claim(2): Q3.2 lasuite-drive — full lifecycle 3x green via install-time OIDC + collabora-ready upgrade gate

3× repeat-green (logs /root/ccci-drive-q32a-r2/r3/r4.log): install+upgrade+backup+restore+custom all
pass, OIDC password-grant PASSED (not skip), deploy-count=1, clean teardown each run. Resolves the
Adversary's standing veto-eligible obligation (lasuite-drive upgrade tier GREEN + reliable OIDC).

Fixes: install-time OIDC wiring (a151489: _provision_deps before single deploy + OIDC_AT_INSTALL +
install_steps.sh) eliminated the flaky post-deploy --chaos reconverge; collabora-WOPI-ready upgrade
gate + DEPLOY_TIMEOUT plumbing (4b38b66) fixed the upgrade tier (was killing a still-booting collabora,
exit 70). Gate evidence + cold-verify HOW/EXPECTED/WHERE in STATUS-2.md. BACKLOG-2 Q3.2/Q3.2a ticked;
DEFERRED.md disk follow-on noted done.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/BACKLOG-2.md

@@ -63,7 +63,12 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       lasuite-docs OIDC env wiring (install_steps.sh wires dep keycloak's client_secret +
       OIDC env into lasuite-docs's .env at install time). Documented in tests/lasuite-docs/
       PARITY.md.
-- [~] **Q3.2** — lasuite-drive: enrolled (mirrored). Maximal testable subset GREEN @2026-05-29
+- [x] **Q3.2** — lasuite-drive: **FULL LIFECYCLE 3× GREEN @2026-05-29 — CLAIMED (STATUS-2 Gate Q3.2),
+      awaiting Adversary.** install+upgrade+backup+restore+custom all pass; OIDC password-grant PASSED
+      (not skip); deploy-count=1; clean teardown; data-integrity (ci_marker) survives upgrade +
+      backup/restore. Fixed via install-time OIDC (commit `a151489`) + collabora-ready upgrade gate +
+      DEPLOY_TIMEOUT plumbing (commit `4b38b66`). Logs r2/r3/r4. Original [~] detail retained below.
+- [~] **Q3.2 (original)** — lasuite-drive: enrolled (mirrored). Maximal testable subset GREEN @2026-05-29
       (`/root/ccci-drive-subset.log`): install (generic+cc-ci test_serving_and_frontend) + backup
       (P4 test_backup_captures_state) + restore (P4 test_restore_returns_state) + custom — all 3
       functional PASS: test_health_check (parity), test_minio_storage (real S3 upload→list→download→
@@ -80,7 +85,15 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       RED). Test assertions are all correct (run 1 proved health+MinIO+OIDC green); the flakiness is in
       the redeploy infra. **Two open issues block a reliable Q3.2 green:** (a) [Q3.2a] flaky OIDC
       redeploy — see below; (b) upgrade tier disk-blocker (DEFERRED/operator). See JOURNAL-2 2026-05-29.
-- [ ] **Q3.2a** — Make lasuite-drive OIDC wiring reliable. **PLAN:**
+- [x] **Q3.2a** — **DONE @2026-05-29 (Part A + harness upgrade gate; claimed under Q3.2).** Part A
+      (install-time OIDC, deploy-once, no mid-run reconverge — real abra only) landed `a151489`;
+      Step 0 root-cause logs captured (JOURNAL-2). The upgrade-tier flakiness (collabora killed
+      mid-boot by the chaos redeploy) was fixed in the **harness** via a collabora-WOPI-ready gate in
+      `pre_upgrade` + DEPLOY_TIMEOUT plumbing (`4b38b66`) — 3× repeat-green, so **Part B (recipe PR)
+      is NOT required for CI green**. (Part B remains an optional upstream-robustness improvement; may
+      file separately. The `--chaos` reconverge is now race-free because it replaces a fully-ready
+      collabora.) Original plan detail retained below.
+- [~] **Q3.2a (original plan)** — Make lasuite-drive OIDC wiring reliable. **PLAN:**
       `cc-ci-plan/plan-lasuite-drive-oidc-robustness.md` (orchestrator, 2026-05-29). The full
       12-service `--chaos` redeploy to apply OIDC env exposes collabora's flaky reconverge (+ transient
       backend gunicorn-perms / WOPI-404). Structured as: **Step 0** capture real failure logs first;