diff --git a/docs/REWORK_PLAN.md b/docs/REWORK_PLAN.md
index 23ef7e8..e5804c7 100644
--- a/docs/REWORK_PLAN.md
+++ b/docs/REWORK_PLAN.md
@@ -120,7 +120,7 @@ Each milestone = independently mergeable PR upstream (unless marked ❌).
 | 2 | frontend WS adapter — app runs vs backend, cross-device works | yes |
 | 3 | characterization tests lock current behavior | yes |
 | 4 | resolve initiative rotation corruption (BUG-5) | yes |
-| 5 | docker compose in-house | smoke |
+| 5 | docker single container (caddy+node) | smoke ✅ |
 | 6 | _moved to TODO backlog (feature work)_ | - |
 | 7 | playwright multi-window e2e (deferred) | e2e |
 | 8 | (future) public exposure | - |
@@ -169,16 +169,18 @@ Each milestone = independently mergeable PR upstream (unless marked ❌).
 - Tests: `turn.skip.test.js`, `turn.dry.test.js` (advance parity lock).
 - **Upstream-PRable:** ✅ bug fix.
 
-### Milestone 5 — Docker compose
-- `docker-compose.yml`:
-  - `backend` service (Node + sqlite volume)
-  - `frontend` service (static build served via **Caddy**)
-  - Caddy reverse-proxies `/api` + `/ws` → backend, auto WS upgrade, HTTP basic auth
-- Caddy chosen over nginx: simpler config, native WS, one file `Caddyfile`.
-- Profiles: `firebase` (frontend only, current behavior) vs `backend` (full stack).
-- Run: OrbStack local now; remote docker context later.
-- **Exit criteria:** `docker compose up` runs full stack in-house.
-- **Upstream-PRable:** ❌ divergence.
+### Milestone 5 — Docker compose ✅
+- Single container: caddy (front, static + proxy) + node backend (internal :4001).
+- Files in `docker/` tree (kept separate from upstream root Dockerfile):
+  - `docker/Dockerfile` — build FE + BE, runtime caddy+node
+  - `docker/Caddyfile` — proxy /api + /ws to node, static SPA fallback
+  - `docker/entrypoint.sh` — node bg + caddy fg
+  - `docker/docker-compose.yml` — one `app` service, volume for sqlite
+- Run: `docker compose -f docker/docker-compose.yml up --build` (or `cd docker && docker compose up --build`). Port 8080.
+- No `image:` field => compose auto-names, never pulls service image (private).
+- **Exit criteria:** `docker compose up` runs full stack in-house. ✅ DONE.
+  - Verified: REST roundtrip, WS subscribe+push, replay 20 rounds CLEAN (0 skips/doubles/shifts), UI styled (Tailwind compiles).
+- **Upstream-PRable:** ✅ separate docker/ tree, root Dockerfile untouched, firebase default preserved.
 
 ### Milestone 6 — Undo rework — _MOVED to TODO backlog_
 - Moved: feature work (transactional undo), not infra. Lives in `TODO.md` now.
@@ -230,7 +232,7 @@ Each milestone = independently mergeable PR upstream (unless marked ❌).
 | 2 WS adapter | ⚠️ partial | interface + firebase extract ✅, WS ❌ |
 | 3 characterization tests | ✅ | if storage-agnostic |
 | 4 BUG-5 rotation fix | ✅ | bug fix |
-| 5 docker compose | ❌ | divergence |
+| 5 docker | ✅ | separate docker/ tree, root Dockerfile untouched, firebase preserved |
 | 6 undo (moved to TODO) | - | - |
 | 7 playwright | ✅ | if test infra shared |
 
@@ -257,7 +259,7 @@ Default `STORAGE=firebase` + `AUTH_MODE=none` (unset) = upstream sees literally
 
 ## Current status
 
-- M0 ✅, M1 ✅, M2 ✅, M3 ✅
+- M0 ✅, M1 ✅, M2 ✅, M3 ✅, M4 ✅, M5 ✅
 - Backend live: port 4001, db `./data/tracker.sqlite`
 - Frontend: port 3999 with `REACT_APP_STORAGE=ws`
 - Test suite: ~160 tests (shared + server + FE). Bugs tracked in `TODO.md`.