diff --git a/DC-PRODUCTION-GRADE-BACKLOG.md b/DC-PRODUCTION-GRADE-BACKLOG.md
index a0c16e2..1e52226 100644
--- a/DC-PRODUCTION-GRADE-BACKLOG.md
+++ b/DC-PRODUCTION-GRADE-BACKLOG.md
@@ -145,9 +145,10 @@
 - **impact:** Any execSync with interpolation is a potential RCE. This is the same class of bug P0-2 already fixed — finish the job.
 
 ### DC-083: 30 source files have zero test coverage
-- **status:** in-progress (license-manager.js — revenue path — claimed by hermes 2026-08-12)
+- **status:** partial (license-manager.js done; 29 files remain — claimed by hermes 2026-08-12)
 - **details:** The test gap scan found 30 source files with NO corresponding test file, including critical paths: `license-manager.js` (534 lines, the entire revenue validation path), `config-schema.js`, `middleware.js` (the auth/rate-limit/CORS stack), `startup-validator.js`, all 7 DNS provider modules (`technitium.js`, `cloudflare.js`, `rfc2136.js`, `manual.js`, `base.js`, `registry.js`, `email.js`), `docker-maintenance.js`, `config/migrations.js`, `event-workers.js`, `keychain-manager.js`, `event-store.js`, `host-registry.js`. Fix: prioritize license-manager.js (revenue path) and middleware.js (security stack) first, then work through the rest. Effort: ~8 hr (can be done incrementally, 2-3 files per PR).
 - **impact:** license-manager.js validates Pro licenses — an untested bug there could silently break activation for every paying customer.
+- **result:** license-manager.js (534 LOC) — the entire revenue validation path — now has dedicated test coverage via `__tests__/license-manager.test.js` (77 tests, codex-graded B). Tests exercise the REAL crypto flow end-to-end: `generateCode(TEST_SECRET)` → `activate(code)` → `_validateOffline(code)` → `verifyCode(secret, code)` → credential store + config persistence. Unlike `license-tier-enforcement.test.js` (which stubs `_validateOffline`), these tests validate actual HMAC signatures, forge version-2 payloads, test online validation paths via `jest.isolateModules`, and cover every public+private method including load/deactivate/getStatus/hasFeature/isPro/isExpired/daysRemaining/getMachineFingerprint/requirePremium/loadSecret/_validateOffline/_updateConfig/_maskCode. Full lifecycle integration tests verify activate→status→deactivate→status and load-after-activate restore across simulated restarts. Full suite: 1738/1738 pass (was 1661, +77 new). Zero new ESLint warnings. 29 files remain uncovered (next priority: middleware.js security stack).
 
 ### DC-084: No .dockerignore — test files and .git leak into Docker image
 - **status:** already done (.dockerignore)