diff --git a/.planning/STATE.md b/.planning/STATE.md
index 314388e..a79e78c 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -1,23 +1,23 @@
 ---
 gsd_state_version: 1.0
 milestone: v1.0
-milestone_name: "Redo and Optimize LLM Integration"
-current_phase: 7
-status: complete
-last_updated: "2026-06-05T00:00:00Z"
+milestone_name: Redo and Optimize LLM Integration
+current_phase: 7.1 (not started — inserted)
+status: completed
+last_updated: "2026-06-05T09:23:13.201Z"
 progress:
   total_phases: 7
-  completed_phases: 7
-  total_plans: 5
-  completed_plans: 5
-  percent: 100
+  completed_phases: 3
+  total_plans: 12
+  completed_plans: 12
+  percent: 43
 ---
 
 # Project State
 
 **Project:** DocuVault
 **Status:** v1.0 Milestone COMPLETE — All 7 phases done
-**Current Phase:** 7 (complete)
+**Current Phase:** 7.1 (not started — inserted)
 **Last Updated:** 2026-06-05
 
 ## Phase Status
@@ -33,12 +33,13 @@ progress:
 | 6.1 | Close v1.0 audit gaps: SHARE-02/STORE-06/ADMIN-06 | ✓ Complete (2/2 plans) |
 | 6.2 | Close v1 sharing + cloud-delete + CSV export gaps | ✓ Complete (5/5 plans, UAT passed, security gate passed) |
 | 7 | Redo and Optimize LLM Integration | ✓ Complete (5/5 plans, UAT 11/11 passed, security gate passed) |
+| 7.1 | Security: session revocation on privilege change (CR-01..03) | ⏳ Not planned (INSERTED) |
 
 ## Current Position
 
 Phase: 7 (redo-and-optimize-llm-integration) — COMPLETE
-All plans: 5/5 executed, UAT 11/11 passed, security gate passed
-**Progress:** [██████████] 100%
+Phase: 7.1 (security-session-revocation-on-privilege-change) — NOT STARTED (INSERTED)
+**Progress:** [██████████] 100% (v1.0 base complete; Phase 7.1 inserted as urgent follow-up)
 
 ## Performance Metrics
 
@@ -145,6 +146,7 @@ All plans: 5/5 executed, UAT 11/11 passed, security gate passed
 - Phase 6.1 inserted: Close v1.0 audit gaps — SHARE-02/STORE-06/ADMIN-06 (2026-05-30)
 - Phase 6.2 inserted: Close v1 sharing + cloud-delete + CSV export gaps (2026-05-31)
 - Phase 7 added: Redo and optimize LLM integration
+- Phase 7.1 inserted (URGENT): Security: session revocation on privilege change (CR-01..03) — inserted after Phase 7 (2026-06-05)
 
 ### Open Questions
 
@@ -202,6 +204,6 @@ _Updated at each phase transition._
 | Last session | 2026-05-31 — Phase 6.2 planned: 4 plans (3 waves); SHARE-03/SHARE-05 (Plan 02), cloud-delete (Plan 03), ADMIN-06 audit enrichment + CSV + daily exports (Plan 04); verification passed (0 blockers, 2 cosmetic warnings fixed) |
 | Last session | 2026-06-03 — Phase 7 planned: 5 plans (5 waves); system_settings DB + HKDF (Plan 01), ProviderConfig + GenericOpenAIProvider + singleton fix (Plan 02), Anthropic output_config + classifier wiring (Plan 03), Celery retry harness + re-queue endpoint (Plan 04), admin AI panel + DocumentCard badge (Plan 05); verification passed (4 blockers fixed in revision round, 0 remaining) |
 | Last session | 2026-06-05 — Phase 7 complete: all 5 plans executed; UAT 11/11 passed; security gate passed (bandit zero HIGH, npm audit zero high/critical); _doc_to_dict status field fix + regression test committed; v1.0 milestone DONE |
-| Next action | v1.0 milestone complete — consider /gsd:complete-milestone or start new milestone |
+| Next action | Phase 7.1 inserted — run `/gsd:plan-phase 7.1` to plan session revocation on privilege change |
 | Pending decisions | None |
 | Resume file | None |