fix(lasuite-drive): re-assert SECRET_COLLABORA_P_VERSION in EXTRA_ENV

abra's pinned-version 'app new' regenerates the app .env from generation
hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships the line
manually — not a generatable secret). Every secret-touching abra command
for the app then FATAs 'missing version for secret? (collabora_p)' and the
cold base deploy goes RED at install (first seen in the 2026-10-25 weekly
sweep's cold tests of the new releases: lasuite-drive never got past
install_steps' oidc_rpcs insert). Re-asserting the shipped version pin via
EXTRA_ENV restores the sample's contract.

Verified live on cc-ci: abra app check passes for the pinned sample env
collabora_p only with the line present; repro via 'abra app new -S' on
0.12.0+v0.21.0 dropped the line deterministically.

machine-docs/BACKLOG-ghost.md

@@ -9,9 +9,15 @@
 - [x] Verify no Ghost resources leak after the retry — no `ghos-*`/`dev-ghost` stacks, services, or volumes
 - [x] M1 current evidence Adversary-verified — PASS @2026-09-07T21:29:58Z
 - [x] M2 current operator-ready outcome Adversary-verified — PASS @2026-09-07T21:29:58Z
+- [x] Fresh current PR#8 post-proxy retry — comment 16237, build #50, level 5/5
+- [x] Fresh PR#8 cleanup and duplicate inventory — exactly one open PR, no Ghost resources
+- [x] Fresh M1/M2 revalidation Adversary-verified — PASS @2026-10-13T03:14:20Z
+- [x] Fresh PR#8 retry after level-4 lint uncertainty — comment 16297, build #66, level 5/5
+- [x] Fresh M1/M2 revalidation for build #66 — Adversary PASS @2026-10-20T03:22:00Z; operator classification comment #16299 added
 
 ## Adversary findings
 
 - [x] [adversary] **[A1] Build #585 must NOT be used as the "clean post-proxy pass"** — it ran pre-proxy (03:59Z vs proxy fix at 05:38Z) and tested PR#5 (cfold probe), not PR#4. A genuine post-proxy !testme on PR#4 is required for M1. @2026-06-13T06:22Z — **CLOSED: Builder used build #612 (post-proxy, 06:13Z), not #585. M1 PASS @06:38Z**
 - [x] [adversary] **[A2] `update_config.monitor` is likely the root cause of upgrade timing failures** — builds #557 and #578 both failed with `UpdateStatus=paused`, NOT VIP exhaustion. @2026-06-13T06:22Z — **CLOSED: Build #612 passed post-proxy confirming infra-confound. Operator comment explains MySQL timing under load. M1+M2 PASS @06:38Z**
 - [x] [adversary] **[A3] PR#5 (cfold probe) should be closed once PR#4 has its verdict** — not the canonical upgrade. @2026-06-13T06:22Z — **CLOSED: PR#5 closed (verified). M2 PASS @06:38Z**
+- [x] [adversary] **[A4] Current run #55 is not fully green** — cold artifact for current PR#8 head `dbe40ecb` is level 4: lifecycle/custom stages pass, but lint is `unver` (`abra recipe lint exited 2 with no table`) and is listed as an unintentional skip. Result comment #16249 says only `passed` without explaining the blocker. Repro: `ssh cc-ci 'jq -c "{recipe,pr,ref,level,results,flags,skips,lint}" /var/lib/cc-ci-runs/55/results.json'`. @2026-10-20T03:10:02Z — **CLOSED: fresh build #66 for the same current head reports level 5 with lint pass and no unintentional skips; M2 PASS @2026-10-20T03:22Z**

machine-docs/JOURNAL-ghost.md

@@ -131,3 +131,66 @@ The authoritative host artifact `/var/lib/cc-ci-runs/1332/results.json` reports
 proxy subnet `10.10.0.0/16` and no matching Ghost stacks, services, volumes, or networks. The
 unauthenticated Drone API endpoint returned HTTP 401, so no claim is based on that endpoint; the
 host artifact and Gitea result comment remain the verification sources.
+
+## 2026-10-13T03:14Z — Fresh PR#8 revalidation
+
+Live inventory found exactly one open Ghost upgrade PR: PR#8, branch `upgrade-ee04ca9`, head
+`ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; PRs #1 through #7 are closed. The proxy network is
+`10.10.0.0/16`.
+
+Triggered `!testme` as Gitea comment `16237` at `2026-10-13T03:11:52Z`. The bridge created build
+#50 and result comment `16238`. The cold artifact `/var/lib/cc-ci-runs/50/results.json` reports
+level 5, `install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all passing, with
+`clean_teardown=true`, `no_secret_leak=true`, and no skipped stages. The upgrade stage included
+`tests.ghost.test_upgrade.test_upgrade_preserves_state`.
+
+Host probes after completion found no `ghos-*` or `dev-ghost` stacks, services, volumes, or
+networks. The Adversary independently recorded M1 and M2 PASS at `2026-10-13T03:14:20Z` in
+`REVIEW-ghost.md`.
+
+## 2026-10-20T03:12Z — Fresh retry resolved lint uncertainty
+
+The live PR remains #8 at head `dbe40ecb7b0084050a71baf4dcf971b65aac125e`. The prior current-head
+run #55 passed all lifecycle stages but had an unintentional `lint` unverifiable result because Abra
+panicked while sorting a catalogue version. One fresh retry was triggered with comment #16297. It
+created build #66, which completed successfully at level 5/5.
+
+Verification commands and results:
+
+```sh
+curl -fsS https://drone.ci.autonomic.zone/api/repos/recipe-maintainers/cc-ci/builds/66
+# status=success, RECIPE=ghost, PR=8, REF=dbe40ecb7b0084050a71baf4dcf971b65aac125e
+ssh cc-ci 'jq -c "{recipe,pr,ref,level,results,lint,flags,skips}" /var/lib/cc-ci-runs/66/results.json'
+# level=5; install/upgrade/backup/restore/custom/lint=pass; clean_teardown=true; no_secret_leak=true
+ssh cc-ci 'docker stack ls; docker service ls; docker volume ls; docker network ls'
+# no ghos-* or dev-ghost resources
+```
+
+The result comment #16298 links build #66 and reports passed. M1 and M2 are re-claimed in STATUS for
+fresh independent verification; no recipe change was needed.
+
+## 2026-10-20T03:24Z — Live recheck and operator classification
+
+Bootstrap checks passed: `ssh cc-ci 'hostname && whoami'` returned `cc-ci` and `root`,
+`ssh cc-ci 'nixos-version'` returned `26.05.20260906.c257840 (Yarara)`, authenticated Gitea API
+version is `1.27.3`, and a random `probe-*.ci.commoninternet.net` resolved to gateway address
+`195.201.88.249`.
+
+Live Gitea inventory shows exactly one open Ghost PR: #8, `upgrade-ee04ca9`, head
+`dbe40ecb7b0084050a71baf4dcf971b65aac125e`. Closed PRs include the historical upgrade/probe PRs;
+none is an open duplicate. The clean post-proxy retry is comment #16297 / build #66. The host
+artifact reports level 5, all lifecycle stages and lint `pass`, `clean_teardown=true`,
+`no_secret_leak=true`, and no skipped stages. The proxy subnet is `10.10.0.0/16`; stack, service,
+volume, and network probes produced no `ghos-*` or `dev-ghost` resources.
+
+Posted operator-facing classification comment #16299 on PR #8. It records build #66 as the current
+evidence, identifies the 2026-06-12 proxy/IPAM and concurrent-load failures as historical, and
+states that the PR is operator-ready and unmerged. No recipe or test change was needed.
+
+## 2026-10-20T03:26Z — M1/M2 passed and phase completed
+
+`REVIEW-ghost.md` records fresh independent PASSes for M1 and M2 at 2026-10-20T03:22:00Z. The
+Adversary verified the sole open PR #8, current-head build #66 at level 5/5 with lint pass and no
+unintentional skips, historical failure separation, operator-facing result, and absence of Ghost
+resource leaks. The prior level-4 lint VETO is explicitly cleared. STATUS-ghost.md now records
+`## DONE`; no recipe PR was merged.

machine-docs/REVIEW-ghost.md

@@ -145,3 +145,102 @@ Builder may write `## DONE` to STATUS-ghost.md.
 - Current Swarm cleanup probe found no Ghost-named resources, and the phase's current PR head matches the level-5 result artifact.
 
 **Fresh verdict:** M1 and M2 PASS. The ghost phase is operator-ready; the 2026-06-12 failures remain historical, pre-proxy/load-confounded evidence and are not evidence against the current PR.
+
+## Fresh revalidation
+
+**M1: PASS @2026-10-13T03:14:20Z**
+
+- Cold Gitea inventory shows exactly one open Ghost upgrade PR: #8, `chore: upgrade ghost to 6.69.0-alpine`, head `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`, branch `upgrade-ee04ca9`.
+- The fresh `!testme` comment is Gitea comment #16237 at 2026-10-13T03:11:52Z. Its result comment #16238 links Drone build #50 and reports pass.
+- Cold Drone API check for build #50 reports `success` with parameters `RECIPE=ghost`, `PR=8`, `REF=ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; the exec pipeline and both steps also report success.
+- Cold host artifact `/var/lib/cc-ci-runs/50/results.json` matches PR #8 and the full level-5 matrix: install, upgrade, backup, restore, custom, and lint are all `pass`; `clean_teardown=true`, `no_secret_leak=true`, and no stages are skipped.
+- This evidence is post-proxy and current; the 2026-06-12 failures remain historical and were not used as current recipe evidence.
+
+**M2: PASS @2026-10-13T03:14:20Z**
+
+- Exactly one relevant open Ghost upgrade PR remains: #8. The prior PR #7 is no longer open, and no duplicate open upgrade PR is present.
+- The operator-facing result comment #16238 is green and links build #50.
+- Cold Swarm probes found no `ghos-*` or `dev-ghost` stacks, services, volumes, or networks after build #50; the proxy subnet remains `10.10.0.0/16`.
+
+**Fresh verdict:** M1 and M2 PASS. The current Ghost upgrade PR is operator-ready, the fresh post-proxy retry is green, the historical failure classification remains valid, and no Ghost resources leak.
+
+## Fresh revalidation — 2026-10-20
+
+### M1: PASS @2026-10-20T03:10:02Z
+
+- Cold Gitea inventory shows exactly one open Ghost upgrade PR: #8, head
+  `dbe40ecb7b0084050a71baf4dcf971b65aac125e` on `upgrade-ee04ca9`.
+- The current head has a fresh post-proxy `!testme` comment #16248 and result comment #16249,
+  linked to run #55. The run artifact identifies `recipe=ghost`, `pr=8`, and ref
+  `dbe40ecb7b00`.
+- Run #55 independently reports install, upgrade, backup, restore, and custom as `pass`, with
+  `clean_teardown=true` and `no_secret_leak=true`. No Ghost stacks, services, volumes, or
+  networks remain; proxy subnet is `10.10.0.0/16`.
+
+### M2: FAIL @2026-10-20T03:10:02Z
+
+- The current run artifact is level 4, not level 5. Its lint stage is `unver`, with
+  `skips.unintentional=["lint"]` and detail `abra recipe lint exited 2 with no table`.
+- Result comment #16249 says only `passed` and does not disclose the unverified lint stage.
+  The lifecycle evidence is strong, but the operator-facing outcome is not accurately explained
+  as required by the phase gate. The Builder must either obtain a fresh fully verified result or
+  add a precise operator-facing explanation of the lint blocker and its impact before M2 can pass.
+
+## VETO CLEARED @2026-10-20T03:22:00Z
+
+The prior veto applied to run #55. Fresh build #66 for the same PR head has verified lint
+pass and an accurate result comment; see the fresh M1/M2 verdict below.
+
+## Fresh gate verification — 2026-10-20T03:22:00Z
+
+### M1: PASS @2026-10-20T03:22:00Z
+
+- Cold Gitea inventory shows exactly one open Ghost upgrade PR: PR#8, head
+  `dbe40ecb7b0084050a71baf4dcf971b65aac125e` on `upgrade-ee04ca9`; PRs #1-#7 are closed.
+- Gitea comments #16297 and #16298 show the fresh `!testme` and its result for build #66.
+- Drone API build #66 independently reports `status=success`, `RECIPE=ghost`, `PR=8`,
+  `REF=dbe40ecb7b0084050a71baf4dcf971b65aac125e`, and `SRC=recipe-maintainers/ghost`.
+- Host artifact `/var/lib/cc-ci-runs/66/results.json` reports `level=5`, with install,
+  upgrade, backup, restore, custom, and lint all `pass`; no unintentional skips are present.
+- The current evidence is post-proxy and uses the current PR head. The historical failed
+  artifacts remain separate: builds #515/#517 failed at install and #519/#557 failed at
+  upgrade, while the proxy was subsequently fixed to `10.10.0.0/16`; they were not used as
+  evidence against the current retry.
+
+### M2: PASS @2026-10-20T03:22:00Z
+
+- Exactly one relevant open Ghost upgrade PR remains, PR#8; all historical PRs #1-#7 are closed.
+- The operator-facing result comment #16298 links build #66 and reports the successful result.
+- Artifact flags are `clean_teardown=true` and `no_secret_leak=true`; `docker stack ls`,
+  `docker service ls`, `docker volume ls`, and `docker network ls` probes found no
+  `ghos-*` or `dev-ghost` resources. The proxy subnet is `10.10.0.0/16`.
+- The prior M2 veto is cleared: build #66 has a verified lint `pass`, unlike build #55's
+  unintentional lint `unver` result.
+
+**Fresh verdict:** M1 and M2 PASS. The current Ghost upgrade PR is operator-ready, the
+post-proxy retry is a genuine level-5 pass for the current head, historical failures remain
+separate from current recipe evidence, and no Ghost resources leak.
+
+## Gate re-verification — 2026-10-20T03:23:01Z
+
+### M1: PASS @2026-10-20T03:23:01Z
+
+- Cold live inventory still shows exactly one open Ghost PR: PR#8 at
+  `dbe40ecb7b0084050a71baf4dcf971b65aac125e`, branch `upgrade-ee04ca9`; PRs #1-#7 are closed.
+- Drone build #66 independently reports success with `RECIPE=ghost`, `PR=8`, and the exact
+  current head SHA in `REF`.
+- `/var/lib/cc-ci-runs/66/results.json` independently reports level 5, install/upgrade/
+  backup/restore/custom/lint all pass, no unintentional skips, `clean_teardown=true`, and
+  `no_secret_leak=true`.
+- Proxy is `10.10.0.0/16`; no Ghost stacks, services, volumes, or networks are present.
+- Comments #16297, #16298, and operator classification comment #16299 are present; #16299
+  explicitly separates historical 2026-06-12 failures from the current post-proxy evidence.
+
+### M2: PASS @2026-10-20T03:23:01Z
+
+- The live PR inventory and build artifact confirm exactly one operator-ready Ghost upgrade PR.
+- Comment #16299 accurately reports the level-5 result, MySQL upgrade success, historical
+  failure classification, and no leaked Ghost resources; it states the PR was not merged.
+- The previous level-4 lint veto remains cleared by the verified level-5 build #66.
+
+**Gate verdict:** M1 and M2 PASS. No new adversary finding or veto.

machine-docs/STATUS-ghost.md

@@ -1,25 +1,28 @@
 # STATUS — phase ghost (ghost upgrade re-evaluation)
 
-**Updated:** 2026-09-07T21:35Z  
+**Updated:** 2026-10-20T03:26:00Z
 **Phase:** ghost  
 **Builder:** autonomic-bot
 
 ---
 
+Gate: M1 and M2 CLAIMED, awaiting Adversary. The previous M2 VETO for level-4 build #55 is
+superseded by the fresh level-5 build #66 below.
+
 ## DONE
 
-Both M1 and M2 have fresh Adversary PASSes dated 2026-09-07T21:29:58Z. The current canonical
+M1 and M2 have fresh Adversary PASSes in `REVIEW-ghost.md` at 2026-10-20T03:22:00Z.
-Ghost upgrade PR is #7; historical PR#4 was merged after the June completion.
 
 | Check | Result |
 |---|---|
-| Current Ghost PR | PR#7, `upgrade-808ac05`, head `14575de6209ab2c4fb29d95fe454b761070cd351` |
+| Current Ghost PR | PR#8, `upgrade-ee04ca9`, head `dbe40ecb7b0084050a71baf4dcf971b65aac125e` |
-| Fresh post-proxy retry | Gitea comment `15814`; Drone build #1332 |
+| Fresh post-proxy retry | Gitea comment `16297`; Drone build #66 |
-| Build #1332 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
+| Build #66 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
-| PR result comment | Gitea comment `15815` reports passed and links build #1332 |
+| PR result comment | Gitea comment `16298` reports passed and links build #66 |
+| Operator classification comment | Gitea comment `16299` explains historical infra/load confounds and operator readiness |
 | Post-run cleanup | no `ghos-*`/`dev-ghost` stacks, services, or volumes |
-| M1 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
+| M1 Adversary PASS | pending fresh verification of build #66 |
-| M2 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
+| M2 Adversary PASS | pending fresh verification of build #66 |
 
 ### Definition-of-Done checklist (ghost phase)
 
@@ -28,26 +31,26 @@ Ghost upgrade PR is #7; historical PR#4 was merged after the June completion.
 - [x] 2026-06-12 failures are classified separately from current recipe evidence
 - [x] Historical duplicate PRs are closed; no current duplicate exists
 - [x] No Ghost resources remain after the fresh retry
-- [x] M1 and M2 have fresh Adversary PASSes
+- [x] M1 and M2 have fresh Adversary PASSes for build #66
 
 ## M1 — State inventory and clean retry
 
-**Result:** current canonical Ghost upgrade PR verified by build #1332.
+**Result:** current canonical Ghost upgrade PR verified by build #66; Adversary re-verification pending.
 
 ### Live inventory
 
 | Check | Result |
 |---|---|
-| Open Ghost PRs | PR#7 only: `upgrade-808ac05` at `14575de6209ab2c4fb29d95fe454b761070cd351` |
+| Open Ghost PRs | PR#8 only: `upgrade-ee04ca9` at `dbe40ecb7b0084050a71baf4dcf971b65aac125e` |
-| Historical PR#4 | closed 2026-06-15; not the current upgrade PR |
+| Historical PR#7 | closed; not the current upgrade PR |
-| Historical duplicates | PR#3, PR#5, and PR#6 closed |
+| Historical duplicates | PR#1 through PR#7 closed |
 | Proxy subnet | `10.10.0.0/16` |
 | Ghost stacks/services/volumes before retry | none |
-| Fresh retry | Gitea comment `15814` at 2026-09-07T21:29:04Z; Drone build #1332 success, level 5/5 |
+| Fresh retry | Gitea comment `16297` at 2026-10-20T03:09:52Z; Drone build #66 success, level 5/5 |
 
 ### Adversary verification inputs
 
-**WHAT:** M1 is in progress. The correct live PR is `recipe-maintainers/ghost#7`, not historical PR#4. Build #1332 is the fresh post-proxy retry for its current head.
+**WHAT:** M1 and M2 claim the current live PR `recipe-maintainers/ghost#8` and fresh post-proxy build #66.
 
 **HOW:**
 
@@ -56,12 +59,12 @@ set -a; . /srv/cc-ci/cc-ci-plan/load-env.sh; set +a
 curl -fsS -u "$GITEA_USERNAME:$GITEA_PASSWORD" \
   "https://$GITEA_URL/api/v1/repos/recipe-maintainers/ghost/pulls?state=open" \
   | jq -r '.[] | [.number, .state, .head.sha, .head.ref] | @tsv'
-ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true'
+ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true; docker service ls --format "{{.Name}}" | rg "(^|[-_])(ghos-|dev-ghost)" || true; docker volume ls --format "{{.Name}}" | rg "(^|[-_])(ghos-|dev-ghost)" || true; jq -c "{recipe,pr,ref,level,results,lint,flags,skips}" /var/lib/cc-ci-runs/66/results.json'
 ```
 
-**EXPECTED:** one open PR (`7`, `14575de6209ab2c4fb29d95fe454b761070cd351`, `upgrade-808ac05`), proxy subnet `10.10.0.0/16`, and no Ghost stack output. Build #1332 reports `success`, level `5`, and all lifecycle results `pass`.
+**EXPECTED:** one open PR (`8`, `dbe40ecb7b0084050a71baf4dcf971b65aac125e`, `upgrade-ee04ca9`), proxy subnet `10.10.0.0/16`, and no Ghost resource output. Build #66 reports `success`, level `5`, all lifecycle results and lint `pass`, `clean_teardown=true`, `no_secret_leak=true`, and no skipped stages.
 
-**WHERE:** Gitea issue comment `15814`; Drone URL `https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332`.
+**WHERE:** Gitea issue comments `16297` and `16298`; Drone URL `https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/66`; host artifact `/var/lib/cc-ci-runs/66/results.json`; Adversary evidence in `REVIEW-ghost.md`.
 
 ---
 
@@ -74,5 +77,7 @@ ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subne
 | 519 | 2026-06-12T03:03Z | d88f5801 | ❌ FAIL | pre-proxy-fix, MySQL timing under load |
 | 557 | 2026-06-12T21:51Z | d88f5801 | ❌ FAIL | pre-proxy-fix |
 | **612** | **2026-06-13T06:13Z** | **d88f5801** | **✅ PASS level 5/5** | **post-proxy-fix** |
+| **50** | **2026-10-13T03:12Z** | **ee04ca9e** | **✅ PASS level 5/5** | historical PR#8 retry |
+| **66** | **2026-10-20T03:20Z** | **dbe40ecb** | **✅ PASS level 5/5** | fresh current PR#8 retry; lint verified |
 
 Proxy /16 fix: 2026-06-13T05:38Z (pvfix phase).

tests/lasuite-drive/recipe_meta.py

@@ -59,6 +59,13 @@ def EXTRA_ENV(ctx):
         # postgres, redis, collabora ~1GB, onlyoffice ~2GB). Bump so abra waits long enough for
         # convergence; kept under DEPLOY_TIMEOUT (1800) so Python never kills abra mid-wait.
         "TIMEOUT": "1500",
+        # abra's pinned-version `app new` regenerates the .env from generation hints and DROPS
+        # SECRET_COLLABORA_P_VERSION (not a generatable secret — the .env.sample ships its
+        # version line manually). Without it every secret-touching abra command for the app
+        # FATAs "missing version for secret? (collabora_p)" → the base deploy goes RED at
+        # install. env_set runs after app_new, so re-asserting the shipped version pin here
+        # restores the sample's contract.
+        "SECRET_COLLABORA_P_VERSION": "v1",
     }
 
 

tests/unit/test_meta.py

@@ -171,6 +171,22 @@ def test_extra_env_dict_and_callable_forms(tmp_path):
     assert meta_mod.extra_env(meta2, ctx2) == {}  # unset EXTRA_ENV resolves to {}
 
 
+TESTS_DIR = os.path.join(os.path.dirname(__file__), "..")
+
+
+def test_lasuite_drive_extra_env_carries_collabora_p_version():
+    """(REGRESSION, 2026-10-25) abra's pinned-version `app new` regenerates the .env from
+    generation hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships it manually),
+    so every secret-touching abra command for the app FATAs "missing version for secret?
+    (collabora_p)" and the cold base deploy goes RED at install. The per-recipe EXTRA_ENV must
+    re-assert the shipped version pin (env_set runs after app_new). Pin it here so abra/upstream
+    drift that loses it again surfaces as a red unit test, not a weekly red build."""
+    meta = meta_mod.load("lasuite-drive", tests_dir=TESTS_DIR)
+    ctx = meta_mod.hook_ctx("lasuite-drive-pr0-abc123.ci.commoninternet.net", meta)
+    extra = meta_mod.extra_env(meta, ctx)
+    assert extra.get("SECRET_COLLABORA_P_VERSION") == "v1"
+
+
 # ---- P3: uniform ctx hook convention -------------------------------------------------------------