diff --git a/app/api/tasks/[id]/route.ts b/app/api/tasks/[id]/route.ts
index a9c3274..8a4c23a 100644
--- a/app/api/tasks/[id]/route.ts
+++ b/app/api/tasks/[id]/route.ts
@@ -55,6 +55,12 @@ export async function PATCH(req: NextRequest, { params }: { params: { id: string
   // edges — drag-and-drop an "in_progress" card to "backlog" silently
   // no-ops (the UI should use the explicit /cancel endpoint).
   if (typeof body.status === "string") {
+    if (!Object.prototype.hasOwnProperty.call(STATUS_TRANSITIONS, body.status)) {
+      return NextResponse.json(
+        { error: `invalid status: ${body.status}` },
+        { status: 400 },
+      );
+    }
     const current = await fetchRecord<PBRecord>(COLLECTION, params.id);
     const allowed = STATUS_TRANSITIONS[current.status as string] || [];
     if (!allowed.includes(body.status)) {
diff --git a/app/tasks/KanbanBoard.tsx b/app/tasks/KanbanBoard.tsx
index 6bcd9c3..f37665e 100644
--- a/app/tasks/KanbanBoard.tsx
+++ b/app/tasks/KanbanBoard.tsx
@@ -106,7 +106,17 @@ export default function KanbanBoard() {
       done: [],
       failed: [],
     };
-    for (const t of filtered) out[t.status].push(t);
+    for (const t of filtered) {
+      const bucket = out[t.status as TaskStatus];
+      if (!bucket) {
+        // Unknown status — log once and put in backlog so the user
+        // can see it and fix it from the detail panel.
+        console.warn(`[Kanban] task ${t.id} has unknown status ${JSON.stringify(t.status)} — putting in backlog`);
+        out.backlog.push(t);
+        continue;
+      }
+      bucket.push(t);
+    }
     return out;
   }, [filtered]);