diff --git a/.planning/phases/02-users-authentication/02-VALIDATION.md b/.planning/phases/02-users-authentication/02-VALIDATION.md
index 0e2c309..3d16f4c 100644
--- a/.planning/phases/02-users-authentication/02-VALIDATION.md
+++ b/.planning/phases/02-users-authentication/02-VALIDATION.md
@@ -56,6 +56,9 @@ created: 2026-05-31
 | 02-05-T2 | 05 | 5 | ADMIN-01..03 | AdminUsersTab: onMount fetch, deactivate call, empty state | Unit (Vitest) | `cd frontend && npx vitest run src/components/admin/__tests__/AdminUsersTab.test.js` | ✅ | ✅ green |
 | 02-05-T2 | 05 | 5 | ADMIN-04 | AdminQuotasTab: save call, below-usage warning displayed | Unit (Vitest) | `cd frontend && npx vitest run src/components/admin/__tests__/AdminQuotasTab.test.js` | ✅ | ✅ green |
 | 02-05-T2 | 05 | 5 | ADMIN-05 | AdminAiConfigTab: save call, 1.5s Saved confirmation | Unit (Vitest) | `cd frontend && npx vitest run src/components/admin/__tests__/AdminAiConfigTab.test.js` | ✅ | ✅ green |
+| 02-06-T2 | 06 | 1 | SEC-07, AUTH-01 | `requiresAdmin` guard redirects non-admin to `/`; all 4 auth routes carry `meta.layout: 'auth'` | Unit (Vitest) | `cd frontend && npx vitest run src/router/__tests__/router.guard.test.js` | ✅ | ✅ green |
+| 02-06-T3a | 06 | 1 | AUTH-03 | TotpEnrollment renders `<img src="data:image/...">` QR code in verify step; no `otpauth://` link | Unit (Vitest) | `cd frontend && npx vitest run src/components/auth/__tests__/TotpEnrollment.test.js` | ✅ | ✅ green |
+| 02-06-T3b | 06 | 1 | AUTH-03, AUTH-04 | SettingsAccountTab mounts all 4 sections; totp_enabled toggle shows correct 2FA state | Unit (Vitest) | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js` | ✅ | ✅ green |
 
 *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
 
@@ -82,6 +85,16 @@ created: 2026-05-31
 | New test files | 8 |
 | Total tests added | 60 (14 backend + 46 frontend) |
 
+## Validation Audit 2026-06-01
+
+| Metric | Count |
+|--------|-------|
+| Gaps found | 3 (3 MISSING frontend — plan 02-06 not covered in prior audit) |
+| Resolved | 3 |
+| Escalated | 0 |
+| New test files | 3 |
+| Total tests added | 16 (router guard × 10, TotpEnrollment × 2, SettingsAccountTab × 4) |
+
 ---
 
 ## Validation Sign-Off