docs: correct M3 milestone wording

TMS34010.md

@@ -50,8 +50,9 @@ pointer returns. Narrow (`i8`/`i16`) parameters, `i64`, floats/aggregates,
 varargs, `sret`/`byval`/`inreg`/`nest` and indirect calls fail loudly with an
 `M2 ...` diagnostic. Ordinary `tail` markers are **demoted** to ordinary
 calls (`LowerCall` clears `IsTailCall`); `musttail` is not implemented and
-M2 C does not emit it. Real tail calls are M3. Narrow loads/stores inside a
-function stay supported (`MOVB`, FS0 `MOVE`). The optimizer's `returned` parameter attribute
+M2 C does not emit it. Real tail calls remain a later milestone (M4+); narrow
+loads/stores inside a function stay supported (`MOVB`, FS0 `MOVE`). The
+optimizer's `returned` parameter attribute
 is **accepted**: it is only an optimization hint and does not change the
 stack-slot ABI. `m2-returned.ll` pins that; `m2-reject-sret.ll` keeps the
 rejection of the ABI-affecting attributes.
@@ -348,16 +349,19 @@ LLVM_SRC=$PWD/build/llvm-clean LLVM_BRANCH=m3 ./scripts/build-llvm.sh
 scripts/tests/m3/run.sh             # layout/symbols, GSPA/GSPLNK, then MAME
 scripts/tests/m3/dis-roundtrip.sh   # linked .text decoded with dis34
 scripts/tests/m3/diff/check.sh      # branch/Xlib shape vs. the 1987 TI compiler
+scripts/tests/m3/diff/negative-control.sh  # the check must reject a wrong TI displacement
 scripts/tests/m3/layout.sh          # Display/Screen bit displacements (also run by run.sh)
 tools/tms-bitaddr/tests/run.sh      # GEP scaling/normalization
 ```
 
 Expected: `layout.sh: PASS`, `M3 MAME: PASS`, `M3 dis34 round-trip: PASS`,
-`M3 diff: PASS` and `tms-bitaddr: PASS`. The MAME gate pins
+`M3 diff: PASS`, `M3 diff negative controls: PASS` and `tms-bitaddr: PASS`.
+The MAME gate pins
 `VT1200_MONITOR=VR319` and requires the white client pixels described above.
 The differential check uses stored golden assembly from the 1987 TI compiler
 and does not run DOSBox; the MAME/dis34 gates do. The M2 gates
-(`scripts/tests/m2/`) still pass on `m3`; the M1 harness
+(`scripts/tests/m2/`) still pass on `m3` (verified 2026-11-11: `M2 MAME`,
+`M2 dis34 round-trip` and `M2 diff` all `PASS`); the M1 harness
 (`scripts/tests/m1/`) lives on the project's `m1` branch and is not an M3 gate.
 The project README lists the prerequisites (DOSBox, mtools, the VT1200 SDK
 image, MAME).