diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index eb625a0..0af7965 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -376,7 +376,7 @@ summarizes classification, blast radius, and recommended/approved remediation st
   4. Each flagged ticket's stored evidence includes ticket ID/number, company, requester/reporter, title, description, notes, relevant time entries, and attachment metadata (EVID-01)
 **Plans**: 3 plans
 - [x] 15-01-PLAN.md — Migration 097: 7-table phishing-triage schema (reports fully designed, others stubbed) (DETECT-01, DETECT-02, EVID-01)
-- [ ] 15-02-PLAN.md — phishing-detector.ts core: pattern matcher + content-hash idempotency + EVID-01 evidence capture + reports upsert (DETECT-01, DETECT-02, EVID-01)
+- [x] 15-02-PLAN.md — phishing-detector.ts core: pattern matcher + content-hash idempotency + EVID-01 evidence capture + reports upsert (DETECT-01, DETECT-02, EVID-01)
 - [ ] 15-03-PLAN.md — Wiring: webhook fire-and-forget hook + bounded cron sweep service + scheduler branch + migration 098 seed (DETECT-01, DETECT-02)
 **UI hint**: no
 
@@ -477,7 +477,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
 | 12. Orders/Invoices & Company Matching | v2.0 | 5/5 | Complete | 2026-07-11 |
 | 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 |
 | 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 |
-| 15. Data Model, Detection & Ticket Evidence | v3.0 | 1/3 | In Progress|  |
+| 15. Data Model, Detection & Ticket Evidence | v3.0 | 2/3 | In Progress|  |
 | 16. EML/MIME Evidence Parser | v3.0 | 0/TBD | Not started | - |
 | 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - |
 | 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - |