docs(phase-12.1): audit Nyquist validation coverage

.planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-VALIDATION.md

@@ -1,10 +1,22 @@
 # Phase 12.1: Fix Nextcloud Root Listing and Sync Visibility — Validation Matrix
 
-**Status:** Plan 04 complete. Phase 12.1 closed. All gates pass, docs updated, v0.2.6 committed.
+**Status:** PARTIAL external live gate. Credential-free focused suites pass, but CLOUD-01 live root/exact acceptance and live connection-ID browse remain environment-dependent until the three Nextcloud variables are available in the backend container.
 **Updated:** 2026-06-22
 
 ---
 
+## Validation Audit 2026-06-22
+
+| Metric | Count |
+|--------|-------|
+| Gaps found | 1 |
+| Resolved | 0 |
+| Escalated to manual-only | 1 |
+
+Current automated evidence: 236 focused backend tests and 89 focused frontend tests pass. The only outstanding gate is the four-test live Nextcloud suite documented below.
+
+---
+
 ## Nyquist Validation Matrix
 
 | Requirement | Test type | Coverage | Evidence |
@@ -21,6 +33,23 @@
 
 ## Live Test Contract (Plan 04, Task 1)
 
+### Nyquist audit result (2026-06-22)
+
+No additional credential-free behavioral test can validate the remaining gap. Existing synthetic-fixture contract tests can prove parsing, normalization, trusted identity, and no-byte/no-mutation behavior, while mocked API tests can prove connection-ID ownership and response shape. They cannot prove that the external Nextcloud account is reachable, accepts the configured credentials, currently has the owner-confirmed exact root manifest, or traverses the production network path through the connection-ID endpoint.
+
+The live gate therefore remains **manual-only/environment-dependent**, not covered. A fixture-schema test or a mocked replay of the confirmed manifest would be tautological and would not close CLOUD-01 live acceptance.
+
+Actual command and result:
+
+```text
+docker compose exec -T backend pytest -q -rs tests/test_nextcloud_live.py -m live_nextcloud
+ssss                                                                     [100%]
+SKIPPED [4] Live Nextcloud credentials not configured.
+4 skipped in 0.75s
+```
+
+Required rerun condition: provide `NEXTCLOUD_URL`, `NEXTCLOUD_USER`, and `NEXTCLOUD_APP_PASSWORD` to the backend container through the ignored local environment, then rerun the command above. No credential values belong in commands, logs, fixtures, or this artifact.
+
 ### Marker
 
 ```