diff --git a/TRACKING.md b/TRACKING.md
index eece16f..6e828c5 100644
--- a/TRACKING.md
+++ b/TRACKING.md
@@ -15,6 +15,7 @@ One table, updated in place at each checkpoint. States: done ✅ / doing 🔄 /
 | OPT-9 | integ | ⏳ | #604: node_exporter svc + gateway pressure scrape (Q10) |
 | OPT-10 | integ | ⏳ | #605: k8s join (Q11, blocked by #601) + proxmox-ctl token (Q12) |
 | #606 | gpu | 🔄 | Quadro 4000 passthrough STAGED on 5111 (vfio ids + q35 + hostpci0, staged/gpu-passthrough.md); activates at the human's pre-Friday roll; nouveau-only on kernel 6.12 (no CUDA/NVENC — compute cards come with #601) |
+| #684 | pve-cfg | ✅ | NEW 2026-09-05 (OAM lane): ukrrs-pve-config-backup.timer (03:12 CT nightly, Persistent) runs KNEL/backups scripts/pve-config-backup.sh -> sanitized /etc/pve of all 6 PVE nodes into PRIVATE KNEL/pve-configs git repo; idempotent (commits only on drift); secrets excluded+verified. Ticket #684 |
 | #610 | fleet | ✅ | Open Terminal 9-account fleet (tailscale-only :30000-30008) + OpenWebUI UAT PASS |
 | #611 | rdp | ✅ | UAT PASS both accounts 2026-09-01 evening (5160x2160 clean, iPad res clean). Fix chain: kwin compositor-off + 5min timeout; max_bpp=24 (16K bitmap-row limit was the bars); drdynvc=false; autologin off; DisconnectedTimeLimit=0 (24x7 kept) + tcp keepalives; clean-slate = stop user@UID (manager recycle), not just pkill. 2026-09-05 post-update-reboot outage FIXED (waitforx shim + xbrlapi hook): see 17-fix-rdp-postupdate.sh |
 | #612 | dotfiles | ✅ | UAT PASS 2026-09-01 (human): omz+v2 base + kali addendum both accounts; p10k fallback via KALI_PROMPT=0 |