diff --git a/BACKLOG.md b/BACKLOG.md
index 7dc7572..8818e3f 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -196,8 +196,8 @@
 - **impact:** Faster incident recovery. Currently takes 5-10 manual steps to roll back a failed update; would take 1.
 
 ### DC-039: Audit repo for other `__dirname + sibling-file` patterns — DC-033 class of bug
-- **status:** todo
-- **owner:** unclaimed
+- **status:** in-progress
+- **owner:** hermes
 - **details:** DC-033 was caused by `path.join(__dirname, 'package.json')` in a module loaded from a subdirectory. There may be other instances of the same pattern elsewhere in `src/`. Quick grep: `grep -rn "path.join(__dirname" dashcaddy-api/src/ --include="*.js"` and review each hit. Any that join `'package.json'`, `'VERSION'`, `'.env'`, `'openapi.yaml'`, `'Dockerfile'`, or `'.license-secret'` is suspect (these all live at the api root, not in subdirectories). For each suspect match, either: (a) verify the file does exist at the expected `__dirname` location, or (b) fix it to use the api-root path. Effort: ~30 min. Risk: low. Just an audit + targeted fixes.
 - **impact:** Catches latent bugs before users do. The fact that DC-033 shipped undiscovered through multiple releases suggests this antipattern might exist elsewhere.