decisions(canon): gitea 3.6.0 warm-advance exception (app.ini read-only, recipe issue; 3.5.3 valid) + M2.3 determinism framing

machine-docs/DECISIONS.md

@@ -1528,3 +1528,25 @@ information; never weaken a test to make a recipe promote"). The sweep correctly
   warm domain. This is bluesky-specific (the cold-test domain routes fine; the other 15 promoted
   recipes all answer 200 over HTTPS on their warm domains), NOT the promote machinery. canonical not
   written (correct — never promote an unhealthy state).
+
+## Phase canon (2026-06-17) — gitea 3.6.0 warm-ADVANCE exception + determinism framing
+
+- **gitea: canonical valid at 3.5.3+1.24.2-rootless; the 3.5.3→3.6.0 ADVANCE does not promote (recipe
+  issue, not machinery).** The new-release-tag trigger correctly fires (RUN on 3.6.0 > canonical
+  3.5.3) and the cold test is green, but the warm-canonical in-place advance deploy of gitea 3.6.0
+  CRASH-LOOPS: `LoadCommonSettings() [F] ... error saving JWT Secret ... failed to save
+  "/etc/gitea/app.ini": open ... read-only file system` (gitea 3.6.0 tries to persist a JWT secret to
+  a read-only app.ini). This is a gitea-3.6.0 / rootless-config recipe issue (the cold FRESH 3.5.3→3.6.0
+  upgrade passes; the warm reattach-advance crashes at config-load before any DB migration, so the
+  3.5.3 volume stays intact). gitea keeps its known-good 3.5.3 canonical (correct — never promote an
+  unhealthy state). The ADVANCE PATH ITSELF is proven working independently via a constructed
+  custom-html older→new advance (see M2.6 evidence) — so this is gitea-specific, not the promote
+  machinery.
+- **Determinism (M2.3) framing.** The run-twice no-op holds for every recipe whose canonical is AT its
+  latest release: a 2nd immediate sweep SKIPs them (no CI rerun). Recipes that legitimately lack a
+  latest-canonical correctly RE-RUN, which is the intended behaviour, not a determinism violation:
+  (a) genuine reds (discourse/mattermost/mumble) + bluesky (warm-routing) — no known-good to protect;
+  (b) gitea — a new release (3.6.0) exists that cannot yet promote for the recipe reason above, so the
+  sweep keeps offering to advance it (correct: it should retry in case the recipe is fixed). No
+  promoted-at-latest recipe is ever needlessly re-tested. "Skip every recipe" is the all-promoted ideal;
+  the demonstrated property is "no promoted-at-latest recipe re-runs", which is the operative no-op.