diff --git a/PROGRESS.md b/PROGRESS.md
index 1c42170..c2914bd 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -60,10 +60,10 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 
 ### M5 networking (parallel track)
 - [x] N1 `internal/proxy` (Caddy route table + labels) — **DONE** (PR #15, `50e6686`)
-- [ ] N2 `internal/trust` (mkcert; sudo-gated) — TODO
-- [ ] N3 `internal/dns` (/etc/hosts; sudo-gated) — TODO
+- [x] N2 `internal/trust` (mkcert; sudo-gated) — **DONE** (PR #21, `ba3cb54`)
+- [x] N3 `internal/dns` (/etc/hosts; sudo-gated) — **DONE** (PR #20, `8628134`)
 - [ ] N4 `internal/tunnel` (cloudflared; account-gated) — TODO
-- [ ] N5 saga trust phase + doctor probes — BLOCKED (N2,N3,C5)
+- [ ] N5 saga trust phase + doctor probes — TODO  *(now ready: N2,N3,C5 all in)*
 
 ### M6 (saga completion + glue)
 - [ ] X1 config completion — TODO
@@ -94,3 +94,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **C5a, C5b, C6, C7, C8 merged** (PRs #8–12) — **M2-remainder complete**. The resumable/compensating orchestrate engine + the real up phases, the `up`/`down`/`status` CLI, and `shared gc`/`doctor --rebuild-state`. Verified the whole `up` saga end-to-end against the host daemon (shared-postgres came up *healthy* via the cross-project gate; re-run all-skips; `--json` matched; `down` dropped refs) then fully tore it down — the machine was clean before and after. Process note: poll ALL ≥9 PR checks to green before merge (an early poll once merged C6 before the slow checks registered — it passed retroactively, but the lesson stuck).
 - (night 2 cont.) **G1 + CI/test overhaul merged** (PRs #17–18) — owner asked for a `tests/` folder + better CI mid-night. Added `tests/e2e` (functional CLI flows + a real `up→status→re-up→down` daemon e2e, `//go:build e2e`, daemon tier gated on `DEVSTACK_E2E=1` with self-cleanup); **consolidated CI from 7 jobs → 2** (`ci` cheap→expensive fail-fast ladder with module/build caching + Docker for the integration & e2e steps; `release-dryrun` separate). The full `ci` lane (incl. real-daemon integration + e2e) runs green on GitHub's runner in ~4.5 min. This also delivers the saga **daemon e2e** that C5 deferred. `make integration` / `make e2e` added.
 - (night 2 cont.) **S1 + N1 merged** (PRs #14–15) — started the M4 + M5 parallel tracks: the `secret://` core (parser/Provider/registry/batched Resolve) and the Caddy proxy route table + labels. **Gotcha learned the hard way:** pushing a non-semver milestone tag (`m2-done`) broke `release-dryrun` on the next PR (goreleaser `git describe`); deleted the tag, re-ran, green. Decision #1 updated — milestones go in this log, never as tags. **Next ready (all parallel): the provision saga phase (host-port coupling), S2 (SOPS via shelling to `sops`), S3/S5, N2–N4 (sudo/account-gated → mock/temp-file tests), X1 config completion, X8 self-update notifier, X9 migrate/import, G1 integration lane (also unblocks the saga daemon e2e).** Consider G1 next — it activates the already-written `-tags=integration` tests (docker/health/hooks) in CI and provides the isolation harness the saga e2e needs.
+- (night 2 cont.) **owner CI/test request + G1 + N3 + N2 merged** (PRs #17–21) — consolidated CI (7→2 jobs, fail-fast cheap→expensive, module/build cache, Docker for integration+e2e) + a `tests/` folder (functional + real-daemon e2e CLI, green on GitHub's runner ~4.5 min); then `internal/dns` (marker-fenced /etc/hosts) and `internal/trust` (mkcert wrapper), both behind injectable runners + fully temp-file/fake tested, with `dns setup|status|remove` and `trust install|uninstall|status` CLIs. **M5 has N1/N2/N3 done; N4 (tunnel) + N5 (saga trust phase) remain.** Per-PR `ci` now runs the e2e lane too, so docs PRs also take ~4.5 min — acceptable; add path filters later if noisy. **Next ready: N4 tunnel, N5 trust saga-phase, S2 (sops), the provision saga phase (host-port coupling), X1 config completion, X8 notifier, X9 import.**