diff --git a/src/docs/apiserver-backend-tasks.md b/src/docs/apiserver-backend-tasks.md
index 6605c464..4d1a524d 100644
--- a/src/docs/apiserver-backend-tasks.md
+++ b/src/docs/apiserver-backend-tasks.md
@@ -44,22 +44,23 @@
 
 ## P0-2: Host Control via Backend
 
-- [ ] **#6 P0-2a: C-side plumbing for host control**
-  - `schema/controller.capnp` — Add `HostControl` struct + `hostctrlmsg @21`
-  - `include/typemap.h` — Add `xce_hostctrl_t* hostctrlmsg;` to body union
-  - `include/client.h` — Add `xcecli_hostctrl()` declaration
-  - `include/xceapi.h` — Add `xce_hostctrl()` declaration
-  - `include/request.h` — Add `xce_hostctrl_req()` declaration
-  - `lib/client.c` — Implement `xcecli_hostctrl()`
-  - `lib/xceapi.c` — Implement `xce_hostctrl()` with `cbuf_get()` wait
-  - `lib/request.c` — Implement `xce_hostctrl_req()` (validate HOST_OPEN/HOST_CLOSE only)
-  - `lib/helper.c` — Add `Request_body_hostctrlmsg` case to `xce_request_body()` + `xce_request_msg_name()`
-  - `controller/cluster.c` — Add `OPCode_hostcontrol` case → `do_hostcontrol_op()`
-  - `controller/worker.c` — Implement `do_hostcontrol_op()` calling `worker_ctrl()`
-  - `controller/include/cluster.h` — Declare `do_hostcontrol_op()`
-  - Regenerate capnp: `ninja -C build`
+- [x] **#6 P0-2a: C-side plumbing for host control**
+  - `schema/controller.capnp` — Added `HostControl` struct + `hostctrlmsg @21`
+  - `include/typemap.h` — Added `xce_hostctrl_t* hostctrlmsg;` to body union (after @20 clrpreasonmsg, matching capnp ordinal)
+  - `include/client.h` — Added `xcecli_hostctrl()` declaration
+  - `include/xceapi.h` — Added `xce_hostctrl()` declaration
+  - `include/request.h` — Added `xce_hostctrl_req()` declaration
+  - `lib/client.c` — Implemented `xcecli_hostctrl()`
+  - `lib/xceapi.c` — Implemented `xce_hostctrl()` with `cbuf_get()` wait
+  - `lib/request.c` — Implemented `xce_hostctrl_req()` (validates HOST_OPEN/HOST_CLOSE only, rejects HOST_TAG/UNTAG)
+  - `lib/helper.c` — Added `Request_body_hostctrlmsg` case to `xce_request_body()` + `xce_request_msg_name()`
+  - `controller/cluster.c` — Added `OPCode_hostcontrol` case → `do_hostcontrol_op()`
+  - `controller/worker.c` — Implemented `do_hostcontrol_op()` calling `worker_ctrl()`; fixed pre-existing `goto clean` bug that leaked write lock + reference count
+  - `controller/include/cluster.h` — Declared `do_hostcontrol_op()`
+  - `lib/testsuite/test_request.c` — 8 TDD validation tests (null ep/ctrl/hostname, empty hostname, HOST_DO_NONE no-op, HOST_TAG/UNTAG reject, negative action)
+  - Regenerated capnp via `ninja -C build`
 
-- [>] **#7 P0-2b: Implement Go-side ControlHost + fix allFlag race** (blocked by #6)
+- [ ] **#7 P0-2b: Implement Go-side ControlHost + fix allFlag race** (unblocked)
   - `backend/clib.go` — Replace `ControlHost()` stub with real implementation via `xcecli_hostctrl()`
   - `controllers/hosts.go` — Fix data race: remove `var allFlag bool`, return from `preCheckHostControlRequest` as local
   - `controllers/queues.go` — Same allFlag data race fix (lines 534-536 / 465)