docs: offboarding's effects confirmed in Google

README.md

@@ -173,8 +173,8 @@ for the Builder's External-only filter, and reading the connected admin and its
 | Suspend / unsuspend | Users (both), Builder (suspend) | not yet |
 | Delete an account | Users, Builder | not yet |
 | Undelete an account | Builder | not yet |
-| Transfer Drive + calendar data | Offboarding, Builder | **confirmed**: as two calls, and the single call offboarding makes (`drive,calendar … all`) was accepted (the first live offboarding, 2026-10-07, GAM 7.48.14); that the transfer *completed* and moved every file is not yet recorded |
-| Remove the leaver from everyone's calendars | Offboarding | **confirmed** the shape (the first live offboarding, 2026-10-07, GAM 7.48.14): GAM visited every user and ended, as expected, on the leaver's own calendar ("Cannot change your own access level", exit 50, tolerated); that a colleague's share was removed is not yet recorded |
+| Transfer Drive + calendar data | Offboarding, Builder | **confirmed**: as two calls, and the single call offboarding makes (`drive,calendar … all`) ran (the first live offboarding, 2026-10-07, GAM 7.48.14), and the operator checked the effects in Google afterwards: the transfer completed |
+| Remove the leaver from everyone's calendars | Offboarding | **confirmed** the shape (the first live offboarding, 2026-10-07, GAM 7.48.14): GAM visited every user and ended, as expected, on the leaver's own calendar ("Cannot change your own access level", exit 50, tolerated); the operator checked the effects in Google afterwards |
 | Add a calendar event (the manager's reminder) | Offboarding | **confirmed**; with an invitee it now adds `sendupdates all` (so they get the invitation email), not yet run live |
 | Share a calendar (add an ACL) | Calendars, Users (their own calendar) | **confirmed** |
 | Subscribe someone, so a shared calendar appears | Calendars, Onboard | **confirmed** |

docs/domains/lifecycle-offboarding.md

@@ -323,9 +323,10 @@ NotSpecified`, and the single `create datatransfer … drive,calendar … all` c
 not recorded). The sweep visited every user and ended exit 50 on the leaver's own primary calendar,
 "Cannot change your own access level" — `all users` includes the still-active leaver, so this happens
 on **every** offboarding and is tolerated as `OWN_ACL` (the mock's default sweep now does the same;
-`SWEEPCLEAN` keeps the exit-0 path for a leaver suspended first). Still unproven live: that the
-transfer completed with nothing left owned, that a colleague's share was removed (only the last
-stderr line of each kind is audited), the reminder with an invitee (`sendupdates all`), and
+`SWEEPCLEAN` keeps the exit-0 path for a leaver suspended first). The operator then worked through
+the after-run checks in Google and reported every effect as expected: the transfer completed, the
+manager has the mailbox, an outside sender gets the auto-reply, the sweep and the reminder did their
+part. Still unproven live: the reminder with an invitee (`sendupdates all`; this run had none) and
 `delete_user`.
 
 ## First live run checklist

docs/guide.md

@@ -112,8 +112,8 @@ transfer has finished.
 **Before:** enter the leaver and the manager and click **Preview steps**. Read every warning. GamGUI
 refuses to offboard the admin it is connected as — revoking that account's access would cut off
 GamGUI mid-run — so connect as a different super admin first if you need to. The routine has run
-live once, every step succeeding; a few effects (the transfer finishing, a colleague's calendar share
-removed) are still unconfirmed, so **work through the
+live, every step succeeding and its effects checked in Google afterwards; for your own first run,
+still **work through the
 [first live run checklist](domains/lifecycle-offboarding.md#first-live-run-checklist)** with it
 open: what to look at in the preview, and what to verify in Google afterwards.
 

docs/plans/2026-09-23-ten-out-of-ten.md

@@ -220,10 +220,9 @@ plan's Phase 0 F1–F3.
   that ends at the guide; `make setup`'s interpreter choice stated as it is; screenshots regenerated
   with the tenant header). **Open:** V1; V3–V5 are new
   scope, and D6 says none for now.
-- **Phase 8** — **mostly done** (D8). The operator's first real offboarding ran 2026-10-07, all eight
-  steps `ok`; README "Live verification status" and the offboarding runbook record what it confirmed.
-  Open: the transfer's completion, a colleague's share removed, the reminder with an invitee, and the
-  account delete.
+- **Phase 8** — **done** for offboarding (D8). The operator's first real offboarding ran 2026-10-07,
+  all eight steps `ok`, and its effects checked in Google; README "Live verification status" and the
+  offboarding runbook record it. Still open: the reminder with an invitee, and the account delete.
 
 **Beyond the plan**, also on the branch (each has a failure-log entry): every confirm step runs what
 its preview held, under a single-use token — offboarding, signatures, onboarding, bulk department,

docs/plans/2026-10-02-configurable-offboarding.md

@@ -95,9 +95,8 @@ the leaver group by group, the memberships recorded in the preview so it can be
 
 ## Before P2 ships
 
-Done in part: the operator's first live offboarding (2026-10-07) ran all eight `ok`. Still open
-before relying on new steps: the transfer's completion and a colleague's share actually removed (the
-runbook's after-run checks).
+Done: the operator's first live offboarding (2026-10-07) ran all eight `ok`, and its effects
+checked out in Google.
 
 ## Status by item