test(net,drive): cover drop_pool rebuild + GoogleDriveStore::new CA path

Bring the regression-vs-main coverage delta to ~neutral.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

Author: pmaxhogan

crates/driven-drive/src/google/mod.rs

@@ -1872,6 +1872,27 @@ pub(crate) fn clone_kind(kind: &ResumableKind) -> ResumableKind {
 mod tests {
     use super::*;
 
+    #[test]
+    fn google_store_new_builds_a_stream_client_with_the_ca() {
+        // Issue #34: `GoogleDriveStore::new` derives its streaming client via
+        // `build_stream_client(ca)` (here `none`, offline). Covers the ctor +
+        // stream-client build path without a network/keychain dependency.
+        let tokens = crate::google::oauth::Tokens {
+            access_token: String::new(),
+            refresh_token: "rt".to_string(),
+            expires_at: 0,
+        };
+        let http = build_meta_client(&CustomCaConfig::none()).expect("meta client");
+        let source = RefreshingTokenSource::new(tokens, http, "cid", "secret");
+        let store = GoogleDriveStore::new(
+            build_meta_client(&CustomCaConfig::none()).expect("meta client"),
+            source,
+            &CustomCaConfig::none(),
+        );
+        // The streaming client is a distinct, usable handle (no panic on build).
+        let _ = store.http_stream();
+    }
+
     #[test]
     fn drive_clients_apply_custom_ca_fail_closed() {
         // Issue #34: the Drive metadata + stream clients add the custom CA

crates/driven-net/src/lib.rs

@@ -592,6 +592,17 @@ mod tests {
         assert!(build_service_client(ServiceName::Drive, &bad).is_err());
     }
 
+    #[tokio::test]
+    async fn drop_pool_rebuilds_the_service_client_with_the_stored_ca() {
+        // Issue #34: a pool teardown rebuilds the client re-applying the SAME CA
+        // (here `none`, offline) - it must not panic or drop the client.
+        let backend = ReqwestBackend::new(CustomCaConfig::none()).expect("construct backend");
+        backend.drop_pool(ServiceName::Drive).await;
+        // Telemetry has no pooled client; drop is a no-op (early-return covered).
+        backend.drop_pool(ServiceName::Telemetry).await;
+        assert!(backend.service_client(ServiceName::Drive).is_some());
+    }
+
     // --- per-service client mapping covers exactly the probed services ---
 
     #[test]