diff --git a/app/api/capa/route.ts b/app/api/capa/route.ts
index 40c9cae..3824de9 100644
--- a/app/api/capa/route.ts
+++ b/app/api/capa/route.ts
@@ -5,7 +5,7 @@ import { getSession } from '@/lib/auth/get-session'
 import { withUser } from '@/lib/db/with-user'
 import { writeAuditLog } from '@/lib/db/audit'
 import { capaActions, incidents, users } from '@/lib/db/schema'
-import { aliasedTable, eq, asc } from 'drizzle-orm'
+import { aliasedTable, eq, asc, and } from 'drizzle-orm'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function GET() {
@@ -47,6 +47,7 @@ export async function GET() {
     return q
   })
 
+  const today = new Date().toISOString().slice(0, 10)
   const data = rows.map(r => ({
     id: r.id,
     incident_id: r.incidentId,
@@ -56,7 +57,9 @@ export async function GET() {
     department: r.department,
     due_date: r.dueDate,
     priority: r.priority,
-    status: r.status,
+    status: (r.status === 'open' || r.status === 'in_progress') && r.dueDate && r.dueDate < today
+      ? 'overdue'
+      : r.status,
     completed_at: r.completedAt,
     verified_by: r.verifiedBy,
     verified_at: r.verifiedAt,
@@ -102,6 +105,15 @@ export async function POST(request: NextRequest) {
     await writeAuditLog(tx, 'capa_actions', capa.id, 'created', {
       incident_id, description, owner_user_id, department, due_date,
     })
+
+    await tx
+      .update(incidents)
+      .set({ status: 'capa_pending' })
+      .where(and(eq(incidents.id, incident_id), eq(incidents.status, 'investigating')))
+
+    await writeAuditLog(tx, 'incidents', incident_id, 'status_changed', {
+      status: 'capa_pending',
+    })
   })
 
   await createInAppNotifications([{