diff --git a/_bmad-output/implementation-artifacts/1-1-project-scaffold-and-verified-entry-points.md b/_bmad-output/implementation-artifacts/1-1-project-scaffold-and-verified-entry-points.md
index 44b3d0f..a3ed112 100644
--- a/_bmad-output/implementation-artifacts/1-1-project-scaffold-and-verified-entry-points.md
+++ b/_bmad-output/implementation-artifacts/1-1-project-scaffold-and-verified-entry-points.md
@@ -1,6 +1,6 @@
 # Story 1.1: Project Scaffold & Verified Entry Points
 
-Status: review
+Status: done
 
 ## Story
 
diff --git a/_bmad-output/implementation-artifacts/deferred-work.md b/_bmad-output/implementation-artifacts/deferred-work.md
new file mode 100644
index 0000000..c08e657
--- /dev/null
+++ b/_bmad-output/implementation-artifacts/deferred-work.md
@@ -0,0 +1,17 @@
+# Deferred Work Manifest
+
+Tracks blocked, deferred, and tech-debt items across sprints.
+
+---
+
+## Infrastructure / environment setup
+
+### [1-1] systemd unit installation
+Story: `1-1-project-scaffold-and-verified-entry-points`
+Task: 7.1, 7.2
+Description: Unit files created at `systemd/`. Must be symlinked or copied to `/etc/systemd/system/` on the Pi and `systemctl daemon-reload` run before they take effect. Cannot be automated without root access to target device.
+
+### [1-1] Pi Zero 2W runtime verification
+Story: `1-1-project-scaffold-and-verified-entry-points`
+Task: 9.1, 9.2
+Description: Entry points verified on host (Pi 5, Linux). Full AC1 verification on Pi Zero 2W hardware requires physical deployment.
diff --git a/_bmad-output/implementation-artifacts/sprint-status.yaml b/_bmad-output/implementation-artifacts/sprint-status.yaml
index a018ba4..0b4954e 100644
--- a/_bmad-output/implementation-artifacts/sprint-status.yaml
+++ b/_bmad-output/implementation-artifacts/sprint-status.yaml
@@ -44,7 +44,7 @@ story_location: _bmad-output/implementation-artifacts
 development_status:
   # Epic 1: Device Setup & Provisioning
   epic-1: in-progress
-  1-1-project-scaffold-and-verified-entry-points: review
+  1-1-project-scaffold-and-verified-entry-points: done
   1-2-configuration-read-write-wipe: backlog
   1-3-wifi-hotspot-and-captive-portal-form: backlog
   1-4-location-resolution-icao-and-address: backlog
diff --git a/pyproject.toml b/pyproject.toml
index ed3cac2..592507c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -29,7 +29,12 @@ target-version = "py311"
 exclude = [".claude", "_bmad", "_bmad-output"]
 
 [tool.ruff.lint]
-select = ["E", "F", "I", "UP"]
+select = ["E", "F", "I", "TID", "UP"]
+
+[tool.ruff.lint.flake8-tidy-imports.banned-api]
+"planemapper.provisioning".msg = "main.py must not import from planemapper.provisioning.*"
 
 [tool.ruff.lint.per-file-ignores]
-"src/planemapper/main.py" = ["TID252"]
+# All non-main modules may import from provisioning freely
+"src/planemapper/provision.py" = ["TID251"]
+"src/planemapper/provisioning/*.py" = ["TID251"]