diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index cdab484..f7628c3 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -21,17 +21,17 @@ Reliable, persistent visibility into which services need updating — data never
 - ✓ Docker deployment with volume-mounted SQLite — existing
 - ✓ Auto-polling for new updates (5s interval) — existing
 - ✓ Service icon detection from image names — existing
+- ✓ SQLite foreign key enforcement (PRAGMA foreign_keys = ON) — Phase 1
+- ✓ Proper UPSERT preserving tag assignments on re-webhook — Phase 1
+- ✓ Request body size limits (1MB) on webhook and API endpoints — Phase 1
+- ✓ Test error handling uses t.Fatalf (no silent failures) — Phase 1
 
 ### Active
 
-- [ ] Fix SQLite foreign key enforcement (PRAGMA foreign_keys = ON)
-- [ ] Fix INSERT OR REPLACE data loss (switch to proper UPSERT)
 - [ ] Add PostgreSQL support alongside SQLite (dual DB, user chooses)
 - [ ] Bulk acknowledge (dismiss all, dismiss by group)
 - [ ] Filtering and search across updates
 - [ ] In-dashboard new-update indicators (badge/counter/toast)
-- [ ] Request body size limits on webhook and API endpoints
-- [ ] Improve error handling in tests (replace silent returns with t.Fatal)
 - [ ] Data persistence resilience (survive container restarts reliably)
 
 ### Out of Scope
@@ -88,4 +88,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-03-23 after initialization*
+*Last updated: 2026-03-23 after Phase 1 completion*