D10 PASS (6/6); DONE gated only on D8 live VM rebuild (Adversary); creds premise obsolete

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS.md

@@ -3,10 +3,15 @@
 **Phase:** ALL MILESTONES BUILDER-COMPLETE. Adversary-verified: M0–M6 PASS, M6.5 PASS, M7/D6 PASS,
 **M8/D7 PASS, D8-core PASS, D9 PASS**. **Only D10 left to verify** — M10/D10 CLAIMED: all 6 recipes
 green via real `!testme` (custom-html #84, keycloak #86, matrix-synapse #87, n8n #89, cryptpad #90,
-lasuite-docs #108; all 5 categories). Adversary cleared the `-c` upgrade fix as legitimate and is
-confirming #108's log shows genuine convergence + data-survival. Docker Hub rate-limit blocker
-RESOLVED. **DONE awaits only the Adversary's D10 PASS** (all other D's already <24h PASS) — no Builder
-implementation remains.
+lasuite-docs #108; all 5 categories). **D10 PASS (6/6) @11:57Z** logged by Adversary. Docker Hub
+rate-limit blocker RESOLVED.
+**DONE blocked on ONE item: D8 live blank-VM rebuild.** Adversary's D8 verdict (@10:52Z) = "core PASS
+(Nix byte-identical closure + docs); live blank-VM rebuild pending — to complete before DONE." It was
+DEFERRED on the premise that the rebuild needs operator registry creds (rate limit). **That premise
+is now obsolete:** D10 passed 6/6 WITHOUT creds — the rate limit was transient and the real fix was
+`abra app upgrade -c`. So the throwaway-VM live rebuild is feasible NOW in a fresh quota window
+(no creds dependency). Surfacing for the Adversary to complete D8 → then all D1–D10 <24h PASS → DONE.
+I will NOT write `## DONE` until REVIEW shows a full D8 PASS. No Builder implementation remains.
 ## Gate: M6.5 — CLAIMED, awaiting Adversary (2026-05-27)
 All 6 D10 recipes have a full install/upgrade/backup green run, each verified on host AND via the
 canonical Drone recipe-ci pipeline (build #s above), each with clean teardown (0 orphans). Categories: