diff --git a/BACKLOG.md b/BACKLOG.md
index 3cba936..c9cb00d 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -9,6 +9,11 @@
 
 ## P0 — Must Fix (blocks public release)
 
+### DC-020: Restore deleted license-keygen.js — production container in crash-restart loop
+- **status:** in-progress
+- **owner:** hermes
+- **details:** The `refactor(desloppify)` commit (a2e6566) deleted `dashcaddy-api/license-keygen.js` believing it was "stale dev-root noise." It is NOT — it is a required production module. `src/managers/license-manager.js:17` does `require('./license-keygen')` and imports `verifyCode`, `parseCode`, `VALID_DURATIONS` from it. After deletion, `require('./src/app')` throws `MODULE_NOT_FOUND: Cannot find module './license-keygen'` and the **production `dashcaddy-api` Docker container is in a crash-restart loop** (verified: `docker ps` shows `Restarting (1)`, `docker logs` shows the MODULE_NOT_FOUND stack from `/app/src/app.js` → `/app/server.js`). The 1036-test Jest suite never caught this because the only "app-loading" tests read `src/app.js` as a *string* (via `path.join(...,'src','app.js')`), they never execute `require()` on it. Fix: restore the file from git history to `src/managers/license-keygen.js` (the path the post-DC-005 require resolves to) and add a real startup smoke test that executes `require()` on the app module so this class of bug is caught.
+
 ### DC-012: Add Kubernetes-style /healthz + /readyz probe aliases + document for fresh users
 - **status:** done
 - **owner:** hermes