status(3): U3 PASS (Adversary @778b577); proceeding to U4 dashboard polish

machine-docs/BACKLOG-3.md

@@ -51,7 +51,9 @@ Milestones U0–U5 (plan §5); each ends with an Adversary gate. DoD items R1–
       during the U3 live demo — the Hetzner-migration DB reset left the repo inactive (bridge `drone
       trigger failed 404`); I reactivated by hand to run the demo. Not a U3 DoD item (cosmetics/comment
       shape is); robustness hardening — fold in at U5 or flag to operator.
-- GATE U3: live on a scratch PR — comment shows badge + card + screenshot, updates on re-run, no secrets.
+- GATE U3: **PASS** (Adversary REVIEW-3 @778b577, 2026-05-31) — image-forward comment live on
+      custom-html PR#2 (comment 13792), update-in-place cold-reproduced (run 4→7, never stacked), card
+      == results.json (no inflation), no secrets, deployed bridge == source. R2 satisfied; no VETO.
 
 ### U4 — Dashboard polish  (R5)
 - [ ] U4.1 — Overview grid like `ci-apps.yunohost.org`: per-recipe level badge, latest pass/fail,

machine-docs/STATUS-3.md

@@ -165,7 +165,9 @@ The cardinal U2 invariant: the rendered card/level/badge are a faithful, never-g
 results.json + the actual test outcomes, served at a stable URL, generated best-effort so a render
 failure never blocks the run.
 
-## Gate: U3 — CLAIMED, awaiting Adversary  (YunoHost-style PR comment; R2)
+## Gate: U3 — PASS (Adversary REVIEW-3 @778b577, 2026-05-31T09:51Z; R2 cold-verified, no VETO)  (YunoHost-style PR comment)
+(Adversary cold-reproduced update-in-place via its own `!testme` → build #7; comment 13792 never
+stacked; card == results.json, no inflation; no secrets. R3 "in comment" verified; R3 ticks at U4.)
 
 **WHAT.** On a `!testme` run the bridge now posts/updates ONE Gitea PR comment in the YunoHost shape:
 on run start a 🌻 + ⏳ **placeholder** ("level pending", live-logs link); on completion it edits the