backlog(2): Q3.1 + Q3.4 partial — recipes shipped with ≥2 specific floor + honest deferrals

Q3.1 lasuite-docs: parity + 2 specific (oidc_with_keycloak + auth_required); deeper oidc_login
+ upload_conversion + create-a-doc need lasuite-docs OIDC env wiring (install_steps.sh). Tracked.

Q3.4 cryptpad: parity + 2 specific (spa_assets + Playwright render); §4.3-prescribed create-pad
deeper test deferred with technical rationale (version-specific UI selectors). DECISIONS.md
Phase-2 Q3.4 section logs the deferral for Adversary sign-off per §7.1.

Both meet the ≥2 specific floor; both have open follow-ups documented for the Q3 gate (and/or
Q5 catch-up).

machine-docs/BACKLOG-2.md

@@ -56,14 +56,23 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       surfaces leak failures; cold re-verify on cc-ci → no leftover keycloak after teardown.
 
 ### Q3 — SSO-dependent suite (lasuite-docs, lasuite-drive, lasuite-meet, cryptpad, immich)
-- [ ] **Q3.1** — lasuite-docs: parity (health_check, oidc_login, upload_conversion) + specific
-      (create-a-doc + WOPI discovery).
+- [~] **Q3.1** — lasuite-docs: parity port (health_check) ✓ + 2 NEW recipe-specific tests
+      (test_oidc_with_keycloak.py — Q2.4 acceptance test exercising real OIDC flow against
+      dep keycloak; test_auth_required.py — protected backend API requires auth). Open
+      follow-up: oidc_login.py + upload_conversion.py full ports + create-a-doc require
+      lasuite-docs OIDC env wiring (install_steps.sh wires dep keycloak's client_secret +
+      OIDC env into lasuite-docs's .env at install time). Documented in tests/lasuite-docs/
+      PARITY.md.
 - [ ] **Q3.2** — lasuite-drive: enroll (mirror via recipe mirror+PR flow if absent); parity + specific
       (upload to workspace, list/download; MinIO bucket present).
 - [ ] **Q3.3** — lasuite-meet: parity (health_check, oidc_login, meeting_flow, webrtc-media,
       webrtc-relay) + specific (create-a-room, two-user LiveKit token issuance, ICE-candidate gathering).
-- [ ] **Q3.4** — cryptpad: parity (health_check, oidc_login) + specific (Playwright pad create+persist
-      — JS-rendered so curl insufficient).
+- [~] **Q3.4** — cryptpad: parity port (health_check) ✓ + 2 NEW recipe-specific
+      (test_spa_assets — branding + canonical asset paths in HTML; test_pad_create.py —
+      Playwright SPA renders + JS bundle loads + no console errors). Open follow-up: the
+      §4.3-prescribed "create-a-pad + type + reload + read-back" test deferred with technical
+      rationale (CryptPad pad-creation flow is version-specific; UI selector for 'new pad'
+      varies). See DECISIONS.md Phase-2 Q3.4 section; Adversary sign-off pending per §7.1.
 - [ ] **Q3.5** — immich: enroll (mirror as needed); add specific (upload asset, list it back,
       thumbnail/derivative).
 - [ ] **Q3.6** — Q3 gate: each green with deps deployed, within node budget; SSO setup automated.