diff --git a/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md b/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md
new file mode 100644
index 0000000..ee7370b
--- /dev/null
+++ b/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md
@@ -0,0 +1,53 @@
+---
+status: testing
+phase: 16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f
+source: [16.1-VERIFICATION.md]
+started: 2026-10-10T00:00:00Z
+updated: 2026-10-10T00:00:00Z
+---
+
+## Current Test
+
+number: 1
+name: Install the hardened staging vhost on UAT (root)
+expected: |
+  As root on the UAT server: back up /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl,
+  install /srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf over it (sha256 bce4d7f9…bd7c),
+  `nginx -t && systemctl reload nginx`. Afterwards public pages carry X-Content-Type-Options,
+  X-Frame-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy-Report-Only
+  exactly once; /gfadmin keeps its own enforced CSP and Referrer-Policy: same-origin and is not
+  behind basic auth; the public site still is.
+awaiting: user response
+
+## Tests
+
+### 1. Install the hardened staging vhost on UAT (root)
+expected: Security headers present exactly once on public pages, /gfadmin unchanged in access, `nginx -t` passes
+result: [pending]
+
+### 2. Posts list search on UAT
+expected: Searching "cordyceps" at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts returns rows (no "The list could not be loaded")
+result: [pending]
+
+### 3. List state round trip on UAT (D-01, v0.1.17 build)
+expected: Sort plus a category filter survive opening a post and back, "Zapisz i zamknij", and leaving via the plugin rail; the URL carries them; a pasted URL in a new tab shows the same list; after logout and login the list opens unfiltered; signing in as a different admin on the same browser shows no earlier admin's search
+result: [pending]
+
+### 4. Post form locales and fields on UAT (D-03)
+expected: An imported post's form shows pl first with title, slug, content and excerpt filled
+result: [pending]
+
+### 5. Review the prohibition verdicts
+expected: The nine prohibition verdicts in 16.1-VERIFICATION.md (all "not violated") are acceptable
+result: [pending]
+
+## Summary
+
+total: 5
+passed: 0
+issues: 0
+pending: 5
+skipped: 0
+blocked: 0
+
+## Gaps