diff --git a/Makefile b/Makefile
index 5f63f48..2e230ec 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: tier1-up tier1-down tier1-logs fe-unit e2e
+.PHONY: tier1-up tier1-down tier1-logs fe-unit e2e e2e-install
 
 tier1-up:
 	docker compose -f testing/docker-compose.yml up --build -d
@@ -12,5 +12,8 @@ tier1-logs:
 fe-unit:
 	cd frontend && npm run test:run
 
+e2e-install:
+	cd e2e && npm ci && npx playwright install chromium
+
 e2e:
 	cd e2e && BASE_URL=$${BASE_URL:-http://localhost:8080} MAILSINK_URL=$${MAILSINK_URL:-http://localhost:8025} npm run e2e
diff --git a/frontend/src/lib/brand.js b/frontend/src/lib/brand.js
index a3d0136..69a0640 100644
--- a/frontend/src/lib/brand.js
+++ b/frontend/src/lib/brand.js
@@ -1,3 +1,4 @@
+// Harness sample unit — to be wired into title rendering by M3c (branding slice).
 export function brandTitle(name) {
   const trimmed = (name || '').trim()
   return trimmed || 'RFC'
diff --git a/testing/README.md b/testing/README.md
index 04be637..de22c5e 100644
--- a/testing/README.md
+++ b/testing/README.md
@@ -5,6 +5,7 @@ One environment-agnostic suite, two targets.
 ## Tier 1 — local Docker (every PR)
 
 ```sh
+make e2e-install     # one-time: install Playwright + chromium (cold checkout)
 make tier1-up        # build + start: gitea(seeded) + backend + web(nginx) + mailpit
 make e2e             # run Playwright against http://localhost:8080
 make fe-unit         # run Vitest frontend unit tests
@@ -24,7 +25,10 @@ Mailpit, so no real OAuth provider is needed.
 request, so the normal "fresh `tier1-up` then one `e2e`" flow is well clear of
 it. Do not retry `make e2e` more than ~4 times in a 5-minute window against the
 same running stack, or the 6th OTC request will 429. Restarting the backend
-container (or `tier1-down`/`tier1-up`) resets the in-process limiter.
+container (or `tier1-down`/`tier1-up`) resets the in-process limiter. Note:
+this is distinct from the per-email 60s OTC cooldown (`OTC_REQUEST_COOLDOWN_SECONDS`,
+`backend/app/otc.py`); the smoke spec handles that separately by using a unique
+email address per run.
 
 ## Tier 2 — PPE (deploy gate)