journal(3): U2 render-path de-risked headless (pass+fail cards render correct, no inflation); parked at U0 gate

machine-docs/JOURNAL-3.md

@@ -69,3 +69,33 @@ Design notes / WHY:
 Pre-existing repo lint RED (94 reformat + 36 ruff errors on origin/main, ruff 0.7.3 on CI devshell):
 not mine, flagged in STATUS for the operator. My new files are clean; run_recipe_ci.py left better
 than found (1 vs 4 errors). NOT reformatting 94 cross-phase files in Phase 3 (out of scope, huge noise).
+
+## 2026-05-31T06:50Z — U2 render-path de-risked headless on cc-ci (parked at U0 gate)
+
+While U0 is CLAIMED awaiting the Adversary (its cold runs adv-cht=L2 / adv-uk=L4 reproduced my
+claimed levels exactly @06:06/06:09 — swarm clean, no orphans), I kept the unblocked U2 render path
+moving. Ran a real headless Playwright PNG render on cc-ci of the pure `harness.card` renderers from
+two fixtures (a passing L4 uptime-kuma and a failing L0 custom-html-tiny):
+
+    cc-ci-run /tmp/smoke_card.py  (renders render_card_html → render_card_png + level_badge_svg)
+    pass: png size=119765  badge svg=342B
+    fail: png size=56353   badge svg=342B
+
+Pulled both PNGs back and eyeballed them:
+- **pass card** — level 4 in a yellow-green badge, full per-stage/per-test ✔ rows with PASS labels,
+  inline sunflower renders, `clean teardown` + `no secret leak` flags green. Fonts clean (no tofu).
+- **fail card** — level 0 in a red badge, install FAIL row, `no screenshot` placeholder shown.
+- **No inflation:** the fail card honestly shows L0/red/FAIL; the card computes nothing, it reports
+  the dict verbatim (cardinal guardrail upheld at the render layer).
+
+This proves the U2 render path (HTML→PNG headless) works on the real cc-ci browser for both pass and
+fail runs — the U2 acceptance shape — *before* I wire it into run_recipe_ci.py (which I will not do
+until U0 PASSes, to avoid rework if the schema changes).
+
+WIRING CONTRACT noted for U1/U2: the broken-image icon seen on the pass fixture is only because the
+fixture set `screenshot:"screenshot.png"` with no file present. The wiring MUST set
+`data["screenshot"]` truthy ONLY when the captured PNG actually exists (screenshot.capture returns
+None on failure) — then the card's `show_shot` gate falls back to the `no screenshot` placeholder,
+as the fail fixture already proves. No renderer change needed.
+
+Not claiming U2 — still parked at the U0 gate per §6.1 (no advance past a gate without its PASS).