diff --git a/DC-PRODUCTION-GRADE-BACKLOG.md b/DC-PRODUCTION-GRADE-BACKLOG.md
index 84d5ef9..1a15a05 100644
--- a/DC-PRODUCTION-GRADE-BACKLOG.md
+++ b/DC-PRODUCTION-GRADE-BACKLOG.md
@@ -28,9 +28,9 @@ If an item is too big for one tick, implement a sub-part, push that, and note pr
 - [x] **P2-2: Delete dead legacy files** — Done (commit 140aa5d). Removed comprehensive-test.js + test-security-fixes.js (-878 lines). (status/api/test-api.js is untracked.)
 - [x] **P2-3: ESLint no-empty fix** — Done (commit 140aa5d). Added `no-empty: ['error', { allowEmptyCatch: true }]` to .eslintrc.js. 3 errors→0.
 - [x] **P2-4: Fix no-useless-escape** — Done (commit 140aa5d). routes/auth/session-handlers.js:39 `\-` → `.-` (dash moved to end of char class).
-- [ ] **P2-5: Test handle leaks** — Run `npx jest --detectOpenHandles --silent 2>&1 | grep -i leak` and add teardown (`afterEach(() => clearInterval/clearTimeout)`) to tests that leave open handles. Focus on `totp.routes.test.js` (22s) and `containers.routes.test.js` (28s).
-- [ ] **P2-6: Refactor config-schema.js validateConfig** — Complexity 44 → extract sub-validators for each config section. Behavior-preserving refactor only.
-- [ ] **P2-7: Refactor middleware.js auth function** — Complexity 24, nesting depth 6 → extract auth-logic branches into named helper functions.
+- [x] **P2-5: Test handle leaks** — Done (commit 1bc41bb). Root cause: `setTimeout` in `log-digest.js:start()` was never stored, so `stop()` couldn't clear it — 4 leaked handles. Fixed by storing as `this._initialTimeout` and clearing in `stop()`. Also swept 3 remaining console.error calls. `--detectOpenHandles` reports 0 handles.
+- [x] **P2-6: Refactor config-schema.js validateConfig** — Done (commit f5fc688). Extracted 8 sub-validators (validateTld, validateDns, validateDashboardHost, validateTimezone, validateTheme, validateRoutingMode, validateDomain, validateKnownKeys). Complexity 44→<10 per function. Removed unused constant. Behavior-preserving.
+- [x] **P2-7: Refactor middleware.js auth function** — Done (commit a7512b4). Extracted isTailScaleProbePath, extractTailscaleIPs, isIPInTailnet from tailscaleAuthMiddleware. Complexity 24→7, nesting 6→3. Behavior-preserving.
 
 ## Completion Criteria