diff --git a/TODO.md b/TODO.md
index ae27aa8..e31ce2a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,22 +22,22 @@ _Last updated: 2026-05-10 (post Sprint 7: §1.6/§3.2 done, test plan created)_
 
 **Stato generale**: §2 affidabilità chiuso. §3 perf: 3/6 done (3.1/3.2/3.6). §1.6 threat model + §3.2 7-Zip implementati. Comprehensive test plan (v1.3→HEAD) creato. Security items deferred per home lab. Prossimi: §3.3/3.4 (in-VM clone + pre-warm), §6.6 (toolchain Tier-1).
 
-| Area                            | Done | Open | Note                                                          |
-| ------------------------------- | ---: | ---: | ------------------------------------------------------------- |
-| Setup & Infrastructure          |    8 |    0 | Gitea + runner + dirs + rete tutti operativi                  |
-| Template VM (Fasi A→D)          |    4 |    0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
-| Scripts Verification            |    3 |    0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok       |
-| Runner Configuration            |    2 |    0 | `config.yaml`, capacity 4, `BuildVMGuest`                     |
-| Gitea Workflow Integration      |    4 |    1 | manca solo §P3 generalizzazione workflow                      |
-| §1 Sicurezza & hardening        |    3 |    0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab)   |
-| §2 Affidabilità & resilienza    |    7 |    0 | tutto done (2.1-2.7)                                          |
-| §3 Performance & throughput     |    3 |    3 | 3.1/3.2/3.6 done; 3.3/3.4/3.5 backlog                         |
-| §4 Osservabilità & manutenzione |    3 |    1 | 4.1/4.3/4.4 done; 4.5 backlog (4.2 Prometheus rimosso)        |
-| §5 Qualità codice & test        |    4 |    1 | 5.1/5.2/5.3/5.4 done; 5.5 (type hints) backlog                |
-| §6 Scalabilità & estensioni     |    0 |    6 | Linux VM, composite action, toolchain Tier-1                  |
-| §7 Refactor Deploy ↔ Setup      |    4 |    1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale                |
-| In-VM Git Clone (§3.3)          |    0 |    4 | dipende da §6.6 (Git+7-Zip nel template)                      |
-| Linux Build VM (§6.1)           |    0 |    4 | bozza in `docs/LINUX-TEMPLATE-SETUP.md`                       |
+| ✓ | Area                            | Done | Open | Note                                                          |
+| - | ------------------------------- | ---: | ---: | ------------------------------------------------------------- |
+| [x] | Setup & Infrastructure          |    8 |    0 | Gitea + runner + dirs + rete tutti operativi                  |
+| [x] | Template VM (Fasi A→D)          |    4 |    0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
+| [x] | Scripts Verification            |    3 |    0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok       |
+| [x] | Runner Configuration            |    2 |    0 | `config.yaml`, capacity 4, `BuildVMGuest`                     |
+| [ ] | Gitea Workflow Integration      |    4 |    1 | manca solo §P3 generalizzazione workflow                      |
+| [x] | §1 Sicurezza & hardening        |    3 |    0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab)   |
+| [x] | §2 Affidabilità & resilienza    |    7 |    0 | tutto done (2.1-2.7)                                          |
+| [ ] | §3 Performance & throughput     |    3 |    3 | 3.1/3.2/3.6 done; 3.3/3.4/3.5 backlog                         |
+| [ ] | §4 Osservabilità & manutenzione |    3 |    1 | 4.1/4.3/4.4 done; 4.5 backlog (4.2 Prometheus rimosso)        |
+| [ ] | §5 Qualità codice & test        |    4 |    1 | 5.1/5.2/5.3/5.4 done; 5.5 (type hints) backlog                |
+| [ ] | §6 Scalabilità & estensioni     |    0 |    6 | Linux VM, composite action, toolchain Tier-1                  |
+| [ ] | §7 Refactor Deploy ↔ Setup      |    4 |    1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale                |
+| [ ] | In-VM Git Clone (§3.3)          |    0 |    4 | dipende da §6.6 (Git+7-Zip nel template)                      |
+| [ ] | Linux Build VM (§6.1)           |    0 |    4 | bozza in `docs/LINUX-TEMPLATE-SETUP.md`                       |
 
 **Prossimi passi consigliati** (vedi anche "Suggerimento di sequencing" in fondo):
 1. **Test Plan** — eseguire `docs/TEST-PLAN-v1.3-to-HEAD.md` (25+ Pester tests, e2e validation)