docs(phase-19.7): update tracking after gap wave 4

.planning/ROADMAP.md

@@ -1454,7 +1454,7 @@ Plans:
   3. `tools/list` lists only the tools the session's principals may call (frontend permissions through the merged group/user permissions, backend permissions and token scope through cabana), and a call runs through the route's own middleware.
   4. An editor signs in once through `wristband` OAuth as a frontend user; with a verified link to a backend user, backend-guarded tools such as Journal's run as that admin, and removing the link or the grant removes them. The phase gets a security review; the MCP SDK dependency has a decision note before code lands; unit tests are the last plan.
 
-**Plans:** 8/9 plans executed
+**Plans:** 9/9 plans executed
 
 Plans:
 **Wave 1**
@@ -1484,7 +1484,7 @@ Gap closure (`19.7-REVIEW.md` findings, escalations E-1 and E-2; `19.7-GAP-INPUT
 - [x] 19.7-08-PLAN.md — Plugins and demo (lane C): link proof on `auth_time` with the code in the fragment, grant revocation on ban/reset and link changes, member token scopes (E-2), organisation logo (E-1), Journal prompt ceiling, nginx MCP body cap
 
 **Gap wave 4** *(blocked on 19.7-06, 19.7-07 and 19.7-08)*
-- [ ] 19.7-09-PLAN.md — Unit tests for every fix and both escalations, the extended gate (workspace check, unreleased-pin policy), validation rows, the corrected security review, deferred items
+- [x] 19.7-09-PLAN.md — Unit tests for every fix and both escalations, the extended gate (workspace check, unreleased-pin policy), validation rows, the corrected security review, deferred items
 
 ### Phase 19.8: Console commands overhaul (INSERTED)
 
@@ -1621,7 +1621,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.5. Social login in sm-user-plugin | 5/5 | Complete    | 2026-10-21 |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
 | 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete    | 2026-10-22 |
-| 19.7. Generic MCP module | 8/9 | In Progress|  |
+| 19.7. Generic MCP module | 9/9 | In Progress|  |
 | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress|  |
 | 20. Demo instance with every shared plugin | 0/TBD | Not started | - |
 | 30. Płytarium cutover | 0/TBD | Not started | - |

.planning/STATE.md

@@ -3,17 +3,17 @@ msd_state_version: "1.0"
 milestone: v1.0
 current_phase: "19.7"
 current_phase_name: Generic MCP module (INSERTED)
-status: executing
-stopped_at: "Session resumed; repos verified at handoff HEADs; next: /msd-execute-phase 19.7 --gaps-only (19.7-09)"
-last_updated: "2026-10-23T15:22:01.510Z"
+status: verifying
+stopped_at: "Completed 19.7-09-PLAN.md; all 9 plans summarized; next: code review gate, regression gate, verifier"
+last_updated: "2026-10-23T17:05:53.380Z"
 last_activity: 2026-10-23
 last_activity_desc: "Completed 19.7-08: plugin gap closure, E-1 logo, E-2 member token scopes; paused before 19.7-09"
-state_head: bccf06d9606be04b817113b810adf28dfb0c5d28
+state_head: 883ac5133cd2e77d37a9873eeb0cdc5cac0f3467
 progress:
   total_phases: 45
   completed_phases: 37
   total_plans: 242
-  completed_plans: 237
+  completed_plans: 238
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -31,7 +31,7 @@ See: .planning/PROJECT.md (updated 2026-10-22)
 
 Phase: 19.7 (Generic MCP module (INSERTED)) — EXECUTING
 Plan: 5 of 5
-Status: Ready to execute
+Status: Phase complete — ready for verification
 Last activity: 2026-10-23 — Phase 19.7 execution started
 
 Progress: [████████░░] 82%
@@ -1067,6 +1067,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-23T15:22:00.479Z
-Stopped at: Session resumed; repos verified at handoff HEADs; next: /msd-execute-phase 19.7 --gaps-only (19.7-09)
+Last session: 2026-10-23T17:05:52.378Z
+Stopped at: Completed 19.7-09-PLAN.md; all 9 plans summarized; next: code review gate, regression gate, verifier
 Resume file: .planning/phases/19.7-generic-mcp-module/.continue-here.md