diff --git a/REFACTOR_PLAN.md b/REFACTOR_PLAN.md
index 7d74cb6..7fa75bb 100644
--- a/REFACTOR_PLAN.md
+++ b/REFACTOR_PLAN.md
@@ -20,11 +20,11 @@ citations, and the highest-severity ones were independently re-verified
 | 2 | Validation tooling & clean baseline | Done. `yamllint`/`ansible-lint`/`kubeconform` installed by user; `.yamllint.yml`/`.ansible-lint` added; baseline clean (0 yamllint issues, `kubeconform`: 117+20 resources valid, all playbooks pass `--syntax-check`). Remaining `ansible-lint` findings are either pre-existing role/var naming conventions (out of scope — would require repo-wide renames) or collections-not-installed noise that resolves once `ansible-galaxy collection install -r ansible/requirements.yml` is run. |
 | 3 | Remove confirmed junk | Done, committed locally. `.DS_Store` confirmed never tracked (no action needed). |
 | 4 | Ansible cleanup | Done, committed locally. |
-| 5 | Argo CD bootstrap normalization | Not started — highest-risk stage, needs one-Application-at-a-time live rollout with `kubectl diff`, not a blind batch. |
-| 6 | Values/DNS consolidation | DNS drift + orphaned entry done, committed locally. Sync-policy normalization (finding #18) done, committed locally, **not pushed** (changes live Argo CD behavior on 5 Applications). |
-| 7 | Kubernetes correctness & security | Not started. |
-| 8 | Documentation & DR runbook | Partially done (host tables, ingress/storage doc-drift, ansible role tables) — cold-rebuild runbook not yet written. |
-| 9 | CI & Claude Code guidance | Not started. |
+| 5 | Argo CD bootstrap normalization | Files done, committed locally, **not pushed — highest-risk stage**. `authentik.yaml`'s chart version is a placeholder needing your input (`helm list -n authentik`); every new/changed Application here needs `kubectl diff` one at a time before/after enabling, not a blind batch push. |
+| 6 | Values/DNS consolidation | Done, committed locally, **not pushed**. |
+| 7 | Kubernetes correctness & security | Resource requests/limits + probes done (finding #16), committed locally, **not pushed**. `gitea-backup` RBAC narrowing (#11) done as part of Stage 5's commit. Grafana `runAsNonRoot`/`fsGroup` test (#25) and `:latest` image pinning not done — both need a live test window / registry inspection I didn't do unprompted. |
+| 8 | Documentation & DR runbook | Done, committed locally. |
+| 9 | CI & Claude Code guidance | Done, committed locally, **not pushed** (new CI automation surface). |
 
 **Secret rotation still needs you** (Stage 1): I wired up the `existingSecret`/env-injection plumbing for the Gitea DB password and Dashy API key, but I don't generate or handle the actual new credential values — that's your call per this repo's credential-handling rule. See the session summary for exact steps.