diff --git a/docs/waves/wave-10.md b/docs/waves/wave-10.md
index a7d2eef..825e983 100644
--- a/docs/waves/wave-10.md
+++ b/docs/waves/wave-10.md
@@ -95,6 +95,10 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other
   specific): `url_state_check.py` 26/26, including scenario 2's real click-through of
   the fake-Okta round trip, and `browser_check.py` 71/71. Gap closed.
 
+  **Validated 2026-09-03:** `tests/okta_auth_check.py` 22/22 (no browser needed) ·
+  `tests/url_state_check.py` 26/26 · `tests/browser_check.py` 71/71 — all three run
+  clean, the last two against real headless Chromium via Docker.
+
 - **T10.8 — Verification.** 390px and 1440px, full suite, done-when checks per task,
   matching the rigor D13 was held to.