journal(2): Q3.2a fixed-code run 1 FULL SUITE GREEN (collabora-ready gate fixed upgrade tier); launching 3x repeat-green

machine-docs/JOURNAL-2.md

@@ -826,3 +826,35 @@ time (between `abra app new` and the single `abra app deploy`) so the recipe dep
 already set; no post-deploy reconverge.** keycloak is live-warm (always up), so the per-run realm is
 a lightweight API call provisioned before the single deploy. Part B (recipe robustness PR) remains
 the deeper fix so ANY reconverge (incl. the upgrade-tier prev→PR-head crossover) is race-free.
+
+---
+
+## 2026-05-29 — lasuite-drive Q3.2a: Part A + upgrade-gate fix → FULL SUITE GREEN (run 1 of 3)
+
+Two iterations landed:
+- **Part A** (commit `a151489`): wire OIDC at INSTALL (provision warm-keycloak realm before the
+  single deploy; `install_steps.sh` writes OIDC env into it). Run 1 (`ccci-drive-q32a-r1.log`):
+  deploy-count=1, install/backup/restore/custom + OIDC test all GREEN — but **upgrade tier FAILED**:
+  the chaos redeploy SIGTERMed a still-booting collabora (coolwsd ~2min boot) → "Shutdown requested
+  while starting up", forced exit 70 → abra aborted ("FATA deploy failed"). install wait_healthy
+  returns on collabora container 1/1 while coolwsd is still loading.
+- **Upgrade-gate fix** (commit `4b38b66`): `ops.py::pre_upgrade` now waits for collabora WOPI
+  discovery (`/hosting/discovery` on `collabora-<domain>`) → 200 before the chaos redeploy; +
+  DEPLOY_TIMEOUT plumbed through `chaos_redeploy`/`perform_upgrade`/`_perform_op` (was abra.deploy's
+  900s default vs the .env internal TIMEOUT 1500s).
+
+**Fixed-code run 1 (`ccci-drive-q32a-r2.log`) — FULL SUITE GREEN:**
+```
+pre_upgrade: collabora WOPI discovery ready (200) on collabora-lasu-d12d03.ci.commoninternet.net
+RUN SUMMARY: deploy-count = 1 (expect 1)
+  install : pass   upgrade : pass   backup : pass   restore : pass   custom : pass
+```
+- upgrade: `test_upgrade_preserves_data` PASSED (ci_marker survived prev→PR-head chaos crossover).
+- custom: health + minio round-trip + OIDC password-grant JWT all PASSED (OIDC PASS, NOT skip).
+- Clean teardown: no lasu stacks/volumes after; disk 38%.
+
+The collabora-ready gate is the decisive fix — the upgrade chaos redeploy now replaces a fully-ready
+collabora cleanly instead of killing it mid-boot. Launching runs 2 + 3 for the Adversary-required 3×
+repeat-green before claiming Q3.2. (Part B — recipe-level WOPI healthcheck/gunicorn-perms PR — is no
+longer required for CI green; will reassess whether to still file it as upstream robustness once 3×
+green holds.)