DONE(1d): Phase 1d complete — DG1-DG8 all Adversary cold-verified PASS, NO VETO

Adversary G4 FINAL sign-off (4a6d6cf): own !testme -> build 154 green, !testmexyz rejected,
generic suite e2e, per-op report, deploy-count=1, clean teardown, secret-leak clean.
F1d-1 + F1d-2 closed. STATUS-1d flipped to ## DONE.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/BACKLOG-1d.md

@@ -33,7 +33,7 @@
 - [x] Proof on custom-html-tiny: install FAILS without the hook (404, graceful), PASSES with it.
 - [x] DG3 N/A-skip run-demo: custom-html-tiny non-backup-capable -> backup/restore = skip (Run B).
 
-### G4 — !testme e2e + per-op reporting + docs + cold verify (DG6, DG7, DG8)
+### G4 — !testme e2e + per-op reporting + docs + cold verify (DG6, DG7, DG8) — Adversary PASS @2026-05-28
 - [x] !testme on an unconfigured recipe → full generic suite via real pipeline; per-op pass/fail/skip.
       DONE (CLAIMED): build #153 — hedgedoc PR#1 (no overlays) → bridge <60s → all 4 tiers ran
       tests/_generic → install/upgrade/backup/restore=pass, custom=skip, deploy-count=1, clean
@@ -42,7 +42,8 @@
       (keycloak/cryptpad/matrix-synapse/n8n/lasuite-docs → assertion-only deploy-once contract).
 - [x] docs/: generic suite, overlay convention (names/locations/precedence), install-steps hook,
       how to add an overlay — b756e72 (docs/testing.md + enroll-recipe.md + README).
-- [ ] Request Adversary cold-verify DG1–DG8 → flip STATUS-1d to ## DONE.
+- [x] Request Adversary cold-verify DG1–DG8 → flip STATUS-1d to ## DONE. DONE @2026-05-28:
+      Adversary G4 PASS (4a6d6cf), DG1–DG8 all verified, NO VETO; STATUS-1d → ## DONE.
 
 ## Adversary findings (Adversary-only)
 

machine-docs/STATUS-1d.md

@@ -1,5 +1,16 @@
 # STATUS — Phase 1d (generic test suite + layered recipe overlays)
 
+## DONE
+**Phase 1d COMPLETE @2026-05-28.** All DG1–DG8 Adversary cold-verified PASS within 24h in REVIEW-1d
+(final sign-off commit 4a6d6cf — DG1·DG2·DG3·DG4·DG4.1·DG5·DG6·DG7·DG8 all PASS, NO VETO; findings
+F1d-1 + F1d-2 both CLOSED). The Adversary cold-verified DG6 with its OWN independent `!testme` on
+hedgedoc PR#1 → Drone build **154** (success): `!testme` triggered <60s, `!testmexyz` did NOT trigger,
+all 4 tiers ran tests/_generic (no-overlay⇒generic), per-op `install/upgrade/backup/restore=pass,
+custom=skip`, deploy-count=1, clean teardown, PR comment `✅ passed → …/154`, secret-leak grep clean.
+Evidence: REVIEW-1d "## G4 / DG6+DG7+DG8 — PASS @2026-05-28". Builder build #153 = the same e2e green.
+Loop stops; the generic-suite + layered-overlay foundation is ready for Phase 2.
+
+
 **Phase plan (SSOT):** `/srv/cc-ci/cc-ci-plan/plan-phase1d-generic-test-suite.md`
 **Loop state for THIS phase:** STATUS-1d / BACKLOG-1d / REVIEW-1d / JOURNAL-1d (DECISIONS.md shared).
 The repo's STATUS.md/BACKLOG.md/REVIEW.md (Phase 1) and STATUS-1b/1c (DONE) are HISTORY, not this
@@ -28,15 +39,15 @@ per-recipe overlay authoring is Phase 2.
 - [x] **DG5** — Custom install-steps hook + graceful-generic rule; fail-without / pass-with proof.
       **Adversary PASS @2026-05-28** (custom-html-tiny: fail-without / pass-with the install_steps.sh hook).
 - [x] **DG6** — `!testme` e2e on an unconfigured recipe through the real pipeline; per-op reporting.
-      **CLAIMED @2026-05-28** — build #153: `!testme` on hedgedoc PR#1 (no overlays) → bridge triggered
+      **Adversary PASS @2026-05-28** (own !testme→build 154; !testmexyz rejected). Was CLAIMED — build #153: `!testme` on hedgedoc PR#1 (no overlays) → bridge triggered
       (<60s, REF=PR head) → Drone → all 4 tiers ran tests/_generic → per-op install/upgrade/backup/
       restore=pass, custom=skip, deploy-count=1 → clean teardown (no service/volume/secret/app leaked)
       → PR comment `✅ passed → …/153`. Awaiting Adversary cold-verify.
 - [x] **DG7** — Real, DRY, clean: no softened/skip/xfail assertions; generic in the shared harness;
-      teardown always; respects MAX_TESTS. **CLAIMED** — afd75a4 migrated the remaining overlays to
+      teardown always; respects MAX_TESTS. **Adversary PASS @2026-05-28** — afd75a4 migrated the remaining overlays to
       the assertion-only deploy-once contract; build #153 left zero residual. Awaiting Adversary.
 - [x] **DG8** — Documented (docs/ explains the generic suite, overlay convention, hook) + cold-verify.
-      **CLAIMED** — b756e72 (docs/testing.md + enroll-recipe.md + README). Awaiting Adversary cold-verify.
+      **Adversary PASS @2026-05-28** — b756e72 (docs/testing.md + enroll-recipe.md + README).
 
 ## Milestones (plan §3)
 - **G0** — Generic install + deploy-once orchestrator; green on custom-html-tiny. *Accept: DG1.*
@@ -74,13 +85,11 @@ composition, data-continuity, deploy-count=1, precedence unit tests 5/5). No VET
 **G3 (DG5 + DG3 N/A-skip) — Adversary PASS @2026-05-28.** No VETO. DG1–DG5 all Adversary-verified;
 F1d-1 + F1d-2 closed.
 
-**G4 (DG6 + DG7 + DG8) — CLAIMED @2026-05-28, awaiting Adversary cold-verify.** Evidence: build #153
-(`!testme` on hedgedoc PR#1, the unconfigured recipe) — bridge trigger <60s, REF=PR head, all 4 tiers
-ran tests/_generic (no-overlay⇒generic invariant), per-op install/upgrade/backup/restore=pass +
-custom=skip, deploy-count=1, clean teardown (zero residual on swarm/abra), PR comment `✅ passed
-→ …/153`. DG7 migration afd75a4; DG8 docs b756e72 (docs/testing.md). **Requesting the Adversary
-re-run the DG1–DG8 acceptance checks cold (plan §1 / §6.1); on PASS for all, I flip to ## DONE.**
-No VETO standing.
+**G4 (DG6 + DG7 + DG8) — Adversary PASS @2026-05-28 (FINAL sign-off, commit 4a6d6cf).** The Adversary
+cold-verified with its OWN `!testme` (build 154): trigger <60s, `!testmexyz` rejected, all tiers
+generic, per-op install/upgrade/backup/restore=pass + custom=skip, deploy-count=1, clean teardown,
+PR outcome reflected, secret-leak grep clean. DG7 (no-regression/DRY/teardown-always) + DG8 (docs)
+verified. **DG1–DG8 all PASS, NO VETO → ## DONE written.** Phase 1d complete.
 
 Design (DECISIONS.md Phase 1d): tier model with the lifecycle OP owned by the shared harness (test
 files = assertions only); override precedence repo-local > cc-ci > generic + extend-by-composition;