diff --git a/BACKLOG.md b/BACKLOG.md
index ed633e7..d61b3fc 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -10,13 +10,14 @@
 ## P0 — Must Fix (blocks public release)
 
 ### DC-001: Fix 4 failing tests in services.routes.test.js
-- **status:** in-progress
+- **status:** done
 - **owner:** hermes
 - **details:** Credential storage tests failing since before v1.13.4. Run `cd dashcaddy-api && npx jest __tests__/routes/services.routes.test.js` to see failures. Fix the root cause, not the test.
+- **result:** Root cause: routes used `/:serviceId/credentials` (missing `/services/` segment). All 3 credential routes (POST/DELETE/GET) in `routes/services.js` had the wrong path. Fixed to `/services/:serviceId/credentials` — matches the URL pattern used by the live frontend and all 759 tests pass.
 
 ### DC-002: Sync VERSION file
-- **status:** todo
-- **owner:** 
+- **status:** in-progress
+- **owner:** hermes
 - **details:** `/root/dashcaddy/VERSION` says `1.13.0` but `package.json` says `1.13.4`. VERSION file should always match package.json. Add a pre-commit or post-version bump hook to keep them in sync.
 
 ### DC-003: Remove stale test/debug files from repo root