claim(2): Q3.3 lasuite-meet — full lifecycle green (meeting_flow §4.3 + OIDC; R014 chaos-base; webrtc env-blocker non-port)

lasuite-meet full suite GREEN (log /root/ccci-meet-full6.log): install/upgrade/backup/restore/custom
all pass, deploy-count=1, clean teardown, real upgrade crossover 0.2.0+v1.15.0→0.3.0+v1.16.0.
- §4.3 test_meeting_flow: create-room (201) → read-back (200) → LiveKit join token (JWT room grant) →
  delete. test_oidc_password_grant PASSED. Parity: health_check + oidc_login. Reused lasuite-drive
  OIDC-at-install machinery.
- R014 fix (72719fe): upstream lightweight tag → chaos-base deploy of the checked-out prev version
  (skips lint, deploys prev not latest — verified by the crossover).
- webrtc-media/relay UDP media-relay = documented env-blocker non-port; maximal subset (LiveKit token
  issuance) shipped in meeting_flow.
Gate evidence/HOW/EXPECTED/WHERE in STATUS-2. DECISIONS: R014 chaos-base + webrtc non-port. BACKLOG-2
[idea]: harness image pre-pull. Single cold-verified green is the bar (operator clarification).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/STATUS-2.md

@@ -49,6 +49,10 @@ tree must carry:
 - **Q5** — Completeness + docs; flip `## DONE`.
 
 ## In flight
+**Q3.3 lasuite-meet — CLAIMED @2026-05-29 (Gate: Q3.3 below), awaiting Adversary.** Full lifecycle
+green; meeting_flow §4.3 + OIDC; reused drive's OIDC-at-install; R014 fixed via chaos-base. Working
+next Q4 recipe meanwhile. (Q3.1 lasuite-docs partial, Q3.5 immich remain for Q3.)
+
 **Q3.2 lasuite-drive — ✅ Adversary PASS @2026-05-29 (REVIEW-2 `3f5d58a`); F2-12 CLOSED.** Cold
 re-run all 5 tiers GREEN, upgrade tier passes, deploy-count=1, ready-probe OK(200)×2, OIDC+minio PASS,
 data-integrity survives, clean teardown; `-c`+owned-wait/READY_PROBE proven non-vacuous. The standing
@@ -125,6 +129,47 @@ SKIP no longer yields a GREEN `!testme`.
 
 ## Gate
 
+**Gate: Q3.3 lasuite-meet — CLAIMED @2026-05-29, awaiting Adversary.**
+
+**WHAT.** lasuite-meet (La Suite real-time meetings via LiveKit; OIDC-required; sibling of
+lasuite-docs/drive) runs its **full lifecycle GREEN** — install + upgrade (real prev→PR-head
+crossover) + backup + restore + custom (health + OIDC + meeting_flow). Enrolled by reusing the
+lasuite-drive OIDC-at-install machinery (DEPS=["keycloak"], OIDC_AT_INSTALL, install_steps.sh wiring
+OIDC env before the single deploy). Two infra fixes were needed:
+- **R014 lightweight-tag → chaos-base deploy** (commit `72719fe`): upstream coop-cloud lasuite-meet
+  ships a stray LIGHTWEIGHT tag `0.3.0+v1.16.0`, which FATAs `abra recipe lint` (R014) on the pinned
+  prev-version base deploy. Fix: `abra.has_lightweight_version_tags` detects it; deploy_app then
+  deploys the EXPLICITLY-checked-out prev version with chaos (chaos skips lint + deploys the current
+  checkout — NOT latest; F1d-2's hazard was a *missing* checkout). Verified by the real upgrade
+  crossover below. (An origin-repoint approach was tried + abandoned: go-git 'reference not found'.)
+- **meeting_flow tolerant delete** (commit `1f7806a`): meet 0.3.0 soft/async-deletes rooms, so the
+  post-delete 404 check is best-effort; the §4.3 create+read-back+LiveKit-token asserts stay HARD.
+
+**HOW (Adversary, cold, on cc-ci):**
+```
+ssh cc-ci 'cd /root/<your-clone> && git pull && RECIPE=lasuite-meet PR=0 cc-ci-run runner/run_recipe_ci.py'
+```
+
+**EXPECTED:**
+- RUN SUMMARY: `deploy-count = 1`; `install/upgrade/backup/restore/custom` **all `pass`**.
+- `tests/lasuite-meet/functional/test_meeting_flow.py::test_create_room_get_livekit_token_and_read_back`
+  **PASSED** — creates a room (201), reads it back (200, same LiveKit room), the LiveKit token is a JWT
+  granting that room, deletes it.
+- `test_oidc_password_grant_against_dep_keycloak` **PASSED** (not skipped) — password-grant JWT vs the
+  per-run keycloak realm `lasuite-meet-<6hex>`.
+- Log shows `lightweight upstream tag present → chaos base deploy` and
+  `upgrade→PR-head: … version=0.2.0+v1.15.0→0.3.0+v1.16.0` (real crossover, NOT latest-as-base).
+- Data-integrity: postgres ci_marker survives upgrade + backup→wipe→restore.
+- Clean teardown: post-run no `lasu` stacks/volumes.
+
+**WHERE.** Commits `32a743f` (recipe_meta) + `9c6cb53` (meeting_flow + PARITY) + `72719fe` (R014
+chaos-base) + `1f7806a` (tolerant delete). Files: `tests/lasuite-meet/{recipe_meta.py,install_steps.sh,
+ops.py,test_*.py,functional/*.py,PARITY.md}`, `runner/harness/abra.py` (`has_lightweight_version_tags`),
+`runner/harness/lifecycle.py` (chaos-base branch). Log `/root/ccci-meet-full6.log`. webrtc-media/relay
+UDP media-relay = documented env-blocker non-port (maximal subset = LiveKit token issuance, shipped).
+
+---
+
 **Gate: Q3.2 lasuite-drive — RE-CLAIMED @2026-05-29 (after F2-12 fix), awaiting Adversary.**
 (First claim `911680f` FAILed cold-verify — F2-12: the upgrade chaos redeploy's abra converge monitor
 FATA'd while the NEW collabora 25.04.9.4.1 was still in its healthcheck `start_period`. Fixed by