diff --git a/machine-docs/STATUS-2.md b/machine-docs/STATUS-2.md
index 79b7199..4369c33 100644
--- a/machine-docs/STATUS-2.md
+++ b/machine-docs/STATUS-2.md
@@ -130,7 +130,48 @@ Standing VETO on DONE (REVIEW-2 @16:22:07Z) requires: ghost + discourse + mumble
   - Harness now echoes abra backup+restore output into the run log (cc-ci `4a29ca6`,`2f6a684`) — backup/
     restore no longer opaque. cc-ci fixes `8d689d6`. Validation run `/root/ccci-discourse-full4.log`
     (full `install,upgrade,backup,restore,custom`, PR head `3758522`).
-- mumble F2-14c + plausible Q4.7b still open.
+- **mumble F2-14c — ✅ CLAIMED @2026-05-31T05:1xZ (full lifecycle green incl upgrade-to-latest; cc-ci
+  host-ports fork REMOVED; see ## Gate F2-14c).** Closes the mumble portion of the DONE VETO — the LAST
+  VETO checklist item (ghost done, discourse Q4.6 claimed). plausible Q4.7b still open (P1-coverage,
+  not a VETO item).
+
+## Gate F2-14c — CLAIMED @2026-05-31T05:1xZ (mumble upgrade-to-latest + voice-on-latest, NO cc-ci fork)
+**WHAT.** mumble full lifecycle GREEN incl **upgrade-to-latest** with the cc-ci `compose.host-ports.yml`
+fork + `install_steps.sh` REMOVED (the Adversary's F2-14c disposition / DONE-VETO item). Base 0.2.0
+deploys minimally (`compose.yml:compose.mumbleweb.yml`, no host-ports — predates 1.0.0); the on-host
+voice overlay SKIPS on the base (recorded); the upgrade to latest 1.0.0 adds the NATIVE
+`compose.host-ports.yml` via the new general `UPGRADE_EXTRA_ENV` harness hook, and the voice/web/config
+tests run on latest. No cc-ci fork of any upstream file remains for mumble. Closes the mumble portion of
+the standing DONE VETO (REVIEW-2 @16:22:07Z) — with ghost (F2-14b PASS) and discourse (Q4.6 claimed),
+this is the LAST VETO checklist item.
+
+**WHERE (inputs).**
+- cc-ci commit: `4bf9e1d` (+ pushed HEAD). Harness additions: `abra.env_get` (symmetric reader);
+  `generic.perform_upgrade` applies `UPGRADE_EXTRA_ENV` (meta dict/callable) via `abra.env_set` after the
+  PR-head checkout, before the chaos redeploy; `UPGRADE_EXTRA_ENV` added to the meta allowlist
+  (`run_recipe_ci.py`). mumble `tests/mumble/recipe_meta.py`: base `EXTRA_ENV.COMPOSE_FILE` without
+  host-ports, `UPGRADE_EXTRA_ENV.COMPOSE_FILE` with it, `READY_PROBE` reads live COMPOSE_FILE (tcp 64738
+  probe only when host-ports active), `CHAOS_BASE_DEPLOY` removed. `tests/mumble/test_install.py` skips
+  the voice check when host-ports absent. DELETED: `tests/mumble/compose.host-ports.yml`,
+  `tests/mumble/install_steps.sh`. Decision: DECISIONS.md 2026-05-31 mumble entry.
+- Run log on cc-ci: `/root/ccci-mumble-f214c.log`.
+
+**HOW (cold re-run).** From a fresh clone at `4bf9e1d`, on cc-ci (node clean first):
+`RECIPE=mumble PR=0 cc-ci-run runner/run_recipe_ci.py`
+
+**EXPECTED.** RUN SUMMARY: `deploy-count = 1`; install/upgrade/backup/restore/custom ALL `pass`.
+- Base deploy: `deploy_app(mumble@0.2.0+v1.6.870-0)` (NORMAL pinned, NO `CHAOS_BASE_DEPLOY` line, NO
+  `install_steps: provided compose.host-ports.yml`). install tier: `test_serving PASSED` (mumble-web HTTP)
+  + `test_voice_server_listening SKIPPED` (reason: 0.2.0 predates host-ports → voice on latest).
+- Upgrade: `upgrade-env: COMPOSE_FILE=compose.yml:compose.mumbleweb.yml:compose.host-ports.yml` then
+  `ready-probe OK (tcp 3x): 127.0.0.1:64738` then `upgrade→PR-head: head_ref=<8> chaos-version=<same>
+  version=0.2.0+v1.6.870-0→1.0.0+v1.6.870-0` (real crossover, chaos-version==head_ref).
+- P3/P2 on latest (custom tier, all PASS): `test_protocol_handshake` (TLS handshake + channel presence),
+  `test_tcp_health` (64738), `test_web_client` (mumble-web UI), `test_welcome_text_roundtrip`
+  (WELCOME_TEXT marker surfaces in ServerSync), `test_server_config_limits` (USERS=42 surfaces).
+- P4 NON-VACUOUS: `test_backup::test_backup_captures_state PASSED`,
+  `test_restore::test_restore_returns_state PASSED` (sqlite `ci_marker` survives seed→backup→drop→restore).
+- Clean teardown: 0 mumble stacks / volumes / secrets / networks after the run.
 
 ## Gate Q4.6 — CLAIMED @2026-05-31T05:0xZ (discourse full lifecycle incl upgrade-to-latest, green)
 **WHAT.** discourse full lifecycle GREEN — install + **upgrade-to-latest** + backup + restore + custom,