status(3): U2 PASS (Adversary @324d84d); start U3 (YunoHost-style PR comment) + note do_HEAD polish item

machine-docs/BACKLOG-3.md

@@ -33,8 +33,12 @@ Milestones U0–U5 (plan §5); each ends with an Adversary gate. DoD items R1–
 - [x] U2.3 — Card + badge + screenshot + results.json served at stable URLs
       `/runs/<id>/{summary.png,badge.svg,screenshot.png,results.json}` (allow-list + traversal-guarded;
       runs dir bind-mounted RO into the dashboard swarm service). LIVE over HTTPS, verified.
-- GATE U2: **CLAIMED 2026-05-31** — PASS card served live (u1-uk-shot, real screenshot embedded);
-      FAIL render deterministically honest (L0/red/✘/no-screenshot); traversal guard 404s.
+- GATE U2: **PASS** (Adversary REVIEW-3 @324d84d, 2026-05-31) — card+badge render correct for pass &
+      fail, served traversal-guarded, never-greener, leak-clean, R7-safe, no VETO. (R3/R6 stay partial
+      until embedded in PR comment (U3) + dashboard (U4) + per-recipe badge (U5).)
+- Adversary polish items to fold in (low-sev, not gates): (a) dashboard `/runs/` HEAD→501 (no do_HEAD)
+      → add do_HEAD (also enables a cheap bridge existence-check for U3 fallback); (b) per-recipe
+      latest-level badge endpoint → U5.
 
 ### U3 — YunoHost-style PR comment  (R2)
 - [ ] U3.1 — Bridge posts a placeholder comment on run start (⏳ + live-logs link).