test(08): UAT complete — 7/7 passed, phase 8 marked complete

All 7 UAT tests passed (cold start, auth, documents, admin, cloud storage,
session revocation, Vite 6 build). Security gate: 0 threats open. Phase 8
transition complete — ROADMAP.md updated, PROJECT.md evolved with Phase 8
decisions, stale handoff deleted. Next: Phase 9 (Admin Panel Rearchitecture).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/STATE.md

@@ -3,21 +3,22 @@ gsd_state_version: 1.0
 milestone: v0.2
 milestone_name: Phases
 current_phase: 9
-status: ready
-last_updated: "2026-06-12T00:00:00.000Z"
+status: ready_to_plan
+last_updated: 2026-06-12T09:27:34.436Z
 last_activity: 2026-06-12
 progress:
   total_phases: 17
   completed_phases: 14
   total_plans: 73
   completed_plans: 73
-  percent: 80
+  percent: 82
+stopped_at: Phase 08 complete (8/8) — ready to discuss Phase 9
 ---
 
 # Project State
 
 **Project:** DocuVault
-**Status:** Phase 8 complete — ready for Phase 9
+**Status:** Ready to plan
 **Current Phase:** 9
 **Last Updated:** 2026-06-12
 
@@ -60,6 +61,8 @@ Last activity: 2026-06-12
 | Sub-routers carry NO prefix | Parent APIRouter prefix propagates — sub-routers with prefix cause double-segment URLs |
 | AdminLayout as route component, not App.vue branch | Router resolves AdminLayout as the /admin component; its router-view renders children |
 | to.matched.some() for requiresAdmin guard | Vue Router 4 does not inherit meta to children; direct to.meta check is a security regression |
+| FastAPI 0.128+ empty-path sub-router restriction | `@router.get("")` on sub-router with empty include prefix fails; register root routes on parent aggregator |
+| Vite 6 upgrade resolves 2 CVEs | CVE-2026-39363/39364 closed; npm audit now clean |
 
 ### Roadmap Evolution