review(gtea): M2 pre-verify — two critical blockers filed @2026-06-15T20:50Z

Run 674 (main): upgrade FAIL ("not intended PR-head"); run 676 (PR#1 LFS): test_lfs_roundtrip
fails at git-push batch endpoint (LFS not enabled in deployed container). Builder must fix before M2.

machine-docs/BACKLOG-gtea.md

@@ -25,6 +25,57 @@
 ## Adversary findings
 (Adversary-owned — only the Adversary writes this section)
 
+### [critical — M2 blocker] LFS test fails in run 676 @2026-06-15T20:36Z
+
+Drone build 676 (RECIPE=gitea, PR=1, REF=357926f2): all lifecycle stages PASS but
+custom FAIL — `test_lfs_roundtrip` fails at `git push` with:
+```
+batch response: Repository or object not found:
+https://ci_admin:<passwd>@gite-e1cb78.ci.commoninternet.net/ci_admin/ci-lfs-test.git/info/lfs/objects/batch
+```
+Level=3 (install+upgrade+backup_restore pass, functional FAIL).
+
+Diagnosis: gitea ran WITHOUT LFS enabled at server level (`LFS_START_SERVER = false` in app.ini).
+`_lfs_available()` returned True (compose.lfs.yml was in the per-run ABRA_DIR at test time —
+recipe reflog confirms checkout to 357926f2 at 20:35:58, 38s before the test at 20:36:36).
+
+Root cause under investigation: EXTRA_ENV sets COMPOSE_FILE to include compose.lfs.yml when
+`_lfs_enabled()` is True. But the upgrade tier's abra base-deploy internally checks out
+`3.5.2+1.24.2-rootless` tag in the recipe dir (reflog: 20:35:37) removing compose.lfs.yml, then
+harness re-checkouts 357926f2 at 20:35:58. Depending on WHEN the install deploy runs relative to
+these checkouts, COMPOSE_FILE and/or SECRET_LFS_JWT_SECRET_VERSION may not have been correctly
+resolved.
+
+Most likely cause: compose.lfs.yml was NOT included in the actual `docker stack deploy` command
+(either because EXTRA_ENV was evaluated before compose.lfs.yml existed, or because the lfs_jwt_secret
+Docker secret was not generated since SECRET_LFS_JWT_SECRET_VERSION=v1 only exists in the EXTRA_ENV
+dict, not in the .env FILE that `abra secret generate` reads).
+
+Builder must: reproduce locally with RECIPE=gitea, PR=1, REF=357926f2; verify compose.lfs.yml is
+in COMPOSE_FILE at deploy time; verify lfs_jwt_secret Docker secret is generated; verify
+LFS_START_SERVER=true and LFS_JWT_SECRET=<value> appear in /etc/gitea/app.ini inside the container.
+
+### [critical — M2 blocker] Upgrade fails on main-branch CI run (run 674) @2026-06-15T20:36Z
+
+Drone build 674 (RECIPE=gitea, PR=0, REF=main): upgrade FAIL with:
+"upgrade deployed chaos commit 'e6a1cc79', not the intended PR-head 'main' — the re-checkout
+to the code under test failed, so the upgrade is not exercised."
+Level=1 (install pass only).
+
+This is the M2 main-branch CI run that must be level=5. With upgrade failing, M2 cannot pass.
+Builder must investigate why REF=main doesn't work correctly for the upgrade tier.
+
+### [non-blocking — concurrency] Run 675 install failure @2026-06-15T20:36Z
+
+4 !testme comments were posted concurrently → 4 Drone builds triggered simultaneously (674, 675,
+676, +). Builds 674 and 675 both have PR=0/REF=main → same app domain → lock contention.
+Run 675 started while 674 had the lock → found stale state → ci_admin creds cached but user
+gone (409 create path) → 401 on API calls → level=0.
+
+Not a code bug. Builder should post ONE !testme at a time to avoid concurrency collisions.
+The concurrent lock mechanism should prevent partial-state damage, but the stale cred cache
+(`/tmp/ccci-gitea-admin-<domain>.json`) persists and causes 401s.
+
 ### [non-blocking] Stale screenshot in manual runs @2026-06-15T20:32Z
 
 `/var/lib/cc-ci-runs/manual/screenshot.png` mtime = June 13, not from today's M1 run.