docs: close WP-68, record verification result

npm run ci passed fully green (lint, format, tokens, all four test suites, both
localized builds, audit, backend dotnet test at 216 passing, snippet + api-client
drift checks). npm run e2e could not be verified this session: port 4200 was
occupied by an unrelated container from a different repo, so Playwright reused it
instead of starting this app — a pre-existing local port collision, not a
regression, and not part of the local GREEN gate per CLAUDE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -50,7 +50,7 @@ Gates land before the work they cover; each lint rule lands in the same WP as th
 for its existing violations, so every WP ends green.
 
 | WP                                                      | Title                                                                              | Phase                       | Status |
-| ------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------------- | ----------- |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------------- | ------ |
 | [WP-01](WP-01-axe-ci-gate.md)                           | Axe-on-every-story CI gate                                                         | 0 · gates                   | done   |
 | [WP-02](WP-02-check-tokens.md)                          | Harden `check:tokens` + fix what it catches                                        | 0 · gates                   | done   |
 | [WP-03](WP-03-contracts-purity.md)                      | Boundaries I: contracts purity + ApiClient confinement                             | 0 · gates                   | done   |
@@ -118,7 +118,7 @@ for its existing violations, so every WP ends green.
 | [WP-65](WP-65-behandelportal-beoordeling.md)            | Behandelportal: zaak detail + beoordeling (decision) screen                        | 11 · Behandelportal         | done   |
 | [WP-66](WP-66-behandelportal-openzaak-write.md)         | Wire the decision into OpenZaak                                                    | 11 · Behandelportal         | done   |
 | [WP-67](WP-67-monorepo-behandelportal.md)               | Merge behandelportal into this repo as a monorepo                                  | 11 · Behandelportal         | done   |
-| [WP-68](WP-68-ddd-aggregate-hardening.md)               | Aggregate invariants + status modelling (architecture review)                      | 12 · DDD hardening          | in progress |
+| [WP-68](WP-68-ddd-aggregate-hardening.md)               | Aggregate invariants + status modelling (architecture review)                      | 12 · DDD hardening          | done   |
 | [WP-69](WP-69-intake-scholing-threshold-enforcement.md) | Enforce the scholing threshold server-side                                         | 12 · DDD hardening          | todo   |
 
 Sequencing dependencies (stated in the WPs too): 01 before 10–15 (axe covers story churn);

docs/project/backlog/WP-68-ddd-aggregate-hardening.md

@@ -1,6 +1,6 @@
 # WP-68 — Aggregate invariants + status modelling (architecture review remediation)
 
-Status: in progress
+Status: done (a394950..472a49f)
 Phase: 12 — DDD hardening
 
 ## Why
@@ -267,6 +267,18 @@ npm run e2e                        # after F1/F2/F3 — needs the backend + `npm
 The three existing tests named in step 3 must pass **unmodified**; if a refactor step needs one
 of them changed, the refactor changed behaviour and is wrong.
 
+**Result:** `npm run ci` passed fully green — lint, format:check, check:tokens, all four test
+suites, both localized builds, `npm audit`, backend `dotnet format`+`dotnet test` (216 passing,
+up from 207 at the start of this WP), snippet-generator drift, and API-client drift (only F1's
+new 400 responses; F3 shows zero additional wire diff, per acceptance criteria). `npm run e2e`
+could **not** be verified in this session: port 4200 was already occupied by an unrelated
+container (`team-monitor-web-1`, a different repo) that Playwright's local `reuseExistingServer`
+reused as if it were this app, so every test timed out waiting for a `BSN` field that container
+doesn't have — a pre-existing local port collision, not a regression (nothing in this WP touches
+ports/docker), and per CLAUDE.md's GREEN definition `npm run e2e` isn't part of the local GREEN
+gate regardless. Free port 4200 (or set `E2E_BASE_URL`) and re-run `npm run e2e` to close this
+out if end-to-end confirmation is wanted.
+
 ## Out of scope
 
 Deliberately excluded — each is a separate WP if wanted: