diff --git a/HANDOFF.md b/HANDOFF.md
index 101d264..de8cb9c 100644
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -75,14 +75,14 @@ evidence, proposed fixes, and acceptance criteria.
 
 ## Current state (as of this handoff)
 
-- **56 tests** in `tests/test_core.py`, ruff clean, CI = lint + pytest (py3.10/3.12).
-- `main` = `13d6b91` (PR #15 merged). No unpushed commits.
+- **92 tests** in `tests/test_core.py`, ruff clean, CI = lint + pytest (py3.10/3.12).
+- `main` = `ece049c` (PR #16 merged). No unpushed commits.
 - **Completed items:** #2 (spawn-test, PR #11), #3 (backup restore UI, PR #14),
-  #4 (stale-file protection, PR #15).
-- **Next item:** #1r — secret-in-args warning badge (remainder of item 1).
-  `is_secret_key` / `_is_secret_value` / `redact_args` already in `bcc_core.py`.
-  Scope: a non-blocking warning badge when a secret-shaped value sits in `args`
-  instead of `env` (safer pattern). See issue #1 on Gitea for acceptance criteria.
+  #4 (stale-file protection, PR #15), #1r (secret-in-args warning, PR #16).
+- **Next item:** #8 — duplicate-name conflict handling. **VERIFY FIRST:** read
+  `paste_json` and `dropEvent` in `bcc.py` to check whether pasting/dropping a
+  server with a name that already exists silently overwrites it; file your
+  findings as a comment on issue #8 before writing any code.
 - Recent features you should know exist: lenient JSON repair
   (`repair_json_text`, `parse_pasted_json_verbose`, `repair_config_file` +
   RepairDialog), ArgsEdit numbered gutter + `split_suspicious_args`,