From Ask to Contract: What “Done” Must Mean Before You Touch Data