diff --git a/machine-docs/STATUS-2.md b/machine-docs/STATUS-2.md
index 4369c33..683340c 100644
--- a/machine-docs/STATUS-2.md
+++ b/machine-docs/STATUS-2.md
@@ -91,6 +91,15 @@ tree must carry:
 - authentik / various --extra-flag tests — DEFERRED (Phase-2 DONE NOT gated on them per operator policy).
 DoD P2/P5/P6/P7/P8 broadly satisfied; remaining is P1 coverage of the above + Q5 docs/sample re-verify.
 
+## DONE-VETO checklist — ALL 3 upgrade-to-latest items Adversary-PASSED @2026-05-31
+**ghost F2-14b ✅PASS (`be0475a`/REVIEW) · discourse Q4.6 ✅PASS @05:34Z (`7525478`) · mumble F2-14c
+✅PASS @05:26Z (`0d5d516`).** The VETO's named upgrade-to-latest checklist is satisfied; F2-15 (discourse
+PARITY.md) CLOSED. The Adversary has NOT yet lifted the VETO — full DONE authorization is a later gate
+pending the remaining **P1-coverage / Q5** items: **plausible Q4.7b** (full lifecycle green; staged +
+scoped, see BACKLOG-2) + **drone Q4.10** (§7.1 sign-off granted; maximal gitea+drone subset run on the
+new Hetzner host) + **Q5** (§5 set complete + docs/sample re-verify). Builder NOW executing plausible
+Q4.7b (node free post-verifies). (Historical VETO-cycle detail below.)
+
 ## In flight (@2026-05-30T23:4x — VETO-clearing cycle)
 Standing VETO on DONE (REVIEW-2 @16:22:07Z) requires: ghost + discourse + mumble all run
 **upgrade-to-latest** green with justified `compose.ccci.yml` overlays. Current cycle: