status(2): Q3.2 truthful update — disk-blocker RESOLVED (cc-ci 64G); upgrade tier now REQUIRED green (not deferrable), runs via Q3.2a rework; F2-7 closed out-of-scope per SSO policy

machine-docs/BACKLOG-2.md

@@ -69,11 +69,10 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       functional PASS: test_health_check (parity), test_minio_storage (real S3 upload→list→download→
       assert-bytes round-trip), test_oidc_with_keycloak (password-grant JWT vs warm keycloak,
       per-run realm, clean teardown). deploy-count=1, deps=['keycloak'] (warm-reused). **Upgrade
-      tier DEFERRED pending host disk resize** — the prev→PR-head crossover holds two multi-GB office
-      image versions at once (onlyoffice 9.2→9.3.1.2 @3.94GB + collabora) → exhausts the 28GB host
-      (DEFERRED.md/DECISIONS.md 2026-05-29). Per Adversary BUILDER-INBOX this is a
-      conditional/deferred sign-off (NOT a §7.1 waiver): upgrade tier stays a veto-eligible open item,
-      must run green + cold-verified before Phase-2 DONE once disk grows. Bug fixed en route: `fix(2)`
+      tier: disk-blocker RESOLVED @2026-05-29 (cc-ci grew to 64G/44G-free) — the upgrade tier is now
+      REQUIRED green (no longer deferrable, per Adversary + operator) and runs as part of the Q3.2a
+      rework. It stays a veto-eligible OPEN obligation until run green (incl. real prev→PR-head office
+      crossover) + Adversary cold-verified.** Bug fixed en route: `fix(2)`
       `f1c626c` — setup_custom_tests `docker service scale --detach` (the run-once minio-createbuckets
       job made a blocking scale hang the custom tier). **NOT CLAIMED — OIDC setup is FLAKY:** the
       step-3 in-place full-stack `abra app deploy --force --chaos` (applies OIDC env) only converges