diff --git a/machine-docs/STATUS-2.md b/machine-docs/STATUS-2.md
index 7b460e1..83cde70 100644
--- a/machine-docs/STATUS-2.md
+++ b/machine-docs/STATUS-2.md
@@ -55,7 +55,7 @@ at `bitnamilegacy/discourse` but the install tier deploys the prev published ver
 recipe-PR can't unblock testing until upstream releases a fixed version (same class as plausible Q4.7b).
 Scaffolding staged (recipe_meta + postgres-P4 overlays + health, commit ca7acf3); §4.3 create-topic not
 written (deploy blocked). DEFERRED.md 2026-05-29 discourse entry. Node fully torn down/clean.
-**Q4.9 mailu — FULL LIFECYCLE GREEN @2026-05-29 — CLAIMED (see ## Gate Q4.9), awaiting Adversary.**
+**Q4.9 mailu — ✅ Adversary PASS @2026-05-29 (REVIEW-2 `2958eb6`); P4-N/A §7.1 sign-off GRANTED. DONE.**
 install+upgrade(3.0.0→3.0.1)+custom green; backup/restore N/A-skip (no backupbot → P4 N/A, §7.1
 sign-off requested); 2 functional (create-mailbox + send→deliver→fetch mail-flow). TLS_FLAVOR=notls;
 in-container sendmail/doveadm. Commits 916bdd8+8844943; log ccci-mailu-full2. **NEXT: drone Q4.10**
@@ -180,7 +180,11 @@ SKIP no longer yields a GREEN `!testme`.
 
 ## Gate
 
-**Gate: Q4.9 mailu — CLAIMED @2026-05-29, awaiting Adversary.**
+**Gate: Q4.9 mailu — ✅ Adversary PASS @2026-05-29 (REVIEW-2 `2958eb6`).** Cold first-hand full
+lifecycle GREEN ×2: deploy-count=1, real upgrade crossover 3.0.0→3.0.1 (head_ref==chaos-version),
+2 non-vacuous P3 (unique-mailbox create→read-back + unique-marker postfix→dovecot delivery), clean
+teardown; **P4-N/A §7.1 sign-off GRANTED** (no backupbot label, independently confirmed); P5/P6 N/A
+justified. No VETO. mailu enrolled (P1 coverage advanced). (Claim detail retained below.)
 
 **WHAT.** mailu (full email stack: nginx front `app` + admin + postfix `smtp` + dovecot `imap` +
 rspamd `antispam` + webmail + redis `db` + certdumper) runs **install + upgrade + custom GREEN**;