diff --git a/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md b/.planning/todos/done/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
similarity index 79%
rename from .planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
rename to .planning/todos/done/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
index f4298579..318378a5 100644
--- a/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
+++ b/.planning/todos/done/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
@@ -14,3 +14,5 @@ Found by 19.6-03 Task 6, which left both unstaged and pushed sm-demo-app at `bb2
 - `TestGoModRequiresTags` and `scripts/check-pins.sh` need each submodule on the exact commit of the tag go.mod requires. So the bump moves each checkout to the tag, not to the current HEAD, and raises the go.mod requires (`GOWORK=off go get …@vX.Y.Z`, then `go mod tidy`).
 - Make one `chore: bump <plugin> to <tag>` commit per plugin.
 - Until then, `scripts/check-pins.sh` reports both mismatches and `scripts/build.sh release` refuses the dirty tree.
+
+Done in Phase 20 plan 02 (2026-10-30): nothing left to commit. sm-demo-app `2133309` (go.mod) and `5ec5941` (pointers) had already moved both past the stale commits: oauthserver to v0.1.6 (contains `b6a9586`) and journal to v0.2.6, with `scripts/check-pins.sh` reporting ok. They were not moved back to v0.1.3/v0.2.4.