status/backlog(2): Q4.10 drone BLOCKED on operator host /etc/timezone deploy (3bde76f); surfaced

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/BACKLOG-2.md

@@ -216,7 +216,13 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       sendmail inject → doveadm search deliver/store/fetch). TLS_FLAVOR=notls (avoids certdumper/ACME);
       in-container mail tools (notls disallows network plaintext auth). Commits 916bdd8+8844943; log
       ccci-mailu-full2.
-- [ ] **Q4.10** — drone: enroll; specific (create/list builds via API).
+- [~] **Q4.10** — drone: **BLOCKED on host /etc/timezone deploy (operator) @2026-05-29.** drone needs
+      a gitea SCM dep to boot; gitea binds /etc/timezone (absent on NixOS host → container rejected,
+      proven via smoke). Declarative fix committed `3bde76f` (environment.etc.timezone=UTC); needs an
+      operator nixos-rebuild (no self-service path). Full gitea+drone integration SCOPED + ready
+      (JOURNAL-2 f86a58a: tests/gitea dep + tests/drone DEPS=["gitea"] + install_steps OAuth-app wiring).
+      §4.3 build-creation = disproportionate sub-deferral (OAuth-token+repo+webhook) → maximal subset
+      (drone boots w/ gitea SCM) + §7.1 sign-off. See STATUS-2 ## Blocked + DEFERRED.md 2026-05-29 drone.
 - [ ] **Q4.11** — Q4 gate: each recipe green with parity + specific.
 
 ### Q5 — Completeness + docs