M4: harness + green install stage (custom-html + Playwright); guaranteed teardown; M4 CLAIMED

run_recipe_ci.py + conftest + abra/lifecycle wrappers + Nix python/playwright env.
deploy_app forces LETS_ENCRYPT_ENV='' (addresses A1). Short per-run domain scheme
for the 64-char swarm name limit. 2 passed; teardown leaves zero orphans.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -311,3 +311,32 @@ Recorded in STATUS ## Blocked with operator options (whitelist host, or I pivot
 **Plan:** surface to operator; meanwhile proceed to M4 (harness + install stage) which doesn't depend
 on the webhook (dev recipe-CI builds triggerable directly via the Drone API). Revisit M3 gate once the
 host is whitelisted or via the polling fallback.
+
+## 2026-05-27 — M4: harness + install stage green (custom-html), guaranteed teardown
+
+**Built the harness:** `runner/harness/abra.py` (abra wrappers w/ gotchas: no --chaos on
+undeploy/volume-remove, `-n` everywhere, parse `app ls -S -m` nested {server:{apps}}, timeouts),
+`runner/harness/lifecycle.py` (deploy_app forcing `LETS_ENCRYPT_ENV=""` [A1], wait_healthy =
+services-converged + HTTPS, teardown_app = undeploy+volume+secret+env-config, janitor for orphans),
+`tests/conftest.py` (`deployed_app` session fixture with finalizer teardown; short unique domain),
+`tests/custom-html/test_install.py` (HTTP 200 + Playwright/Chromium content assertion),
+`runner/run_recipe_ci.py` (orchestrator: fetch recipe@REF, run stage pytest), `modules/harness.nix`
+(`cc-ci-run` = Nix python3+pytest+playwright with PLAYWRIGHT_BROWSERS_PATH from nixpkgs).
+
+**Bugs fixed en route (3):**
+1. Swarm config name > 64 chars (long domain) → switched to short `<recipe[:4]>-<6hex>` domain
+   scheme (DECISIONS.md). 
+2. `services_converged` used wrong stack name (replaced hyphens) → abra keeps hyphens, only dots→_.
+3. `http_get` connected to the gateway IP (drops SNI, gateway routes by SNI) → use the real URL
+   (resolves to gateway on cc-ci, correct SNI). Also teardown now removes the app .env config.
+
+**Green run + teardown (commands + output):**
+- `RECIPE=custom-html PR=0 REF=m4demo cc-ci-run runner/run_recipe_ci.py` →
+  `tests/custom-html/test_install.py::test_http_reachable PASSED`,
+  `::test_playwright_page PASSED` — **2 passed in 57.99s**.
+- Leak check after: services 0 / volumes 0 / secrets 0 / containers 0 / env config removed. Clean.
+
+**A1 addressed:** deploy_app forces `LETS_ENCRYPT_ENV=""` (no ACME) on every deploy. M4 CLAIMED.
+
+**M3 still blocked** (Gitea webhook delivery — operator); no response yet. Next: M5 (upgrade +
+backup/restore for custom-html), then wire the parameterized Drone pipeline (API-triggerable).