test(19.7): accept the SC-3 group-grant override in UAT

.planning/phases/19.7-generic-mcp-module/19.7-UAT.md

@@ -3,22 +3,23 @@ status: testing
 phase: 19.7-generic-mcp-module
 source: [19.7-VERIFICATION.md]
 started: 2026-10-23T20:05:22.930Z
-updated: 2026-10-23T20:05:22.930Z
+updated: 2026-10-23T22:17:04Z
 ---
 
 ## Current Test
 
-number: 1
-name: Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin).
+number: 2
+name: Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear.
 expected: |
-  An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened
+  One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only)
 awaiting: user response
 
 ## Tests
 
 ### 1. Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin).
 expected: An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened
-result: [pending]
+result: pass
+note: override accepted in 19.7-VERIFICATION.md (SC-3 group-grant wording)
 
 ### 2. Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear.
 expected: One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only)
@@ -39,9 +40,9 @@ result: [pending]
 ## Summary
 
 total: 5
-passed: 0
+passed: 1
 issues: 0
-pending: 5
+pending: 4
 skipped: 0
 blocked: 0