diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index dc852af..07a07c9 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -25,24 +25,29 @@ output.
 
 <!-- Shipped and confirmed valuable. -->
 
-(None yet — Phase 1 of the SPEC ships from a partially-broken first attempt;
-nothing is validated until SPEC §10 acceptance passes.)
+**Validated in Phase 1 (closed 2026-05-20 via verifier audit GREEN 17/17 must-haves):**
+- [x] Continuous 30 s whole-desktop video ring buffer (REQ-video-ring-buffer; D-13 restart-segments)
+- [x] Exact manifest permission set per SPEC §7 + DEC-011 Amendment 1 (REQ-manifest-permissions)
+- [x] Extension installs unpacked into Chrome without errors (REQ-install-clean)
+
+**Validated in Phase 2 (closed 2026-05-20 via verifier audit PASSED 5/5 must-haves; T5 override per saved memory):**
+- [x] One-shot screenshot at export time (REQ-screenshot-on-export; A28 archive layout)
+- [x] Russian-language popup with SAVE-only state machine (REQ-popup-ui; A24 + A25)
+- [x] ZIP archive layout `session_report_YYYY-MM-DD_HH-MM-SS.zip` with 5-entry shape (REQ-archive-layout; A28 set-equality)
+- [x] `meta.json` 8-field schema with `urls: string[]` + `schemaVersion: '2'` per D-P2-02 + D-P2-03 (REQ-meta-json-schema; A26 + A27)
+- [x] Click-to-SAVE latency < 5 s via Blob URL pipeline per D-P2-01 (REQ-archive-export-latency; A25 closes audit P0-6)
 
 ### Active
 
 <!-- Current scope. Building toward these. See REQUIREMENTS.md for IDs. -->
 
-- [ ] Continuous 30 s active-tab video ring buffer (REQ-video-ring-buffer)
-- [ ] 10 min / 5 000-event rrweb DOM buffer with sensitive masking (REQ-rrweb-dom-buffer)
-- [ ] 10 min user/runtime event log with password filtering (REQ-user-event-log)
-- [ ] One-shot screenshot at export time (REQ-screenshot-on-export)
-- [ ] Russian-language popup with idle → "Сохраняю..." → "Готово! ✓" state machine (REQ-popup-ui)
-- [ ] ZIP archive layout `session_report_YYYY-MM-DD_HH-MM-SS.zip` (REQ-archive-layout)
-- [ ] `meta.json` schema (REQ-meta-json-schema)
-- [ ] Exact manifest permission set per SPEC §7 (REQ-manifest-permissions)
-- [ ] Click-to-download latency < 5 s (REQ-archive-export-latency)
-- [ ] Passwords never appear in rrweb snapshots or event log (REQ-password-confidentiality)
-- [ ] Extension installs unpacked into Chrome without errors (REQ-install-clean)
+**Phase 3 (SPEC §10 smoke verification + DOM/event-log verification — absorbed from removed original Phase 2 per 2026-05-20 re-phasing):**
+- [ ] 10 min / 5 000-event rrweb DOM buffer (REQ-rrweb-dom-buffer; masking deferred per DEC-004 Amendment + charter shift)
+- [ ] 10 min user/runtime event log (REQ-user-event-log; password filtering deferred per charter)
+- [ ] SPEC §10 full acceptance criteria sweep (#1-#9)
+
+**Phase 4 (Harden + clean up — optional):**
+- Phase 5-style P1/P2 follow-ups + accumulated session backlog
 
 ### Out of Scope
 
@@ -163,4 +168,4 @@ The verbatim list lives in REQUIREMENTS.md under "Phase 1 Acceptance Criteria
 (SPEC §10 verbatim)".
 
 ---
-*Last updated: 2026-05-15 after initial bootstrap from intel synthesis*
+*Last updated: 2026-05-20 — Phase 2 closure (D-P2-01 Blob URL pipeline closes audit P0-6 + D-P2-02/03 meta.urls schema closes audit P1 #10; 5 REQs moved Active → Validated; PROJECT.md Validated section split by phase per evolution rule). Prior: 2026-05-15 initial bootstrap.*