---
id: w7/m6/t007
title: Closeout — DoD verified, milestone moved to done/
worker: worker7
status: todo
estimate: 15m
depends_on: [w7/m6/t006]
---

## Objective

Close the milestone once its DoD actually holds. Verify the collision + reserved-host guards work end to end, then perform the `/pm done` move.

## Context

- DoD (milestone README): `AddDomain` rejects a host already registered on a different App and platform-owned hosts (base apex, dashboard host, foreign `<app>.<base>`) with a typed 400-class error surfaced consistently on REST/GraphQL/MCP + dashboard; the App's own auto host and free external domains still succeed; no separate ownership challenge is added (ACME already covers it).
- Closing move mechanics: `.claude/commands/pm.md` § `done` (step 4 moves the whole milestone to `w7/done/m6/` and checks the box in the w7 README).

## Steps

1. Verify the DoD end state (unit/integration evidence; a live check that a second App cannot claim a taken host and a `*.onbex.co` foreign host is refused, if a cluster is available — else record what was/wasn't exercised, mirroring the m5 closeout note).
2. Set every remaining task `status: done`, mark all rows `— **DONE**`, set `**Status:** done` in the milestone README.
3. Run `/pm done w7/m6/t007` to trigger the milestone move to `w7/done/m6/` and check `- [x]` in the w7 README.

## Files

- `.pm/w7/m6/**` (statuses), `.pm/w7/README.md` (checkbox)

## Acceptance criteria

- [ ] DoD verified (with a note on what was/wasn't exercised live).
- [ ] Milestone moved to `w7/done/m6/`; w7 README box checked; no tombstone left at `w7/m6`.

## Out of scope

- Any remaining implementation (must be done before this task runs).
