diff --git a/200 projects/220 Web Host Migration/Migration Work Log.md b/200 projects/220 Web Host Migration/Migration Work Log.md
index b3232ee..4ce69c9 100644
--- a/200 projects/220 Web Host Migration/Migration Work Log.md	
+++ b/200 projects/220 Web Host Migration/Migration Work Log.md	
@@ -34,9 +34,18 @@ id: 1848129023-LOG
 | P1 | Decision: AWS-only, S3→Glacier DA, ap-southeast-2 (Sydney), IAM least-privilege | Awaiting AWS account signup to proceed |
 | — | Created per-phase plan notes (P0, P1, P2, P3, P5) + this log | Obsidian `220 Web Host Migration/` |
 
+## 2026-08-28 (Phase 1 — build begun)
+| Phase | What was done | Evidence |
+|---|---|---|
+| P0 | **Machine confirmation** — assistant runs on `.27` (sam-4screen-desktop); `.13` reachable via `sam@192.168.20.13` | hostname `sam-4screen-desktop` = `.27` |
+| P1 | AWS account ready; IAM user `backup-offsite` created (programmatic, least-priv) | — |
+| P1 | **Credentials verified** via AWS STS (`get-caller-identity`) | Account `648879824522`, user `backup-offsite`, region `ap-southeast-2` |
+| P1 | Credentials stored local-only (`aws-credentials.local` 0600, .27) + copied to `.13` (`~/.aws-credentials.local.new` 0600). **Not in Obsidian.** | — |
+| P1 | Verified `.13` has no aws-cli/rclone; will use one-off `nix-shell awscli2` for imperative steps until `backup.nix` updated | verified |
+
 ## Pending next action
-- **User:** finish AWS account signup (https://aws.amazon.com) → root MFA + billing + region `ap-southeast-2`.
-- **Then:** build Phase 1 on `.13` (IAM user `backup-offsite`, bucket `sam-offsite-backup`, lifecycle, rclone/Borg→S3, first seed, test restore).
+- **Build:** create bucket `sam-offsite-backup` + lifecycle (S3→Glacier Flexible@30d→Glacier DA@90d), then wire local Borg/rclone→S3 on `.13`, seed, test restore.
+- **Security:** enable root MFA; consider rotating access key after seeding (it was pasted in chat).
 
 ---