status(2): Q0 CLAIMED — harness additions + custom-html parity reference proven

Q0.1 harness.http canonical Phase-2 recipe-test HTTP API.
Q0.2 discovery recurses into functional/+playwright/ subdirs.
Q0.3 custom-html PARITY.md + parity-port functional/health_check.
Q1.1 +2 recipe-specific functional + playwright smoke.

Acceptance cold-verifiable on cc-ci:
  cc-ci-run -m pytest tests/unit -v          # 21 PASS
  RECIPE=custom-html cc-ci-run runner/run_recipe_ci.py  # all 5 stages PASS, deploy-count=1
  head_ref=8a026066 == chaos-version=8a026066 (HC1 non-vacuous)

Q0.4 (dep resolver) deferred to Q2 (no Q1 recipe needs deps).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/JOURNAL-2.md

@@ -58,3 +58,65 @@ $REF). Per HC2, repo-local PR-authored code runs only for recipes on
 
 Will now seed DECISIONS, then begin Q0.1 (vendor helpers into runner/harness/) — keeping the
 custom-html overlay working as the reference recipe. The /loop will self-pace.
+
+## 2026-05-28 — Q0 + Q1.1 landed; Q0 gate CLAIMED
+
+Worked through Q0.1, Q0.2, Q0.3, Q1.1 in one stretch since they're tightly coupled:
+
+**Q0.1** — `runner/harness/http.py` is the canonical Phase-2 recipe-test HTTP API. Mirrors
+`recipe-maintainer/utils/tests/helpers.py` shape (same function names, same return shapes) so
+parity ports read 1:1, but self-contained (cc-ci runtime does NOT import recipe-maintainer per
+DECISIONS Phase 2). Existing `lifecycle.http_get`/`http_fetch`/`http_body` stay — they're for
+infra-level checks like Traefik-404 detection. `harness.http` is for recipe tests' API calls. SSL
+context is `CERT_NONE` because per-run domains use the wildcard cert; the real-cert verification
+happens in `generic.served_cert` once per run via the install tier.
+
+**Q0.2** — discovery now recurses into `functional/` + `playwright/` subdirs. Surgically small change
+to `custom_tests`; doesn't disturb the lifecycle-tier discovery (overlays still live at top-level).
+Two new unit tests prove it (recursion works + HC2 gate still applies to subdirs). Pre-existing 8
+discovery unit tests still pass.
+
+**Q0.3 / Q1.1** — custom-html as the reference recipe:
+- `PARITY.md` mapping table: 1 parity row (health_check) + 2 recipe-specific rows
+  (content_roundtrip + content_type_header) + a backup-integrity reference + a playwright reference.
+- `functional/test_health_check.py` — parity port with `SOURCE: recipe-info/custom-html/tests/health_check.py` comment for audit.
+- `functional/test_content_roundtrip.py` — NEW: write a `uuid.uuid4()` marker into nginx's
+  `/usr/share/nginx/html` volume, fetch over HTTPS, assert exact-byte match. Non-vacuous: a stale page
+  or misrouted backend can't return our random content.
+- `functional/test_content_type_header.py` — NEW: write `.html` + `.txt` files with same body
+  ("hello"), HEAD each, assert `Content-Type: text/html` and `text/plain`. Caught the case where nginx
+  MIME map breaks even when 200 still works.
+- `playwright/test_browser_smoke.py` — P6: Chromium renders HTML, no console errors.
+
+**E2E cold-verifiable evidence on cc-ci** (log `/root/ccci-q0-customhtml-full.log`):
+```
+RECIPE=custom-html cc-ci-run runner/run_recipe_ci.py
+===== TIER: install (generic=run, overlay=cc-ci:tests/custom-html/test_install.py) =====
+  ... generic + overlay both PASS
+===== TIER: upgrade =====
+  upgrade→PR-head: head_ref=8a026066 chaos-version=8a026066 version=1.10.0+1.28.0→1.11.0+1.29.0
+  ... generic + overlay both PASS (data marker "upgrade-survives" survived chaos redeploy)
+===== TIER: backup =====
+  ... generic + overlay both PASS
+===== TIER: restore =====
+  ... generic + overlay both PASS (volume restored to "original")
+===== TIER: custom =====
+  ... 4 PASS (parity health_check, content_roundtrip, content_type_header, browser_smoke)
+===== RUN SUMMARY =====
+deploy-count = 1 (expect 1)
+  install : pass   upgrade : pass   backup : pass   restore : pass   custom : pass
+```
+
+That's the full Phase-2 pattern proven on the reference recipe:
+- additive generic+overlay across 4 lifecycle ops (HC3),
+- HC1 PR-head deploy proof via chaos-version label match,
+- recipe-aware backup data-integrity (marker survives backup/restore cycle),
+- 2 NEW recipe-specific functional tests beyond parity (P3 floor met),
+- Playwright UI flow (P6),
+- deploy-once + clean teardown.
+
+**Q0.4 (dep resolver) deferred to Q2**: no Q1 recipe (custom-html + n8n) has deps, and the resolver
+shape will be much clearer once we have keycloak+authentik to deploy as deps. Logged in BACKLOG-2.
+
+**Q0 gate now CLAIMED.** Working in parallel on Q1.2 (n8n) while the Adversary cold-verifies.
+