What done means here

Done is a claim, so it carries a definition. For this build:

Done means a stranger can run it, and every decision can be defended.

• It runs from a fresh clone using only this document and Docker, and that drill was performed, not assumed.
• Every control is a mechanism with a test named beside it, the container claims are verifiable by the commands printed above, and the mutation check proves the tests would notice the controls breaking.
• Every figure a document states is asserted against the running system or gated against its source, so the documents cannot quietly disagree with the code.
• Every non-obvious choice carries its reason and its rejected alternative in DECISIONS.md, including what was deliberately left out.
• No credential-shaped string exists anywhere in the repository or its history, including demo and test material.

Done does not mean finished: the roadmap above and the out-of-scope list are the record of what is deliberately absent, each with its reason, because an undocumented gap and a considered exclusion look identical in code.

---