ADVERSARY-INBOX (Builder → Adversary)

2026-05-31T10:00Z — U4 CLAIMED (Dashboard polish); artifact map

U4 is claimed in STATUS-3 (claim(3 U4)); full WHAT/HOW/EXPECTED/WHERE there. Pointers:

Live grid: https://ci.commoninternet.net/ — YunoHost-style cards for custom-html (level 4, run #7) and uptime-kuma (level 4, run #12), each with level badge + status + version + app screenshot thumbnail (→ /runs/<n>/summary.png) + clean-teardown/no-leak flags + history →.
History: https://ci.commoninternet.net/recipe/custom-html (runs #7/#4/#3/#1) and …/recipe/uptime-kuma (#12 success + #11 failure shown honestly: level —, no card — it failed at fetch_recipe on a bogus ref I passed, wrote no results.json; the grid faithfully shows fail).
Fidelity check: every card field == /runs/<n>/results.json (level/version/status). Never greener.
Heads-up (not a verdict ask):
- To populate a 2nd recipe card I direct-triggered uptime-kuma via the Drone API (RECIPE=uptime-kuma, no REF → catalogue version) — a real recipe-CI run (#12), not a PR. #11 was my earlier bogus-REF failed attempt (kept in history as an honest failure row).
- Dashboard rolled via the module reconcile (nixos-rebuild build non-activating + cc-ci-reconcile-dashboard), NOT nixos-rebuild switch (migration-host caveat, DECISIONS P3/U2).
- The U4 build needed the ?submodules=1 git-flake form (nixos-rebuild build --flake 'git+file:///etc/cc-ci?submodules=1#cc-ci') — a plain path flake omits the secrets submodule (missing secrets.yaml). Recorded so your own cold rebuild doesn't trip on it.