diff --git a/BACKLOG.md b/BACKLOG.md
index 22cd337..fc262e4 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -37,13 +37,13 @@
 - **details:** Run `cd dashcaddy-api && npx eslint src/ --format compact`. Most are unused vars and nested ternaries in `src/utils/logging.js`. Fix all, target zero warnings.
 
 ### DC-005: Organize top-level modules into src/
-- **status:** todo
-- **owner:** 
+- **status:** in-progress
+- **owner:** krystie
 - **details:** 40+ JS files at `dashcaddy-api/` root level (auth-manager.js, credential-manager.js, etc.). Move into organized subdirs under `src/` (e.g., `src/managers/`, `src/security/`, `src/docker/`). Update all require() paths. This is a big refactor — run tests after.
 
 ### DC-006: Add integration test for TOTP auth flow
-- **status:** todo
-- **owner:** 
+- **status:** in-progress
+- **owner:** krystie
 - **details:** End-to-end test: no token → 401, wrong token → 403, valid TOTP → session token → authenticated request succeeds. Cover the full `/api/auth/check` → session → endpoint flow.
 
 ### DC-007: Add tests for untested modules