diff --git a/website/WIKI_UPGRADE.md b/website/WIKI_UPGRADE.md
index 416b310..71a1242 100644
--- a/website/WIKI_UPGRADE.md
+++ b/website/WIKI_UPGRADE.md
@@ -284,7 +284,7 @@ phase if preferred). Do not merge a phase that hasn't been verified.
 ### Phase 0 — Branch & scaffolding ✅ (this doc)
 - `wiki-upgrade` branch created; this spec committed.
 
-### Phase 1 — Foundation & safety (highest value)
+### Phase 1 — Foundation & safety (highest value) ✅
 - Schema: add `wiki_categories`, alter `wiki_pages` (category_id, excerpt, published,
   published_at, sort_order, FULLTEXT), update `seed.js`.
 - Server: server-side sanitization on save; drafts/publish endpoints; categories CRUD;
@@ -293,6 +293,11 @@ phase if preferred). Do not merge a phase that hasn't been verified.
   `WikiArticle.jsx`; draft/publish + category in the (still-textarea) admin editor.
 - **Exit check**: existing pages still render; XSS payload in body is neutralized;
   draft pages hidden from the public list/article.
+- **Verified** (2026-06-27): schema migration ran clean on MariaDB 11; XSS payload
+  (`<script>`, `onerror=`, `javascript:`) stripped server-side; drafts return 404 on
+  the public API and are absent from the public list while visible in admin; public
+  index is data-driven (categories + sections); article shows category breadcrumb;
+  client builds and server boots with no errors.
 
 ### Phase 2 — Authoring UX
 - TipTap editor replaces the textarea; generalized `/admin/uploads`; inline images.