docs(phase-19.4): update validation strategy

.planning/phases/19.4-oidc-provider-on-wristband/19.4-VALIDATION.md

@@ -3,7 +3,7 @@ phase: "19.4"
 slug: "oidc-provider-on-wristband"
 # status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
 # audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
-status: draft
+status: validated
 nyquist_compliant: true
 wave_0_complete: true
 created: "2026-10-19"
@@ -96,4 +96,18 @@ Commands run from summercms.go; `go -C ../sm-oauthserver-plugin` and `go -C ../f
 - [x] Feedback latency < 60s (quick command)
 - [x] `nyquist_compliant: true` set in frontmatter
 
-**Approval:** pending (`/msd-validate-phase` sets the status)
+**Approval:** validated 2026-10-20 (`/msd-validate-phase 19.4`)
+
+---
+
+## Validation Audit 2026-10-20
+
+| Metric | Count |
+|--------|-------|
+| Gaps found | 1 |
+| Resolved | 1 |
+| Escalated | 0 |
+
+`scripts/check-phase19.4.sh --all` rerun on a Docker host after UAT: self-test, go, plugin, userplugin, fonoteka, docs and docker PASS; parity NOT RUN (D-14 amended, deferred to the WavePath cutover).
+
+The gap was a false positive in the D-05 additivity check (tasks 19.4-04-05 and the plugin's `TestZeroEditAdditivity`): merging origin/master into sm-user-plugin after UAT brought in 24b16b1 (2026-10-07, before the phase), which changed the signatures of `console.APITokenCommands` and `console.RequirePasswordChange`. The check compared against c077029 only. It now takes both pre-phase commits (c077029 and 24b16b1), and a declaration counts as removed only when removed against both. Fixed in sm-oauthserver-plugin 36c8c63 and summercms.go d9f7bfa. A single base or an unknown ref still refuses.