docs(phase-19.7): update tracking after wave 3

.planning/ROADMAP.md

@@ -1454,7 +1454,7 @@ Plans:
   3. `tools/list` lists only the tools the session's principals may call (frontend permissions through the merged group/user permissions, backend permissions and token scope through cabana), and a call runs through the route's own middleware.
   4. An editor signs in once through `wristband` OAuth as a frontend user; with a verified link to a backend user, backend-guarded tools such as Journal's run as that admin, and removing the link or the grant removes them. The phase gets a security review; the MCP SDK dependency has a decision note before code lands; unit tests are the last plan.
 
-**Plans:** 2/5 plans executed
+**Plans:** 3/5 plans executed
 
 Plans:
 **Wave 1**
@@ -1464,7 +1464,7 @@ Plans:
 - [x] 19.7-02-PLAN.md — The `pier` module behind `summercms_mcp` (go-sdk, hybrid stateful/stateless, Redis sessions, fan-out, PRM) and the framework release carrying 19.6.1 + 19.7-01/02
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 19.7-03-PLAN.md — sm-user-plugin: verified account link, Administrators-screen link actions, plugin frontend permission codes, the `user` MCP guard and `user_me` tool, plugin release and app pointer bumps
+- [x] 19.7-03-PLAN.md — sm-user-plugin: verified account link, Administrators-screen link actions, plugin frontend permission codes, the `user` MCP guard and `user_me` tool, plugin release and app pointer bumps
 
 **Wave 4** *(blocked on Wave 3 completion)*
 - [ ] 19.7-04-PLAN.md — sm-oauthserver-plugin `backend` scope, `oas_at_` verifier and MCP consent JSON; Journal tools; vue-demo-app `/connect` and `/link-admin`; sm-demo-app wiring, e2e and deploy notes; plugin releases
@@ -1607,7 +1607,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.5. Social login in sm-user-plugin | 5/5 | Complete    | 2026-10-21 |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
 | 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete    | 2026-10-22 |
-| 19.7. Generic MCP module | 2/5 | In Progress|  |
+| 19.7. Generic MCP module | 3/5 | In Progress|  |
 | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress|  |
 | 20. Demo instance with every shared plugin | 0/TBD | Not started | - |
 | 30. Płytarium cutover | 0/TBD | Not started | - |

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "19.7"
 current_phase_name: Generic MCP module (INSERTED)
 status: executing
-stopped_at: Completed 19.7-02-PLAN.md
-last_updated: "2026-10-22T22:31:56.714Z"
+stopped_at: Completed 19.7-03-PLAN.md
+last_updated: "2026-10-23T10:30:59.954Z"
 last_activity: 2026-10-23
-last_activity_desc: "Completed quick task 261022-x7a: user-plugin golem15.user.password.public_routes switch (login/forgot/reset 404 when false)"
-state_head: e2759d668f4cb0862086bd3f190f6d2493f3e543
+last_activity_desc: "Completed 19.7-03: sm-user-plugin v0.1.10 released, five apps bumped"
+state_head: 607658599f6dfb4dc2745c79de04993db1230e86
 progress:
   total_phases: 45
   completed_phases: 37
   total_plans: 238
-  completed_plans: 231
+  completed_plans: 232
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -30,9 +30,9 @@ See: .planning/PROJECT.md (updated 2026-10-22)
 ## Current Position
 
 Phase: 19.7 (Generic MCP module (INSERTED)) — EXECUTING
-Plan: 3 of 5
+Plan: 4 of 5
 Status: Ready to execute
-Last activity: 2026-10-23 — Completed quick task 261022-x7a: user-plugin golem15.user.password.public_routes switch (login/forgot/reset 404 when false)
+Last activity: 2026-10-23 — Phase 19.7 execution started
 
 Progress: [████████░░] 82%
 
@@ -1067,5 +1067,5 @@ Items acknowledged and carried forward from previous milestone close:
 ## Session Continuity
 
 Last session: 2026-10-22T22:22:57.128Z
-Stopped at: Completed 19.7-02-PLAN.md
+Stopped at: Completed 19.7-03-PLAN.md
 Resume file: None