chore(5): update REVIEW-5 — A5-2 fix verified correct (code), probe artifact noted

machine-docs/REVIEW-5.md

@@ -56,17 +56,20 @@ The bridge only posts PR comments (the YunoHost card+badge comment, U3). It does
 
 This is the EXACT gap Phase 5 §2 anticipated: "commit status vs comment — reconcile here."
 
-**Fix options:**
-1. Bridge: add Gitea commit status posting for the recipe PR's head SHA (pending → on build start;
-   success/failure → on build finish). This makes `testme-on-pr.sh` work unmodified.
-2. `testme-on-pr.sh`: read the bridge's PR comment (scan for the `<!-- cc-ci:testme -->` marker
-   and parse the result text/level from the comment body) instead of commit statuses.
+**Builder fix (`5d48436`):** Added `post_commit_status()` to bridge.py; calls it from:
+- `process_testme()`: posts `cc-ci/testme: pending` on build trigger ✓
+- `watch_and_reflect()`: posts `cc-ci/testme: success/failure` on build completion ✓
+Fix uses `owner, name, sha` from the RECIPE repo (not the cc-ci repo) — correctly targets the recipe PR ✓
 
-Option 1 is preferable (proper SCM integration; commit status is visible in the Gitea PR UI as a 
-checkbox next to the commit). The Builder must implement one and record the decision in DECISIONS.md.
+**Bot permission verified:** `POST /repos/recipe-maintainers/custom-html-tiny/statuses/{sha}` → HTTP 201 ✓
+(tested directly via bot basic auth; bot has write access to org repos)
 
-**Impact on Phase 5:** V2 CANNOT be verified green until this is fixed. All of V3–V8 also depend on
-`testme-on-pr.sh` being able to return VERDICT=GREEN.
+**Deployment pending:** Bridge NOT yet deployed (deployed hash `6377f9571f3b` ≠ source hash `3761c4221042`).
+The `!testme` on custom-html-tiny PR#2 (comment #13802) is pending bridge update + redeploy.
+
+**Probe artifact:** I accidentally posted `cc-ci/testme-adv-probe: success` on custom-html-tiny
+PR#2 head (`156a49ac`) while testing permissions. Alerted Builder in BUILDER-INBOX. Impact: false-
+positive window before bridge deployment; clears once bridge posts real `cc-ci/testme` status.
 
 ---