ -1189,7 +1190,7 @@ python provision.py --port COM6 --ssid "YourWiFi" --password "secret" --target-i
 **Verifying the C6 modules came up** — `idf.py -p COM6 monitor` should show:
 
 ```
-I (353) main: ESP32-C6 CSI Node (ADR-018 / ADR-110) — v0.6.6 — Node ID: 1
+I (353) main: ESP32-C6 CSI Node (ADR-018 / ADR-110) — v0.6.7 — Node ID: 1
 I (413) c6_ts: init done: channel=15 EUI=<your-EUI64> leader=yes(candidate)
 I (463) wifi: mac_version:HAL_MAC_ESP32AX_761      ← 802.11ax MAC firmware loaded
 ```
@@ -1200,17 +1201,57 @@ The `c6_ts: init done` line confirms the 802.15.4 stack is up; if TWT succeeds y
 
 Flash two or more C6 boards, leave them on the same 802.15.4 channel (default 15). One will elect itself leader (lowest EUI-64) and broadcast `TS_BEACON` frames every 100 ms; the others compute and apply offsets. Each CSI frame from a follower carries a `c6_timesync_get_epoch_us()` wall-clock estimate aligned to within ±100 µs of the leader's monotonic time. Target use case: ADR-029/030 multistatic fusion without burning WiFi airtime on coordination.
 
-**Battery seed-node mode:**
+**Battery seed-node mode (v0.6.7 — real LP-core program):**
 
 ```bash
 # Enable LP-core hibernation in menuconfig:
 #   ESP32-C6 capabilities (ADR-110) → Enable LP-core wake-on-motion hibernation
 #   → LP-core wake GPIO (default 4 — connect a PIR or accelerometer INT line here)
+#   → LP-core poll period (default 10 ms)
+#   → LP-core debounce sample count (default 3 consecutive matches)
 idf.py menuconfig
 idf.py build flash
 ```
 
-When enabled, the C6 boots, takes one CSI burst, then enters deep sleep with the LP-core armed. Target standby current ~5 µA.
+When enabled, the C6 LP RISC-V coprocessor runs a real polling program
+(`firmware/esp32-csi-node/main/lp_core/main.c`) that polls the wake GPIO at
+the configured cadence, debounces N consecutive matching reads, and wakes the
+HP core via `ulp_lp_core_wakeup_main_processor()`. `esp_sleep_get_wakeup_cause()`
+returns `ESP_SLEEP_WAKEUP_ULP`, and `c6_lp_core_motion_count()` /
+`c6_lp_core_poll_count()` expose the LP-side counters for the witness harness.
+Target standby current ~5 µA (datasheet; pending INA measurement).
+
+**Two-board iTWT bench (v0.6.7 — soft-AP HE/TWT, no router required):**
+
+Pair two C6 boards — one acts as the iTWT-capable AP, the other as the STA
+that negotiates and benchmarks the TWT agreement.
+
+```bash
+# Board #1 (AP role): append to sdkconfig.defaults.esp32c6:
+CONFIG_C6_SOFTAP_HE_ENABLE=y
+CONFIG_C6_SOFTAP_HE_SSID="ruview-c6-twt"
+CONFIG_C6_SOFTAP_HE_PSK="ruviewtwt"
+CONFIG_C6_SOFTAP_HE_CHANNEL=6
+
+idf.py set-target esp32c6 && idf.py build && idf.py -p COM6 flash
+```
+
+Board #1 boots in `WIFI_MODE_APSTA`, advertising HE capabilities and TWT
+Responder=1 on channel 6. Board #2 provisions to associate with that SSID:
+
+```bash
+python firmware/esp32-csi-node/provision.py --port COM9 \
+  --ssid "ruview-c6-twt" --password "ruviewtwt" --target-ip 192.168.1.20
+```
+
+Board #2 runs the existing `c6_twt_setup_default()` on connect and now
+negotiates a real iTWT agreement against the cooperative AP — the
+`iTWT setup queued: wake_interval=10000 µs` log line should be followed by an
+`iTWT setup event received from AP` instead of the `INVALID_ARG` graceful
+fallback that fired against the bench's 11n-only `ruv.net` AP.
+
+NVS overrides for AP role (namespace `ruview`): `softap_ssid`, `softap_psk`,
+`softap_chan` — provision once and the values survive firmware updates.
 
 **What's NOT on the C6 build** (vs S3 production): no AMOLED display (ADR-045 needs 8 MB + LCD touch driver), no WASM3 (ADR-040 needs PSRAM), no Seeed mmWave fusion (separate board). The C6 is a research/seed target, not a drop-in replacement for the S3 production node.