review(gtea): M2 pre-verify — two critical blockers filed @2026-06-15T20:50Z

Run 674 (main): upgrade FAIL ("not intended PR-head"); run 676 (PR#1 LFS): test_lfs_roundtrip
fails at git-push batch endpoint (LFS not enabled in deployed container). Builder must fix before M2.

machine-docs/REVIEW-gtea.md

@@ -121,3 +121,55 @@ All M1 DoD satisfied:
 - No secrets in run artifacts: no_secret_leak=true ✓
 
 Gate M1: **ADVERSARY PASS** (commit bac3662, run_id=manual, all stages pass)
+
+---
+
+## M2 pre-verification @2026-06-15T20:50Z
+
+Builder triggered !testme on PR #1 (gitea recipe mirror, git.autonomic.zone) and on main branch.
+Bridge is live with recipe-maintainers/gitea in POLL_REPOS. 3 CI runs completed:
+
+### Run 674 — main branch (RECIPE=gitea, PR=0, REF=main)
+
+level=1. install: PASS. upgrade: **FAIL**.
+Error: "upgrade deployed chaos commit 'e6a1cc79', not the intended PR-head 'main' — the re-checkout
+to the code under test failed."
+backup/restore/custom: PASS (ran on the existing install despite upgrade failure).
+LFS test: correctly SKIP (REF=main, compose.lfs.yml absent from main branch). ✓
+
+**M2 main-branch DoD NOT met.** Upgrade tier must PASS for level=5.
+
+### Run 675 — main branch concurrent (PR=0, REF=main)
+
+level=0. All stages FAIL.
+Root cause: concurrent collision with run 674 (same domain from same recipe+pr+ref hash).
+ci_admin creds cached at /tmp/ccci-gitea-admin-<domain>.json from run 674 → 401 on API calls
+because gitea was in a stale state. Non-blocking bug (triggered by multiple !testme comments).
+
+### Run 676 — PR #1 (RECIPE=gitea, PR=1, REF=357926f2)
+
+level=3. install/upgrade/backup/restore: PASS ✓. custom: **FAIL**.
+LFS test failure: `git push` batch endpoint returns "Repository or object not found".
+`_lfs_available()` returned True (compose.lfs.yml present in recipe dir at test time — confirmed
+via recipe reflog: checkout to 357926f2 at 20:35:58, test ran at 20:36:36).
+But gitea LFS server was not accepting LFS batch requests → `LFS_START_SERVER = false` in app.ini.
+
+PR #1 code verified correct:
+- compose.lfs.yml: GITEA_LFS_START_SERVER=true + lfs_jwt_secret external secret ✓
+- app.ini.tmpl: LFS_START_SERVER rendered from env, LFS_JWT_SECRET conditional ✓
+- abra.sh: APP_INI_VERSION v22 (triggers re-render on deploy) ✓
+
+Likely harness-level bug: either (a) lfs_jwt_secret not generated (SECRET_LFS_JWT_SECRET_VERSION=v1
+only in EXTRA_ENV dict, not in disk .env file read by `abra secret generate`), or (b) compose.lfs.yml
+not included in COMPOSE_FILE at actual docker deploy time due to abra base-deploy checkout timing
+(abra checked out 3.5.2+1.24.2-rootless tag at 20:35:37 removing compose.lfs.yml, harness
+re-checked 357926f2 at 20:35:58 restoring it, but EXTRA_ENV may have been evaluated before that).
+
+Filed as critical M2 blockers in BACKLOG-gtea.md. Builder must fix before M2 can be claimed.
+
+## M2 VERDICT: PENDING — two critical blockers
+
+1. LFS test fails in run 676 (PR #1 custom tier fail, level=3 not level=5)
+2. Upgrade fails on main branch run 674 (level=1, not level=5)
+
+Gate M2: **NOT CLAIMED** — Builder must fix and re-trigger CI