diff --git a/.planning/phases/28-profile-and-logto-integration/28-UAT.md b/.planning/phases/28-profile-and-logto-integration/28-UAT.md
new file mode 100644
index 0000000..4d8558a
--- /dev/null
+++ b/.planning/phases/28-profile-and-logto-integration/28-UAT.md
@@ -0,0 +1,76 @@
+---
+status: partial
+phase: 28-profile-and-logto-integration
+source: [28-01-SUMMARY.md, 28-02-SUMMARY.md, 28-03-SUMMARY.md]
+started: 2026-04-12T18:30:00Z
+updated: 2026-04-12T19:00:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Profile page navigation
+expected: Click your avatar in the top nav. The dropdown shows "Profile" above "Settings". Clicking it navigates to /profile.
+result: pass
+
+### 2. Profile page sections
+expected: /profile page shows four sections: Profile Info (displayName, bio, avatar), Account Info (email, member-since date), Security (password change), and Danger Zone (delete account).
+result: pass
+
+### 3. Settings page separation
+expected: /settings page shows only app preferences: weight unit, currency, import/export, API keys. No profile section.
+result: pass
+
+### 4. Edit display name and bio
+expected: On /profile, change display name and bio, click Save. Success message appears. Refreshing the page shows the updated values.
+result: issue
+reported: "Save works for name/bio after Zod null fix, but avatar upload doesn't persist after save. Also needs: crop editor for avatar, larger profile pic with name/bio side-by-side layout, click-to-open modal with full-size image + Remove/Update buttons."
+severity: major
+
+### 5. Email display
+expected: Account Info section shows your email address (from Logto) and a "Change" button next to it.
+result: blocked
+blocked_by: third-party
+reason: "Logto Management API returns 500 — M2M env vars (LOGTO_MANAGEMENT_API_ENDPOINT, LOGTO_M2M_APP_ID, LOGTO_M2M_APP_SECRET) not configured on test env"
+
+### 6. Password change form
+expected: Security section shows a password change form. If you signed in with email+password: current password, new password, confirm new password fields. If social login only: just new password + confirm fields.
+result: blocked
+blocked_by: third-party
+reason: "Logto Management API returns 500 — M2M env vars not configured on test env"
+
+### 7. Delete account UI
+expected: Danger Zone shows a red-bordered card with "Delete Account" button. Clicking it shows a confirmation dialog requiring you to type "DELETE" before proceeding.
+result: blocked
+blocked_by: third-party
+reason: "Logto Management API returns 500 — M2M env vars not configured on test env"
+
+### 8. Member-since date
+expected: Account Info section shows a "Member since" date formatted nicely (e.g., "April 2026").
+result: pass
+
+## Summary
+
+total: 8
+passed: 4
+issues: 1
+pending: 0
+skipped: 0
+blocked: 3
+
+## Gaps
+
+- truth: "Avatar upload should persist after save. Profile pic should have crop editor, larger display with side-by-side layout, and click-to-open modal."
+  status: failed
+  reason: "User reported: avatar upload doesn't persist. Also needs crop editor, layout redesign (larger pic, name/bio beside it), click-to-open modal with Remove/Update."
+  severity: major
+  test: 4
+  artifacts:
+    - src/client/components/ProfileSection.tsx
+  missing:
+    - Avatar save persistence fix
+    - Crop editor integration for avatar
+    - Profile layout redesign (larger pic, side-by-side, modal)