diff --git a/BACKLOG.md b/BACKLOG.md
index c9b3cb7..f717a78 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -101,6 +101,13 @@
 
 ---
 
+## P0 — Must Fix (blocks public release)
+
+### DC-031: /api/v1/network/ips crashes with ReferenceError — Add Service modal silently broken
+- **status:** in-progress
+- **owner:** hermes
+- **details:** Audited via `npx eslint src/`. `src/app.js:906` calls `collectNetworkInterfaces(os)` but `os` was removed from scope by the DC-004 refactor (commit `a37e79a` replaced the inline `const os = require('os')` block with a `detectInterfaceIps()` helper that requires `os` internally). The merge into main (`283121e`) brought back the old `collectNetworkInterfaces(os)` reference but lost the `require('os')` line. Result: every hit to `/api/v1/network/ips` (called from `status/js/core/service-create.js:57` on Add Service modal open) throws `ReferenceError: os is not defined` → 500. ESLint also catches it as `Error - 'os' is not defined. (no-undef)`. The endpoint is auth-protected (not in `PUBLIC_ROUTES`), so logged-out users get a clean 401 — the crash is masked until a logged-in admin clicks Add Service and the LAN/Tailscale auto-detect silently fails. Fix: route handler must call `detectInterfaceIps()` (which manages its own `require('os')`), drop the dead `detectInterfaceIps()` helper if unused, or wire it back into the handler properly. Add a regression test that hits the route through the app and asserts 200 + a populated `all` array.
+
 ## P2 — Polish & DX
 
 ### DC-008: Update CLAUDE.md for cross-platform accuracy