diff --git a/workplans/ZONE-WP-0001-security-zone-model.md b/workplans/ZONE-WP-0001-security-zone-model.md
index 96bc51b..ae3727e 100644
--- a/workplans/ZONE-WP-0001-security-zone-model.md
+++ b/workplans/ZONE-WP-0001-security-zone-model.md
@@ -192,7 +192,7 @@ surface is `tenancy.yaml`'s `zones:` key rather than a new file.
 
 ```task
 id: ZONE-WP-0001-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f1016c71-ccb0-46a7-9143-e81c7ac34cad"
 ```
@@ -220,6 +220,38 @@ Answer explicitly:
   The *other* two axes (environment posture, `M0`–`M3`) remain an open question
   for this task — they are per-workload and genuinely composable.
 
+**Done 2026-08-19.** Full result: `docs/estate-partition-2026-08-19.md`.
+
+Four bands, each of the 27 lanes in exactly one — **Decided** (1, the only lane
+ops-warden decides), **Fronted** (10, owner has a front door), **Covered** (12,
+ops-warden proxies what it does not own), **Signposted** (4, routed, nothing
+flows). Derived from declared fields, not invented.
+
+The discriminator is `delegation.mode`, not `risk`: 10 of 11 high-risk lanes are
+interim and 8 of those are `exec_capable`. A field added to answer a governance
+question predicts operational danger better than the one named for it.
+
+Three results that bind the later tasks:
+
+- **Stance is per control per zone, never per zone alone.** The three existing
+  controls cut the estate differently — pre-sign gate 1 lane, fetch gate 13,
+  read-boundary 11, with only 8 in the overlap. They were built independently
+  and their scopes were never reconciled.
+- **Zone is a property of the lane.** The caller (`WARDEN_AGENT_ID`) is a
+  *modifier*, not the zone — collapsing them would make one lane need two. And
+  the moment is confirmed as a separate object: nothing in the corpus represents
+  it, and `delegation.blocked_on` is exactly the expiry-by-intention shape T04
+  must not reproduce.
+- **Environment posture and `M0`–`M3` compose but cannot be joined today** —
+  they are per-workload, zones are per-lane, and no registry carries a join key.
+  Inventing one would be fabrication under §6.
+
+**Residue, and the most valuable output:** 14 of 27 lanes carry no `risk` value,
+and `is_high_risk` is `risk == "high"`, so the agent read-boundary never fires
+for them; 5 are `exec_capable`. Routed to `risk-nexus` as **`RISK-F-0003`**.
+Consequence for this workplan: `risk` is not usable as a membership input until
+those lanes are graded.
+
 ```task
 id: ZONE-WP-0001-T03
 status: todo