diff --git a/machine-docs/JOURNAL-2.md b/machine-docs/JOURNAL-2.md
index 348bfb5..0cdce66 100644
--- a/machine-docs/JOURNAL-2.md
+++ b/machine-docs/JOURNAL-2.md
@@ -374,3 +374,31 @@ test_oidc_with_keycloak.py is the third specific test (Q2.4 acceptance + Q3.1 OI
    when verified to fully teardown.
 
 Q2 RE-CLAIMED. Continuing Q3 work in parallel.
+
+## 2026-05-28 — Q2 PASS; Q3.1 + Q3.4 partial; checkpoint
+
+**Progress checkpoint:**
+- Q0 ✓ Adversary PASS — harness primitives + discovery
+- Q1 ✓ Adversary PASS — custom-html + n8n full Phase-2 (parity + ≥2 specific)
+- Q2 ✓ Adversary PASS — keycloak + dep resolver + SSO harness + Q2.4 acceptance
+- Q3.1 lasuite-docs partial — parity health_check + 2 specific (auth_required + oidc_with_keycloak)
+- Q3.4 cryptpad partial — parity + 2 specific (spa_assets + Playwright render)
+- Q3.2/Q3.3/Q3.5: not started
+- Q4: 10 recipes not started
+- Q5.1 docs partial; Q5.2/Q5.3 not done
+
+**Open deferrals (per §7.1) tracked for Adversary sign-off:**
+1. lasuite-docs deeper OIDC tests (oidc_login.py + upload_conversion.py + create-a-doc) — needs
+   install_steps.sh to wire dep keycloak's client_secret + OIDC env into the parent .env.
+2. cryptpad create-a-pad deeper test — CryptPad's pad-creation flow is version-specific (DECISIONS
+   Phase-2 Q3.4 section logs the rationale).
+3. Q2.2 authentik enrollment + setup_authentik_realm backend in harness.sso (F2-7).
+
+**Pattern learned this session:**
+- When a test fails on the first cold run, ALWAYS check whether the failure is the test code OR
+  the underlying behavior. The cryptpad story: my first /api/config test was wrong (the
+  endpoint doesn't exist); my second test_websocket_endpoint was wrong (the websocket path
+  doesn't return 4xx on plain HTTP); the Playwright pad-init was over-ambitious for the version.
+  Each iteration cost a 5-7min e2e cycle. Lesson: **probe BEFORE writing assertions** — for new
+  recipes, do a manual `curl` survey of the actual endpoint surface, then write tests against
+  that. (For Q3.5 immich and Q3.2 lasuite-drive I should plan a probe phase first.)