status(gtea): M2 blockers fixed; CI builds #681/#682 in flight

- Consumed BUILDER-INBOX (M2 blockers from Adversary @20:50Z)
- Fixed all 3 blockers in commit a121d2c:
  1. LFS test fails: UPGRADE_EXTRA_ENV + secret generation in upgrade path
  2. REF=main HC1 fail: always use git SHA for head_ref
  3. Stale creds 401s: delete creds file in pre_install
- Unit tests: 53/53 pass
- Retriggered: build #681 (main) and #682 (PR #1 lfs-plain-gitea)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/BACKLOG-gtea.md

@@ -13,12 +13,14 @@
 - [x] 4. Verify LFS test correctly skips on main (compose.lfs.yml absent)
       SKIPPED with expected message in run 846690. PASS.
 - [x] 5. CLAIM M1 — ADVERSARY PASS @2026-06-15T20:32Z (commit a106036)
-- [ ] 6. Run full harness via real CI / !testme on gitea recipe
-      IN FLIGHT: Drone build #675 (RECIPE=gitea REF=main PR=0) — triggered 20:34Z
-- [ ] 7. Run harness on lfs-plain-gitea head → LFS test must go green
-      IN FLIGHT: Drone build #676 (PR=1 REF=357926f2) — !testme posted 20:34Z
+- [~] 6. Run full harness via real CI / !testme on gitea recipe
+      Builds #674/#675 FAILED (blocker: head_ref="main" fails HC1; stale creds).
+      FIXED in commit a121d2c. Retriggered as build #681 (RECIPE=gitea REF=main PR=0) @21:00Z
+- [~] 7. Run harness on lfs-plain-gitea head → LFS test must go green
+      Build #676 FAILED (blocker: LFS not enabled in upgrade chaos redeploy).
+      FIXED in commit a121d2c. Retriggered as build #682 (PR=1 REF=357926f2) @21:00Z
 - [x] 8. Post !testme on PR #1 so result lands in PR
-      DONE (posted 20:34Z, build #676, PENDING)
+      DONE (posted 20:34Z, build #676, PENDING; re-triggered as #682)
 - [ ] 9. CLAIM M2 (await Adversary PASS)
 - [ ] 10. Write ## DONE (all Adversary PASSes)
 

machine-docs/STATUS-gtea.md

@@ -4,20 +4,31 @@
 
 ## Current state
 
-Phase: **BUILDING M2 — Real CI + LFS PR capstone**
+Phase: **BUILDING M2 — M2 blocker fixes applied; CI runs #681/#682 in flight**
 
-Full harness run 846690 result: level=5/5
-  install: PASS  upgrade: PASS  backup: PASS  restore: PASS  custom: PASS
-  LFS test: SKIPPED (correct — compose.lfs.yml absent on main)
+Fixed two M2 blockers (commit a121d2c @~2026-06-15T21:00Z):
+  1. LFS upgrade: added UPGRADE_EXTRA_ENV to recipe_meta.py (adds compose.lfs.yml to
+     COMPOSE_FILE after PR-head checkout) + abra.secret_generate in upgrade path in
+     generic.py so lfs_jwt_secret is generated before chaos redeploy.
+  2. REF=main HC1 fail: run_recipe_ci.py now always uses recipe_head_commit (git SHA)
+     for head_ref instead of the branch name "main".
+  3. Stale creds: ops.py pre_install deletes creds file before _ensure_admin (fresh
+     install wipes DB; old creds are stale and cause 401s).
 
-Adversary pre-M1 findings consumed:
-  - Issue 1 (git-lfs missing): added to nix/hosts/cc-ci-hetzner systemPackages; deployed.
-  - Issue 2 (double /api/v1 path): fixed in test_lfs_roundtrip.py restart health-poll.
+Unit tests: 53/53 PASS (test_gitea_dep.py 10/10, test_meta.py 43/43)
+
+Adversary M2 blockers (from BUILDER-INBOX @20:50Z):
+  - Blocker 1 (run 676): LFS roundtrip FAIL — gitea deployed without LFS (compose.lfs.yml
+    missing from upgrade chaos redeploy COMPOSE_FILE). Fixed by UPGRADE_EXTRA_ENV + secret gen.
+  - Blocker 2 (run 674): upgrade FAIL — head_ref="main" failed HC1 SHA comparison. Fixed.
+  - Blocker 3 (run 675): stale creds file caused 401s on all API calls. Fixed.
 
 ## Gate status
 
 - Gate M1: **ADVERSARY PASS** @2026-06-15T20:32Z (commit a106036)
-- Gate M2: IN PROGRESS (item 6: real CI on main; items 7+8: LFS PR capstone)
+- Gate M2: IN PROGRESS
+  Build #681 (RECIPE=gitea REF=main PR=0): PENDING @21:00Z
+  Build #682 (RECIPE=gitea REF=357926f2 PR=1): PENDING @21:00Z
 
 ## Prerequisites verified