diff --git a/machine-docs/STATUS-2.md b/machine-docs/STATUS-2.md
index 2e14daf..9e7e9e4 100644
--- a/machine-docs/STATUS-2.md
+++ b/machine-docs/STATUS-2.md
@@ -48,6 +48,21 @@ tree must carry:
   plausible, uptime-kuma, mailu, drone).
 - **Q5** — Completeness + docs; flip `## DONE`.
 
+## Remaining Phase-2 P1-coverage gaps (post-ghost, @2026-05-30)
+§5 recipes with Adversary PASS: custom-html, n8n (Q1), keycloak (Q2), cryptpad (Q3.4), lasuite-drive
+(Q3.2), lasuite-meet (Q3.3), immich (Q3.5), matrix-synapse (Q4.1), mumble (Q4.2), bluesky-pds (Q4.3),
+**ghost (Q4.4 ✅)**, mattermost-lts (Q4.5), uptime-kuma (Q4.8), mailu (Q4.9). Still open:
+- **lasuite-docs (Q3.1)** — partial (parity + 2 specific + OIDC); deeper OIDC ports deferred
+  (DEFERRED.md). NEXT-CANDIDATE: confirm full-lifecycle green + formal gate claim. Node-needed.
+- **plausible (Q4.7)** — §4.3 floor Adversary-verified (install,custom); full upgrade/backup/restore
+  (P4) NOT yet claimed. Heavy: ClickHouse cold-boot flaky 1-in-2 (retry/readiness margin). Node-needed.
+- **drone (Q4.10)** — was BLOCKED on operator host /etc/timezone deploy. A `drone_ci_commoninternet_net`
+  stack is now RUNNING on the node — re-check whether the host fix landed (then gitea-dep + §4.3).
+- **discourse (Q4.6)** — BLOCKED: upstream pins `bitnami/discourse:*` images Docker Hub no longer
+  serves; can't unblock until upstream releases a fixed version. DEFERRED.md.
+- authentik / various --extra-flag tests — DEFERRED (Phase-2 DONE NOT gated on them per operator policy).
+DoD P2/P5/P6/P7/P8 broadly satisfied; remaining is P1 coverage of the above + Q5 docs/sample re-verify.
+
 ## In flight
 **Q4.4 ghost — ✅ Adversary PASS @2026-05-30 (REVIEW-2 `baa7ad8`). DONE.** (See ## Gate Q4.4.)
 Closes the Adversary's standing ghost §4.3 DONE-blocker. 4th data-loss recipe bug cc-ci caught