test(19.5): complete UAT - 3 passed, 0 issues

.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md

@@ -8,11 +8,7 @@ updated: 2026-10-21T13:40:00.000Z
 
 ## Current Test
 
-number: 1
-name: Decide on the residual pre-account-takeover path left open by the T-19.5-38 fix. ownerVerifiedEmail treats has_self_set_password=true as proof the owner controls the address, but POST /register with golem15.user activation.activate_mode=auto (the default) creates an activated account with has_self_set_password=true and no email check. An attacker who registers victim@example.com with a password before the victim's first Google/GitHub sign-in gets the victim's verified identity auto-linked onto the attacker's account, and keeps password access.
-expected: |
-  Either accept it explicitly (it is exactly PHP's D-10 behaviour, and the variant T-19.5-38 closed was the social-created one), or schedule a follow-up (for example: auto-link only when the account was activated by mail or set its password through the reset code, or require activate_mode=user for apps mounting sociallogin). Also correct 19.5-SECURITY-REVIEW.md / README wording that a self-set password means the owner 'proved the address'.
-awaiting: user response
+[testing complete]
 
 ## Tests