claim(2): Q3.3 lasuite-meet — full lifecycle green (meeting_flow §4.3 + OIDC; R014 chaos-base; webrtc env-blocker non-port)

lasuite-meet full suite GREEN (log /root/ccci-meet-full6.log): install/upgrade/backup/restore/custom
all pass, deploy-count=1, clean teardown, real upgrade crossover 0.2.0+v1.15.0→0.3.0+v1.16.0.
- §4.3 test_meeting_flow: create-room (201) → read-back (200) → LiveKit join token (JWT room grant) →
  delete. test_oidc_password_grant PASSED. Parity: health_check + oidc_login. Reused lasuite-drive
  OIDC-at-install machinery.
- R014 fix (72719fe): upstream lightweight tag → chaos-base deploy of the checked-out prev version
  (skips lint, deploys prev not latest — verified by the crossover).
- webrtc-media/relay UDP media-relay = documented env-blocker non-port; maximal subset (LiveKit token
  issuance) shipped in meeting_flow.
Gate evidence/HOW/EXPECTED/WHERE in STATUS-2. DECISIONS: R014 chaos-base + webrtc non-port. BACKLOG-2
[idea]: harness image pre-pull. Single cold-verified green is the bar (operator clarification).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/BACKLOG-2.md

@@ -114,8 +114,16 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       convergence** (per the DECISIONS guardrail "prefer abra convergence by default"). Recipe-side only;
       harness-side OIDC-at-install (Part A) stays. Use the recipe-create-pr skill. Not started; do after
       Q3.2 PASSes + higher-priority Q4 coverage.
-- [ ] **Q3.3** — lasuite-meet: parity (health_check, oidc_login, meeting_flow, webrtc-media,
-      webrtc-relay) + specific (create-a-room, two-user LiveKit token issuance, ICE-candidate gathering).
+- [x] **Q3.3** — lasuite-meet: **FULL LIFECYCLE GREEN @2026-05-29 — CLAIMED (STATUS-2 Gate Q3.3),
+      awaiting Adversary.** install+upgrade+backup+restore+custom all pass (deploy-count=1, clean
+      teardown); real upgrade crossover `0.2.0+v1.15.0→0.3.0+v1.16.0`. Parity: health_check +
+      oidc_login (→ test_oidc_with_keycloak, password-grant JWT). §4.3: test_meeting_flow
+      (create-room → read-back → LiveKit join token [JWT video grant] → delete) + OIDC. Reused
+      lasuite-drive OIDC-at-install machinery. R014 lightweight-tag fixed via chaos-base deploy
+      (commit 72719fe). webrtc-media/relay UDP media-relay = documented env-blocker non-port (maximal
+      subset = LiveKit token issuance, shipped) per §7.1. Commits 32a743f+9c6cb53+72719fe+1f7806a;
+      log /root/ccci-meet-full6.log. Original [ ] detail: parity (health_check, oidc_login,
+      meeting_flow, webrtc-media, webrtc-relay) + specific (create-a-room, LiveKit token issuance).
 - [~] **Q3.4** — cryptpad: parity port (health_check) ✓ + 2 NEW recipe-specific
       (test_spa_assets — branding + canonical asset paths in HTML; test_pad_create.py —
       Playwright SPA renders + JS bundle loads + no console errors). Open follow-up: the
@@ -168,6 +176,12 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       with the F2-7 keycloak-specificity caveat; worked lasuite-docs example end-to-end. **Will
       re-pass when Q3.2/Q3.5 enroll new recipes** (immich/lasuite-drive) to confirm a new
       engineer can follow the doc cold.
+- [ ] **[idea]** — Harness image pre-pull before `abra app deploy`. First-ever deploy of a fresh
+      recipe can hit a swarm "No such image" placement race on digest-pinned images (observed once on
+      lasuite-meet's first deploy; self-resolved after manual `docker pull`; images then cached + kept
+      by the conservative prune). A pre-pull (parse compose images, `docker pull` each in
+      `lifecycle.deploy_app` before deploy) would make first-cold deploys deterministic. Low-risk,
+      helps every fresh recipe + a from-scratch host (D8). Not blocking (warm-cache model masks it).
 - [ ] **Q5.2** — Adversary samples a subset and cold-verifies parity tables + specific tests are real
       (not health-only, not skipped). NO weakened test, no corners cut (P7).
 - [ ] **Q5.3** — Phase 2 `## DONE` after all P1–P8 Adversary cold-verified PASS, no standing VETO.