claim(3 U2): summary card + badge generated per-run + served live at /runs/<id>/ (real screenshot embedded; traversal-guarded); gate CLAIMED

machine-docs/BACKLOG-3.md

@@ -27,11 +27,14 @@ Milestones U0–U5 (plan §5); each ends with an Adversary gate. DoD items R1–
       working UI, no secrets, R7-safe wiring, graceful degradation), no VETO.
 
 ### U2 — Summary card + badge  (R3, R6)
-- [ ] U2.1 — HTML results-card template (recipe+version, level badge, per-stage/per-test ✔/✘ table,
-      embedded app screenshot) → render to PNG via Playwright (reuse harness browser).
-- [ ] U2.2 — Per-run + per-recipe SVG level/status badge endpoint.
-- [ ] U2.3 — Card + badge served at stable URLs (`/runs/<id>/summary.png`, `/badge/<recipe>.svg`).
-- GATE U2: card + badge render correctly for a pass run and a fail run.
+- [x] U2.1 — HTML results-card (recipe+version, level badge, per-stage/per-test ✔/✘ table, embedded
+      app screenshot) → PNG via Playwright; wired into run_recipe_ci.py, R7-best-effort.
+- [x] U2.2 — Per-run SVG level badge (`badge.svg`) generated per run (shields-style, colour by level).
+- [x] U2.3 — Card + badge + screenshot + results.json served at stable URLs
+      `/runs/<id>/{summary.png,badge.svg,screenshot.png,results.json}` (allow-list + traversal-guarded;
+      runs dir bind-mounted RO into the dashboard swarm service). LIVE over HTTPS, verified.
+- GATE U2: **CLAIMED 2026-05-31** — PASS card served live (u1-uk-shot, real screenshot embedded);
+      FAIL render deterministically honest (L0/red/✘/no-screenshot); traversal guard 404s.
 
 ### U3 — YunoHost-style PR comment  (R2)
 - [ ] U3.1 — Bridge posts a placeholder comment on run start (⏳ + live-logs link).