status(3): ## DONE — U5 PASS (Adversary @15b3057); all R1–R8 Adversary-verified, no VETO

Phase 3 complete. U5 gate PASS @2026-05-31T13:13Z:
- R6 per-recipe badge endpoint live (custom-html/uptime-kuma level 4, keycloak unknown fallback)
- R8 docs/results-ux.md §1-5 complete, no TODOs
- R7 render-kill: exit 0, install pass, results.json intact, no card/screenshot (u5-renderkill3)
- R7 broad leak scan: 0 real secret values in any artifact or PR comment
All R1–R8 verified <24h; STATUS-3 flipped to ## DONE.

machine-docs/BACKLOG-3.md

@@ -77,8 +77,9 @@ Milestones U0–U5 (plan §5); each ends with an Adversary gate. DoD items R1–
       new defense-in-depth try/except on the screenshot call site (`799cceb`); broad secret scan over
       ALL published text artifacts + PR comments → zero real secret values (only `no_secret_leak`
       flag name/label).
-- GATE U5: **CLAIMED** (awaiting Adversary) — R6 badge live, R8 docs complete, R7 render-kill +
-      leak-scan clean. On Adversary U5 PASS + all R1–R8 verified <24h, no VETO → flip STATUS-3 `## DONE`.
+- GATE U5: **PASS** (Adversary REVIEW-3 @15b3057, 2026-05-31T13:13Z) — R6 badge live (3 URLs verified),
+      R8 docs complete (§1-5, no TODOs), R7 render-kill artifacts confirmed + broad leak scan clean
+      (0 real secret values in any artifact/comment). All R1–R8 verified. STATUS-3 `## DONE` flipped.
 
 ## Adversary findings
 (Adversary owns this section — Builder does not edit.)

machine-docs/STATUS-3.md

@@ -280,7 +280,7 @@ The cardinal U4 invariant: the grid + history are a faithful, never-greener proj
 `results.json`; a failed/levelless run is shown as such (no inflated level, no screenshot it didn't
 produce); rendering is read-only over the RO-bind-mounted artifacts.
 
-## Gate: U5 — CLAIMED, awaiting Adversary  (Badges + docs + hardening; R6, R7, R8 — FINAL gate)
+## Gate: U5 — PASS (Adversary REVIEW-3 @15b3057, 2026-05-31T13:13Z; R6+R7+R8 cold-verified, no VETO)  (Badges + docs + hardening; R6, R7, R8 — FINAL gate)
 
 **WHAT.** The last milestone: (a) **R6** — a per-recipe **latest-level badge** endpoint
 `/badge/<recipe>.svg` (shields-style, coloured by level, embeddable in a recipe README; falls back to
@@ -341,14 +341,20 @@ flag name/label, zero real values, 0 in comments; (6) all unit tests green.
 The cardinal U5 invariant: cosmetics (card, screenshot, badge, comment image) **never** block/fail a
 run or change its verdict — they degrade to text/omission; and no published artifact leaks a secret.
 
-**When the Adversary's U5 PASS lands and REVIEW-3 shows all R1–R8 verified <24h with no VETO → I flip
-STATUS-3 to `## DONE`.**
+**Adversary U5 PASS @15b3057 (2026-05-31T13:13Z) — all R1–R8 verified <24h, no VETO → STATUS-3 `## DONE` flipped.**
 
-## In flight
-(none — U5 (final gate) claimed; parked awaiting the Adversary. On U5 PASS + all R1–R8 verified → DONE.)
+## DONE
 
-## Blocked
-(none)
+**Phase 3 complete.** All R1–R8 Adversary-verified (U0–U5 all PASS, no VETO, all within 24h).
+
+- R1 (level ladder) ← U0 PASS @07:05Z
+- R2 (image PR comment) ← U3 PASS @09:51Z
+- R3 (summary card) ← U2+U3+U4 PASS @07:48Z+09:51Z+10:04Z
+- R4 (screenshot) ← U1 PASS @07:15Z
+- R5 (dashboard polish) ← U4 PASS @10:04Z
+- R6 (badges) ← U5 PASS @13:13Z
+- R7 (safe & robust) ← U1+U2+U3+U5
+- R8 (docs) ← U5 PASS @13:13Z
 
 ## Note — Drone repo reactivation (infra, recorded for the Adversary)
 The Hetzner-migration Drone DB reset left `recipe-maintainers/cc-ci` **inactive** (bridge log `drone