diff --git a/README.md b/README.md
index bb6016e..5910079 100644
--- a/README.md
+++ b/README.md
@@ -73,14 +73,20 @@ device boundary.
 
 ## Validated on real hardware
 
-As of v0.3 the reference firmware is **measured-validated on an
-ESP32-WROOM-32 dev board** over CH340 USB-Serial at 115 200 baud:
+As of v0.3 the reference firmware is **measured-validated on two
+physical boards** — an ESP32-WROOM-32 dev board over CH340 USB-Serial,
+and an ESP32-S3 (LILYGO T-Panel S3) over the S3's native USB-Serial/JTAG
+— both at 115 200 baud:
 
-- 13/13 round-trip tests pass (`tools/test_uart_roundtrip.py`)
+- 13/13 round-trip tests pass on each board (`tools/test_uart_roundtrip.py`)
 - 88/88 Python unit & conformance tests pass
-- Compiled firmware: 294 KB flash, 22.7 KB globals (Arduino-ESP32 core 3.3.8)
+- Compiled firmware: 294 KB flash, 22.7 KB globals on WROOM-32;
+  322 KB / 22.7 KB on the S3 (Arduino-ESP32 core 3.3.8)
 - The pure DCP layer is approximately 14 KB over a baseline empty
   sketch (measurement script in `docs/paper/figures/`)
+- The S3 run also exercises DCP over a native-USB CDC link rather
+  than a USB-UART bridge chip — same firmware, no transport-specific
+  code
 
 ![Memory footprint: DCP target vs IoT-MCP measured vs Direct MCP vs Matter](docs/paper/figures/footprint.png)
 
@@ -95,12 +101,14 @@ validation does and does not prove.
 
 The reference firmware is portable by design (Arduino `Stream` + a
 software SHA-256, no SoC-specific code paths in `DCP.{h,cpp}`). It
-cross-compiles for every current ESP32 variant *and* for ESP8266,
-with end-to-end UART validation pending boards on the bench:
+cross-compiles for every current ESP32 variant *and* for ESP8266;
+two of those targets are also runtime-validated on real boards, the
+rest are build-validated pending hardware on the bench:
 
 | Target            | ISA                   | Flash (lamp+blink) | Globals  | Status        |
 |-------------------|-----------------------|--------------------|----------|---------------|
 | ESP32-WROOM-32    | Xtensa LX6 (baseline) | 294 KB             | 22.7 KB  | runtime ✓     |
+| ESP32-S3 (T-Panel)| Xtensa LX7            | 322 KB             | 22.7 KB  | runtime ✓ (native USB) |
 | ESP32-C3          | RV32IMC               | 289 KB             | 13.4 KB  | builds ✓      |
 | ESP32-C6          | RV32IMAC + HW-crypto  | 266 KB             | 14.0 KB  | builds ✓      |
 | ESP32-H2          | RV32IMAC + 802.15.4   | 292 KB             | 14.0 KB  | builds ✓      |
@@ -294,7 +302,8 @@ MIT.
 - [x] Conformance test suite (golden frames, language-neutral YAML)
 - [x] Codegen `--stubs`: emits handler signatures + binding table
 - [x] Quickstart video script ([docs/QUICKSTART_VIDEO.md](docs/QUICKSTART_VIDEO.md))
-- [x] Real-hardware UART validation (ESP32-WROOM-32, 13/13 round-trips)
+- [x] Real-hardware validation on two boards (ESP32-WROOM-32 over
+  CH340, ESP32-S3 / T-Panel over native USB), 13/13 round-trips each
 - [x] Cross-compile clean on ESP32 RISC-V family (C3, C6, H2, P4) and ESP8266
 - [x] Public repo at `device-context-protocol/dcp` (v0.3.0 released)
 - [x] PyPI release (`pip install pydcp`)
diff --git a/docs/paper/main.tex b/docs/paper/main.tex
index a1953cb..999d6e0 100644
--- a/docs/paper/main.tex
+++ b/docs/paper/main.tex
@@ -465,22 +465,25 @@ \subsection{ESP32 reference firmware}
 thirteen round-trip cases (\texttt{tools/test\_uart\_roundtrip.py}) covering
 calls, reads, dry-run, range rejection, unknown-intent error frames, and a
 non-idempotent intent with a \texttt{duration} parameter that exercises
-the firmware-side CBOR float decode path. All thirteen cases pass against
-real hardware.
+the firmware-side CBOR float decode path. All thirteen cases pass on two
+physical boards: an ESP32-WROOM-32 over a CH340 USB-UART bridge, and an
+ESP32-S3 (LILYGO T-Panel S3) over the S3's native USB-Serial/JTAG
+interface. The latter exercises DCP over a native-USB CDC link with no
+USB-UART bridge chip and no transport-specific firmware changes.
 
 \paragraph{Portability across the ESP family.} The same
 \texttt{firmware/esp32/} library compiles unchanged across the
 current ESP32 family --- C3 (RV32IMC, 289\,KB / 13.4\,KB), C6
 (RV32IMAC, 266\,KB / 14.0\,KB), H2 (RV32IMAC + 802.15.4, 292\,KB /
-14.0\,KB), and P4 (RV32IMAFC dual-core, 326\,KB / 22.0\,KB) --- and
-additionally on the legacy ESP8266 NodeMCU (Xtensa LX106, 242\,KB /
-28.9\,KB), where the lamp example sketch picks the PWM API at
-compile time (\texttt{ledcAttach}/\texttt{ledcWrite} on ESP32,
-\texttt{analogWrite} on ESP8266) while the protocol layer itself
-remains \texttt{\#ifdef}-free. End-to-end UART validation on these
-non-Xtensa-LX6 targets is pending bench availability, but the build
-artefacts confirm the portability claim beyond the single target on
-which the runtime was measured.
+14.0\,KB), P4 (RV32IMAFC dual-core, 326\,KB / 22.0\,KB), and S3
+(Xtensa LX7, 322\,KB / 22.7\,KB) --- and additionally on the legacy
+ESP8266 NodeMCU (Xtensa LX106, 242\,KB / 28.9\,KB), where the lamp
+example sketch picks the PWM API at compile time
+(\texttt{ledcAttach}/\texttt{ledcWrite} on ESP32, \texttt{analogWrite}
+on ESP8266) while the protocol layer itself remains
+\texttt{\#ifdef}-free. Of these, the WROOM-32 and S3 targets are
+runtime-validated as described above; the remaining targets are
+build-validated, with bench validation pending hardware availability.
 
 \subsection{Conformance suite}