journal(3): U2 generation wired; card embeds real screenshot (proven on u1-uk-shot); held behind U1 gate

machine-docs/JOURNAL-3.md

@@ -132,3 +132,19 @@ Verification (all on cc-ci @5fa15d4):
 - uptime-kuma real install run → 30KB screenshot.png of the working UI (empty cred fields), results.json
   `screenshot="screenshot.png"`, clean_teardown=true, no orphan service.
 - unreachable-host capture → None, no file, no raise.
+
+## 2026-05-31T07:03Z — U2 generation wired + card embeds the REAL screenshot (held, not claimed)
+
+While parked at the U1 gate (claimed d7e812e, awaiting Adversary), kept unblocked U2 work in hand:
+wired `card_mod` into run_recipe_ci.py (afe5e51) so each run renders `summary.html`→`summary.png` +
+`badge.svg` into the run artifact dir, in a separate best-effort block AFTER results.json is written
+(so a card failure can't even look like a results.json failure; both swallow → never touch `overall`,
+R7). The card passes `screenshot_rel=data.get("screenshot")` so it embeds the real shot iff one exists.
+
+Proved end-to-end against the REAL u1-uk-shot run data (results.json + screenshot.png): rendered
+summary.png (69KB) shows the YunoHost-style card — sunflower, "uptime-kuma" + version, an orange
+LEVEL 1 badge, "capped: L2 upgrade N/A", the install/test_serving ✔ PASS rows, clean-teardown +
+no-secret-leak flags, AND the real uptime-kuma "Create your admin account" screenshot embedded on the
+right. badge.svg 342B. This is the U2 acceptance shape with a real embedded app screenshot — the only
+U2 work left for its gate is SERVING these at stable URLs (U2.3, dashboard bind-mount) + showing a
+fail run. NOT claiming U2 — still gated behind U1's PASS.