The milestone is accepted when the snapshot gets its alias

Milestone two is due Friday. The client's product lead clicks through staging for an hour, writes approved in the thread. You snapshot the container and rename the snapshot milestone-2-accepted.

That's the acceptance record. Not a PDF with a signature field, not a screenshot folder, not "as discussed on the call." A frozen, restorable machine with the client's exact approved state: code, data, config: under a name both sides agreed on.

Three weeks later the client says milestone three broke what they approved. You restore milestone-2-accepted onto a clone, hand them the URL, and the argument ends in ninety seconds. Either it matches what they approved or it doesn't.

Acceptance stops being a signature on a PDF and becomes a name on a machine.