chore(2): bootstrap Phase 2 loop state + decisions

- STATUS-2.md / BACKLOG-2.md / JOURNAL-2.md seeded from plan §6 (Q0-Q5).
- DECISIONS.md appended Phase 2 section: functional/ + playwright/ subdirs,
  PARITY.md mapping convention, vendored helpers in runner/harness/
  (http, abra_tty, deps, sso, data_integrity), recipe-versioned tests.
- Bootstrap access re-verified: ssh cc-ci ok, Gitea API 200, wildcard DNS to
  gateway 143.244.213.108.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/STATUS-2.md

@@ -0,0 +1,66 @@
+# STATUS — Phase 2 (per-recipe test authoring)
+
+**Phase plan (SSOT):** `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
+**Loop state for THIS phase:** STATUS-2 / BACKLOG-2 / REVIEW-2 / JOURNAL-2 (DECISIONS.md shared).
+Phase 1/1b/1c/1d/1e STATUS/BACKLOG/REVIEW files are HISTORY (all DONE) — not this phase's state.
+
+## Phase
+Phase 2 authors **per-recipe test content** on top of the corrected Phase 1/1d/1e shared harness.
+Per the plan, for every maintained Co-op Cloud recipe (§5 target set), the cc-ci `tests/<recipe>/`
+tree must carry:
+- Phase-1d/1e **lifecycle overlays** (assertion-only, additive) — `test_install.py`, `test_upgrade.py`,
+  `test_backup.py`, `test_restore.py` + `ops.py` pre-op seeds.
+- **Parity-ported** tests from `references/recipe-maintainer/recipe-info/<recipe>/tests/*.py`,
+  one-to-one (P2), with a `PARITY.md` mapping table.
+- **≥2 NEW recipe-specific functional tests** (P3) — characteristic behavior, not just `status==200`.
+- **Real backup data-integrity** (P4): seed → backup → mutate → restore → assert seeded data survived.
+- **Dependency resolution** (P5): recipes that need other apps (SSO providers, DBs) deploy them in-run.
+- **Playwright** (P6) where the app's core UX is a UI flow.
+- **Docs** (P8): `docs/enroll-recipe.md` updated with the per-recipe test contract + worked example.
+
+## Definition of Done (Phase 2) — P1–P8, each Adversary cold-verified in REVIEW-2
+- [ ] **P1 — Coverage.** Every recipe in §5 target set has a `tests/<recipe>/` suite enrolled and a
+      full green `!testme` run (install + upgrade + backup-restore).
+- [ ] **P2 — Parity port.** Every `recipe-info/<recipe>/tests/*.py` has a comparable cc-ci test;
+      `tests/<recipe>/PARITY.md` records the mapping; non-ports documented in DECISIONS.md.
+- [ ] **P3 — Recipe-specific depth.** Each recipe has **≥2 new functional tests** beyond parity
+      (characteristic behavior, real assertions on app state/responses).
+- [ ] **P4 — Backup data-integrity is real.** Seed → backup → mutate → restore → assert seeded data
+      survived (recipe-aware, not health-only). Pattern already proven in Phase 1e on custom-html.
+- [ ] **P5 — Dependencies handled.** Recipes with deps declare them; harness deploys deps within the
+      run (respecting `MAX_TESTS`); SSO setup runs automatically.
+- [ ] **P6 — Browser flows where they matter (D3).** UI-centric recipes have a Playwright test of the
+      core flow (login, create-an-object, etc.).
+- [ ] **P7 — No weakened tests, no corners cut.** Every assertion is real; nothing skip/xfail'd,
+      mocked, or health-only stand-in. Any "untestable" claim is a true env-level blocker with
+      Adversary sign-off.
+- [ ] **P8 — Docs.** `docs/enroll-recipe.md` updated with the per-recipe test contract (§4.1) and a
+      worked example; a new engineer can add a recipe's full suite from the docs.
+
+## Milestones (plan §6)
+- **Q0** — Harness additions (HTTP/convergence, OIDC-flow, dep resolver, backup data-integrity, TTY
+  abra). Reference recipe (custom-html) uses them for full parity+specific suite, green via `!testme`.
+- **Q1** — Pattern proof (custom-html + n8n): full parity + ≥2 specific + real backup data-integrity.
+- **Q2** — SSO providers (keycloak + authentik); reusable SSO-setup/OIDC-flow harness e2e.
+- **Q3** — SSO-dependent suite (lasuite-docs, lasuite-drive, lasuite-meet, cryptpad, immich); deps
+  auto-deployed, SSO setup automated, parity + specific.
+- **Q4** — Remaining recipes (matrix-synapse, mumble, bluesky-pds, ghost, mattermost-lts, discourse,
+  plausible, uptime-kuma, mailu, drone).
+- **Q5** — Completeness + docs; flip `## DONE`.
+
+## In flight
+**Q0 — Harness additions.** Bootstrap Phase 2 loop state + begin porting recipe-maintainer helpers
+into `runner/harness/` (HTTP convergence, OIDC flow, dep resolver, backup-data-integrity, TTY abra).
+
+## Gate
+(none yet — Q0 has not been claimed)
+
+## Blocked
+(none) — bootstrap access re-verified @2026-05-28: `ssh cc-ci` ok (root, NixOS 24.11), Gitea API
+HTTP 200, wildcard DNS resolves to gateway 143.244.213.108.
+
+## Carryover from Phase 1e (not blockers for Phase 2)
+- **F1e-2** [adversary] — concurrent same-recipe `abra recipe fetch` race in
+  `runner/run_recipe_ci.py::fetch_recipe`. Pre-existing in Phase 1d; not a 1e regression. Drone
+  caps `MAX_TESTS=1` today, so practical impact bounded. Tracked for Phase-2 breadth-ramp if
+  concurrent recipe runs become routine.