claim(gtea): M1 — suite green locally, all 5 stages PASS, git-lfs deployed

Manual harness run 846690: install PASS + upgrade PASS + backup PASS + restore
PASS + custom PASS (level=5/5). LFS test self-skips correctly (compose.lfs.yml
absent on main). All pre-M1 Adversary findings from BUILDER-INBOX consumed:
  - Issue 1: git-lfs added to cc-ci-hetzner NixOS config, deployed (v3.6.1)
  - Issue 2: double /api/v1 path in test_lfs_roundtrip.py fixed

Awaiting Adversary M1 PASS before proceeding to real CI + LFS PR capstone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/JOURNAL-gtea.md

@@ -68,3 +68,54 @@ All unit tests: 269 passed, 1 pre-existing failure (test_warm_reconcile.py - unr
 ```
 
 ### Next: run harness locally (BACKLOG item 2)
+
+---
+
+## 2026-06-15 — Harness run + M1 claim
+
+### Bugs found and fixed during harness run
+
+1. **Playwright `_csrf` selector (test_install.py)**: `input[name='_csrf']` is a hidden field;
+   `wait_for_selector` defaults to `state='visible'` and times out. Fixed: use `input#user_name`
+   (the visible username field). Root cause: gitea renders CSRF as `type="hidden"`.
+
+2. **git credential injection (test_git_push.py + test_lfs_roundtrip.py)**: The
+   `GIT_CONFIG_COUNT/KEY/VALUE` insteadOf rewriting approach silently failed: push exited 0 but
+   the remote repo remained empty. Fixed: embed credentials directly in the clone URL as
+   `https://user:pass@host/user/repo.git`. Also switched from empty-repo clone to auto_init=True
+   (initial commit present) + push via explicit URL `git push cred_url HEAD:refs/heads/main`.
+
+3. **double /api/v1 in LFS restart poll (test_lfs_roundtrip.py)**: `_api()` prepends `/api/v1`;
+   the health poll used path `/api/v1/version` which produced `/api/v1/api/v1/version` → 404 forever.
+   Fixed: changed path to `/version`.
+
+4. **Token scope required (test_admin_api.py)**: gitea 1.22+ requires `scopes` in token creation
+   body. Added `["read:user", "read:organization"]` to satisfy both the creation endpoint and the
+   subsequent read-back assertions.
+
+5. **git-lfs not installed on cc-ci (Adversary finding)**: Added `git-lfs` to
+   `nix/hosts/cc-ci-hetzner/configuration.nix` systemPackages. Deployed via
+   `nixos-rebuild switch --flake '/root/builder-clone?submodules=1#cc-ci' 2>&1`. Note: secrets/
+   is a git submodule (gitignored but tracked); must use `?submodules=1` in flake URL.
+   git-lfs 3.6.1 confirmed installed post-deploy.
+
+### Harness results (run 846690)
+
+```
+install : PASS
+upgrade : PASS
+backup  : PASS
+restore : PASS
+custom  : PASS  (admin_api PASS, git_push PASS, health PASS, lfs_roundtrip SKIPPED ✓)
+Level: 5/5
+```
+
+LFS test self-skips with expected message: "compose.lfs.yml absent in gitea recipe checkout".
+
+### M1 CLAIMED
+
+Commit chain: 6ac9989 → 74bc5f0 (selector fix → full test suite → all harness fixes → git-lfs NixOS)
+Adversary findings from BUILDER-INBOX consumed in 446bafe.
+M1 claim commit: see `claim(gtea):` below.
+
+### Next: await Adversary M1 PASS → proceed to BACKLOG items 6-8 (real CI + LFS PR)