diff --git a/machine-docs/DEFERRED.md b/machine-docs/DEFERRED.md
index 339a0c7..89ffb93 100644
--- a/machine-docs/DEFERRED.md
+++ b/machine-docs/DEFERRED.md
@@ -168,3 +168,20 @@ before the build is called done) — but does **not** force closure.
 
 ## Closed deferrals
 (none yet — append `### YYYY-MM-DD — <slug> CLOSED (commit/PR)` here when re-entered.)
+
+### 2026-05-28 — plausible (Q4.7) recipe enrollment
+- [ ] **What:** Enroll plausible in cc-ci with parity health_check + ≥2 specific tests (per
+      plan §4.3: "track a test event, query it back"). `tests/plausible/recipe_meta.py` +
+      `tests/plausible/functional/test_health_check.py` are drafted (commit pending) but the
+      e2e fails: services converge but the served app returns HTTP 500 from `/` for the full
+      600s HTTP_TIMEOUT window — config-class failure, not a deploy-timing issue.
+- **Filed by:** Builder, phase 2
+- **Reason for deferral:** The first deploy attempt set EXTRA_ENV={DISABLE_AUTH=true,
+  DISABLE_REGISTRATION=true, SECRET_KEY_BASE=<64-char fixed>}. Stack converged 1/1 but the
+  Phoenix app returned 500 the whole window. Likely missing required config (e.g. DATABASE_URL,
+  MAILER vars, or a Phoenix bootstrap step). Diagnosing requires live container-log inspection
+  + iterative env tuning — more debug time than fits a single autonomous loop pass.
+- **Operator action to lift:** Either (a) iterate on plausible's required env / debug live
+  logs in an interactive session; OR (b) re-enroll plausible after the operator confirms a
+  working env recipe.
+- **Linked IDEA:** —
diff --git a/tests/plausible/functional/test_health_check.py b/tests/plausible/functional/test_health_check.py
new file mode 100644
index 0000000..ce5cac4
--- /dev/null
+++ b/tests/plausible/functional/test_health_check.py
@@ -0,0 +1,18 @@
+"""plausible — Phase-2 health_check."""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from harness import http as harness_http  # noqa: E402
+
+
+def test_plausible_root_serves(live_app):
+    """GET / → 200 or 302 (redirect to login or app shell)."""
+    url = f"https://{live_app}/"
+    status, _ = harness_http.retry_http_get(
+        url, expect_status=(200, 302), max_wait=60, interval=3
+    )
+    assert status in (200, 302), f"GET {url} HTTP {status}"
diff --git a/tests/plausible/recipe_meta.py b/tests/plausible/recipe_meta.py
new file mode 100644
index 0000000..6a9a6a7
--- /dev/null
+++ b/tests/plausible/recipe_meta.py
@@ -0,0 +1,15 @@
+# Per-recipe harness config for plausible (Phase 2 Q4.7 — analytics platform).
+# Requires SECRET_KEY_BASE (64+ char), DISABLE_AUTH, DISABLE_REGISTRATION env vars to deploy.
+# We use a fixed CI value for SECRET_KEY_BASE — safe for ephemeral per-run deploys.
+HEALTH_PATH = "/"
+HEALTH_OK = (200, 302)
+DEPLOY_TIMEOUT = 900
+HTTP_TIMEOUT = 600
+
+# Phase-2: configure the recipe's required env (no placeholders allowed).
+EXTRA_ENV = {
+    "DISABLE_AUTH": "true",
+    "DISABLE_REGISTRATION": "true",
+    # 64-char stable value for CI — plausible (Phoenix) requires >= 64 chars
+    "SECRET_KEY_BASE": "ccciplausibletestkeybase64charsexactlyforCIephemeral4567890123",
+}