test(19.5): record gap-closure UAT results

.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md

@@ -3,7 +3,7 @@ status: testing
 phase: 19.5-social-login-in-sm-user-plugin
 source: [19.5-VERIFICATION.md]
 started: 2026-10-21T00:24:54.347Z
-updated: 2026-10-21T00:24:54.347Z
+updated: 2026-10-21T13:00:00.000Z
 ---
 
 ## Current Test
@@ -18,7 +18,9 @@ awaiting: user response
 
 ### 1. Decide on the residual pre-account-takeover path left open by the T-19.5-38 fix. ownerVerifiedEmail treats has_self_set_password=true as proof the owner controls the address, but POST /register with golem15.user activation.activate_mode=auto (the default) creates an activated account with has_self_set_password=true and no email check. An attacker who registers victim@example.com with a password before the victim's first Google/GitHub sign-in gets the victim's verified identity auto-linked onto the attacker's account, and keeps password access.
 expected: Either accept it explicitly (it is exactly PHP's D-10 behaviour, and the variant T-19.5-38 closed was the social-created one), or schedule a follow-up (for example: auto-link only when the account was activated by mail or set its password through the reset code, or require activate_mode=user for apps mounting sociallogin). Also correct 19.5-SECURITY-REVIEW.md / README wording that a self-set password means the owner 'proved the address'.
-result: [pending]
+result: pass
+reported: "(a) Tighten auto-link" (Column in sm-user-plugin; chosen 2026-10-21 during /msd-plan-phase 19.5 --gaps)
+retested_by: 19.5-05
 
 ### 2. Walk the bm callback view in a browser (see behavior_unverified_items).
 expected: As in behavior_unverified_items.
@@ -31,9 +33,9 @@ result: [pending]
 ## Summary
 
 total: 3
-passed: 0
+passed: 1
 issues: 0
-pending: 3
+pending: 2
 skipped: 0
 blocked: 0