docs(webapp): say which UAT flow the project-wide answer is preserved for

Author: kathiekiwi

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -89,8 +89,8 @@ export type UserActorEnvironmentScope =
  * Throws a 403 Response when a claim can't be honoured: a claim outside the target project, or a
  * request filter that names anything else. A conflicting filter is refused rather than overridden,
  * so a caller never gets another environment's shape of answer under its own filter. A token with
- * no claim keeps the project-wide answer, as the public PAT exchange's MCP and CLI callers expect —
- * except a dashboard-agent token, which always carries one, so its absence is a bug.
+ * no claim keeps the project-wide answer — narrowing it would break the public PAT exchange, which
+ * mints claimless tokens. A dashboard-agent token always carries one, so its absence is a bug.
  */
 export async function resolveUserActorEnvironmentScope(
   userActor: UserActorClaims | undefined,

apps/webapp/test/userActorProjectWideScope.test.ts

@@ -286,8 +286,8 @@ postgresTest(
     const seeded = await seedProject(prisma);
     ctx.patUserId = seeded.user.id;
 
-    // The public PAT exchange used by MCP and the CLI may issue an environment-agnostic token.
-    // Narrowing it would be a breaking change, so it reads the whole project as it always has.
+    // The public PAT exchange mints claimless tokens, so narrowing one would be a breaking
+    // change: it reads the whole project as it always has.
     const environments = await call(environmentsLoader, {
       projectRef: seeded.project.externalRef,
       token: await agentToken(seeded.user.id, undefined, "mcp"),