status(2): lasuite-drive Q3.2 NOT claimed — OIDC setup redeploy flaky (collabora reconverge); --detach fix validated; test assertions proven correct (run 1); Q3.2a robustness item added; prune-during-deploy lesson recorded

machine-docs/BACKLOG-2.md

@@ -75,8 +75,17 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       conditional/deferred sign-off (NOT a §7.1 waiver): upgrade tier stays a veto-eligible open item,
       must run green + cold-verified before Phase-2 DONE once disk grows. Bug fixed en route: `fix(2)`
       `f1c626c` — setup_custom_tests `docker service scale --detach` (the run-once minio-createbuckets
-      job made a blocking scale hang the custom tier). Clean unassisted re-run with the fix in flight
-      before the formal Q3.2 claim.
+      job made a blocking scale hang the custom tier). **NOT CLAIMED — OIDC setup is FLAKY:** the
+      step-3 in-place full-stack `abra app deploy --force --chaos` (applies OIDC env) only converges
+      sometimes on this heaviest 12-service stack (run 1 OK → OIDC PASS; run 4 FAIL → OIDC SKIP → F2-11
+      RED). Test assertions are all correct (run 1 proved health+MinIO+OIDC green); the flakiness is in
+      the redeploy infra. **Two open issues block a reliable Q3.2 green:** (a) [Q3.2a] flaky OIDC
+      redeploy — see below; (b) upgrade tier disk-blocker (DEFERRED/operator). See JOURNAL-2 2026-05-29.
+- [ ] **Q3.2a** — Make lasuite-drive OIDC wiring reliable. The full 12-service `--chaos` redeploy to
+      apply OIDC env exposes collabora's flaky reconverge (+ transient backend gunicorn-perms / celery
+      WOPI-404). Fix direction: wire OIDC at INSTALL time (install_steps, no post-deploy redeploy — the
+      lasuite-docs model) OR make setup_custom_tests redeploy resilient (retry + wait for collabora WOPI
+      discovery 200 before ready). Then re-run subset to a reliable green before claiming Q3.2.
 - [ ] **Q3.3** — lasuite-meet: parity (health_check, oidc_login, meeting_flow, webrtc-media,
       webrtc-relay) + specific (create-a-room, two-user LiveKit token issuance, ICE-candidate gathering).
 - [~] **Q3.4** — cryptpad: parity port (health_check) ✓ + 2 NEW recipe-specific