diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index f5ff408..3f50128 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -211,13 +211,33 @@ Exchange purge may be preferable later).
   (`hasPermission()` role-name shadowing, crashing every non-admin permission
   check with a 500 instead of 403) were found and fixed during verification.
   Validated in Phase 14: /pax8 UI Surface (PAX8-12, PAX8-13, PAX8-14)
+- ✓ Phishing-triage data model + ticket detection + base evidence — new
+  migrations 097 (7-table schema: `campaigns`, `reports`, `messages`,
+  `indicators`, `classifications`, `remediation_actions`, `audit_events` —
+  `reports` fully designed, the rest stubbed for later phases) and 098
+  (disabled-by-default `phishing-sweep` schedule seed). Shared
+  `lib/services/phishing-detector.ts` core: plain `.includes()` pattern
+  matcher (no regex/ReDoS surface) against the 8 locked title/description
+  signatures, content-hash idempotency scoped to title+description only (so
+  status/assignee churn never triggers reprocessing), and EVID-01 evidence
+  capture (company, requester/reporter, notes, time entries, attachment
+  metadata — `is_deleted=false` filtered, never base64 attachment content).
+  Wired into both established scan triggers: fire-and-forget hook on the
+  `ticket.created` webhook (near-real-time) and a bounded (500-row, 7-day
+  window) daily cron sweep for reconciliation. A code-review pass caught and
+  fixed a critical bug pre-ship: the webhook path branched on an Autotask
+  payload field that is never actually populated, so it silently never
+  detected anything — fixed by reading the ticket back from Postgres instead
+  (verified independently by phase verification, not just the fix commit).
+  Forward-only per this milestone's design (no backlog backfill); the
+  reconciliation sweep is disabled by default pending an admin opt-in, same
+  convention as `pax8-daily`. Validated in Phase 15: Data Model, Detection &
+  Ticket Evidence (DETECT-01, DETECT-02, EVID-01)
 
 ### Active
 
 <!-- Hypotheses for this milestone — see .planning/REQUIREMENTS.md for the full v3.0 requirement list -->
 
-- Phishing/spam report tickets in Autotask can be reliably detected from
-  title/body patterns and reprocessed idempotently
 - `.eml` evidence (when present) can be parsed into normalized, actionable
   indicators without executing/fetching anything suspicious
 - Duplicate reports of the same campaign can be grouped via a small set of
@@ -314,4 +334,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-07-14 — v3.0 Phishing Triage Automation milestone started*
+*Last updated: 2026-07-15 — Phase 15: Data Model, Detection & Ticket Evidence complete*