diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f677335..03e2a82 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,14 +28,14 @@ on:
 # ─────────────────────────────────────────────────────────────────────────────
 # CI DAG overview
 #
-#   changes ──► provider-e2e ──┐
-#                              │
-#   lint ──────────────────────┤
-#   unit-test ─────────────────┤──► required-checks ──► package
-#   build ─────────────────────┤                  └────► publish (main only)
+#   changes ──► gitea-e2e ─────┐
+#           └─► provider-e2e ───┤
+#   lint ───────────────────────┤
+#   unit-test ──────────────────┤──► required-checks ──► package
+#   build ──────────────────────┤                  └────► publish (main only)
 #
-# All four validation jobs (lint, unit-test, build, provider-e2e) start in
-# parallel right after the push; only `provider-e2e` waits on `changes` for its
+# All five validation jobs start in parallel right after the push; only the E2E
+# jobs wait on `changes` for their
 # path gate. No validation waits on E2E any more -- a lint/unit/build error now
 # surfaces in <1-2 min instead of after the real-provider matrix. The single
 # `required-checks` job is the only status branch protection needs to watch.
@@ -78,6 +78,43 @@ jobs:
 
   # ── Fast checks (parallel, no E2E dependency) ──────────────────────────────
 
+  # Gitea is secretless and disposable, so it runs on a fresh GitHub-hosted
+  # VM. This is the only E2E job allowed to execute fork PR code; untrusted
+  # code must never reach the privileged self-hosted fleet below.
+  gitea-e2e:
+    name: CI / Provider E2E / gitea
+    needs: changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 20
+    if: >-
+      (needs.changes.outputs.e2e-relevant == 'true' ||
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'schedule' ||
+      github.ref == 'refs/heads/main') &&
+      (github.event_name != 'workflow_dispatch' ||
+      github.event.inputs.provider == 'all' ||
+      github.event.inputs.provider == 'gitea')
+    concurrency:
+      group: e2e-${{ (github.event_name == 'push' || github.event_name == 'pull_request') && (github.head_ref || github.ref_name) || format('{0}-{1}', github.event_name, github.run_id) }}-gitea
+      cancel-in-progress: true
+    env:
+      E2E_KEEP_BRANCH: ${{ github.event.inputs.keep_branch }}
+      E2E_PR_NUMBER: ${{ github.event.pull_request.number }}
+      E2E_SOURCE_BRANCH: ${{ github.head_ref || github.ref_name }}
+    steps:
+      - name: Compute run-scoped workdir
+        run: echo "E2E_WORKDIR=$RUNNER_TEMP/git-files-sync-e2e/${{ github.run_id }}/${{ github.run_attempt }}/gitea" >> "$GITHUB_ENV"
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: Run disposable Gitea E2E
+        run: scripts/run-e2e.sh --provider gitea
+
   lint:
     name: CI / Lint
     runs-on: ubuntu-latest
@@ -151,7 +188,8 @@ jobs:
 
   # ── Integration check: real-provider E2E ────────────────────────────────────
 
-  # Real-provider E2E: one matrix job covering GitHub, GitLab, and Gitea (see
+  # Credentialed provider E2E: GitHub and GitLab remain on the self-hosted
+  # fleet. Fork PRs are rejected at job level before one can claim a runner.
   # docs/testing/real-provider-e2e.md). It starts as soon as `changes` resolves
   # (no preflight/E2E-gate dependency any more), then provider legs run in
   # parallel. `fail-fast: false` so one provider failure doesn't cancel the
@@ -170,15 +208,21 @@ jobs:
     # `if:` can see it. That part is done by the "Determine whether this
     # provider leg should run" step below instead, gating every later step.
     if: >-
-      needs.changes.outputs.e2e-relevant == 'true' ||
+      (needs.changes.outputs.e2e-relevant == 'true' ||
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'schedule' ||
-      github.ref == 'refs/heads/main'
+      github.ref == 'refs/heads/main') &&
+      (github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository) &&
+      (github.event_name != 'workflow_dispatch' ||
+      github.event.inputs.provider == 'all' ||
+      github.event.inputs.provider == 'github' ||
+      github.event.inputs.provider == 'gitlab')
     strategy:
       fail-fast: false
-      max-parallel: 3
+      max-parallel: 2
       matrix:
-        provider: [github, gitlab, gitea]
+        provider: [github, gitlab]
     # One group per source branch/provider -- keyed by branch name alone
     # (github.head_ref || github.ref_name, same expression E2E_SOURCE_BRANCH
     # below uses), deliberately NOT split by event type. A `push` to a branch
@@ -197,7 +241,7 @@ jobs:
     # support the `matrix` context (unlike job-level `if:`, see the comment
     # below), so each matrix leg still gets its own group.
     concurrency:
-      group: e2e-${{ github.head_ref || github.ref_name }}-${{ matrix.provider }}
+      group: e2e-${{ (github.event_name == 'push' || github.event_name == 'pull_request') && (github.head_ref || github.ref_name) || format('{0}-{1}', github.event_name, github.run_id) }}-${{ matrix.provider }}
       cancel-in-progress: true
     env:
       E2E_GITHUB_OWNER: ${{ vars.E2E_GITHUB_OWNER }}
@@ -242,33 +286,6 @@ jobs:
         id: gate
         run: |
           run=true
-          # TODO(e2e): gitea temporarily disabled in CI -- container
-          # provisioning against this runner fleet's Docker topology needs
-          # more investigation (bridge-IP reachability, health-check timing)
-          # than is safe to iterate on inside the shared matrix. Suite/harness
-          # code is untouched and passes locally (`npm run test:e2e --
-          # --provider gitea`); re-enable by deleting this block once the CI
-          # runner behavior is confirmed. NOTE: gitea is also what normally
-          # covers fork PRs (no secrets needed) -- while this is disabled,
-          # fork PRs get no E2E coverage at all.
-          if [ "${{ matrix.provider }}" = "gitea" ]; then
-            run=false
-            # Make the disabled state explicit in the run log + summary so a
-            # green "CI / Provider E2E / gitea" job is never mistaken for
-            # "Gitea E2E passed".
-            echo "::notice::Gitea E2E is disabled in CI (runner Docker networking — see TODO below). Suite/harness code passes locally; re-enable by removing this block."
-            {
-              echo "### Gitea E2E: disabled"
-              echo "Reason: runner Docker networking — container provisioning against this runner fleet needs investigation (bridge-IP reachability, health-check timing)."
-              echo "Suite/harness code is untouched and passes locally (\`npm run test:e2e -- --provider gitea\`). The Gitea infrastructure fix is tracked separately; do not infer three-provider coverage from a green gitea leg."
-              echo "Re-enable by removing the gitea block in the \"Determine whether this provider leg should run\" step."
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
-          if [ "${{ github.event_name }}" = "pull_request" ] \
-            && [ "${{ matrix.provider }}" != "gitea" ] \
-            && [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
-            run=false
-          fi
           if [ "${{ github.event_name }}" = "workflow_dispatch" ] \
             && [ "${{ github.event.inputs.provider }}" != "all" ] \
             && [ "${{ github.event.inputs.provider }}" != "${{ matrix.provider }}" ]; then
@@ -346,14 +363,14 @@ jobs:
   # cancelled duplicate's gate is correct, not a wedged red.
   required-checks:
     name: CI / Required Checks
-    needs: [lint, unit-test, build, provider-e2e]
+    needs: [lint, unit-test, build, gitea-e2e, provider-e2e]
     if: always()
     runs-on: ubuntu-latest
     steps:
       - name: Aggregate validation results
         run: |
           fail=0
-          for r in "${{ needs.lint.result }}" "${{ needs.unit-test.result }}" "${{ needs.build.result }}" "${{ needs.provider-e2e.result }}"; do
+          for r in "${{ needs.lint.result }}" "${{ needs.unit-test.result }}" "${{ needs.build.result }}" "${{ needs.gitea-e2e.result }}" "${{ needs.provider-e2e.result }}"; do
             echo "result: $r"
             case "$r" in
               success|skipped) ;;
@@ -440,4 +457,4 @@ jobs:
           subject-path: styles.css
       - env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
-        run: npx semantic-release
\ No newline at end of file
+        run: npx semantic-release
diff --git a/docs/testing/real-provider-e2e.md b/docs/testing/real-provider-e2e.md
index fa78b76..9fefc99 100644
--- a/docs/testing/real-provider-e2e.md
+++ b/docs/testing/real-provider-e2e.md
@@ -56,8 +56,9 @@ uses those APIs at all:
   `e2e-branch-cleanup.yml`, never by the normal per-run job.
 - `scripts/e2e-janitor.sh` — layer 3: TTL-based sweep of any leftover `e2e/**` branch, run by
   `.github/workflows/e2e-janitor.yml` on a schedule.
-- `scripts/run-e2e.sh` — thin local-dev wrapper: provision → seed → vitest → cleanup (CI drives
-  the same four steps directly as separate job steps instead).
+- `scripts/run-e2e.sh` — the shared local/CI entry point: provision → seed → vitest → cleanup.
+  It allocates a unique temporary workdir when the caller does not supply one, so concurrent local
+  runs cannot overwrite each other's repository, runtime adapters, or credentials.
 - `e2e/config/env.ts` — reads the env vars `provision` resolved and constructs the real,
   already-configured `GitServiceInterface` per provider (`githubContext`/`gitlabContext`/
   `giteaContext`).
@@ -110,17 +111,12 @@ killed run's branch is simply never touched by the next one.
 
 ### Concurrency and cancellation
 
-`.github/workflows/ci.yml`'s `provider-e2e` job carries a per-source-branch/per-provider
-concurrency group (`e2e-<branch>-<provider>`, using `github.head_ref || github.ref_name` — the
-same expression as `E2E_SOURCE_BRANCH`) with `cancel-in-progress: true`, so a superseding
-push/rerun cancels its own predecessor instead of the two competing for runner/provider capacity.
-The group is keyed by branch name alone, deliberately *not* split by trigger event: a `push` to a
-branch with an open PR fires both a `push` and a `pull_request` run for the same commit, and an
-earlier version of this group keyed PR runs by number instead of branch name, putting those two
-runs in different groups — so they ran fully concurrently against the same shared provider
-sandbox and starved each other (observed as real GitLab API timeouts under that double load).
-Keying by branch name alone means the later of the two cancels the earlier instead. The two
-cleanup workflows below share this same group naming for the same branch, with
+`.github/workflows/ci.yml`'s E2E jobs carry per-source/per-provider concurrency groups with
+`cancel-in-progress: true`. Push and pull-request runs use the same branch identity, so a push to a
+branch with an open PR cancels its duplicate instead of both competing for runner/provider
+capacity. Manual dispatches and schedules use `<event>-<run-id>` instead: they must not cancel a
+normal PR's required checks or a push's provider run. The two cleanup workflows share the
+branch-based group naming used by push/PR runs, with
 `cancel-in-progress: false`, so cleanup queues behind rather than races an active run.
 The cancelled duplicate's `CI / Required Checks` treats the cancelled leg as a failure, but that
 run is for the superseded commit — the surviving run (the one GitHub uses for the latest commit)
@@ -171,7 +167,7 @@ flowchart TD
 The design goal is **not** "the sandbox repos are always perfectly clean" — it's that old garbage,
 however it got there, can never contaminate a current run's state.
 
-### Self-hosted runner workspace isolation
+### Workspace isolation
 
 `provider-e2e` runs on a persistent self-hosted fleet, so `E2E_WORKDIR` is pinned per
 run/attempt/provider rather than relying on a fresh filesystem or a shared `/tmp` path:
@@ -180,11 +176,11 @@ run/attempt/provider rather than relying on a fresh filesystem or a shared `/tmp
 $RUNNER_TEMP/git-files-sync-e2e/<run-id>/<run-attempt>/<provider>/
 ```
 
-set once at job level in `ci.yml` (`env.E2E_WORKDIR`) so every step in the job shares it, and a
+set once near the start of each E2E job so every later process shares it, and a
 previous killed job's leftover files under a different run-id/attempt can never leak into the
-current one. Locally, `scripts/e2e-harness.sh` falls back to a provider-namespaced (not random)
-tmp dir so sequential `npm run test:e2e` invocations in the same shell session still share state
-across its own provision/seed/vitest/cleanup steps.
+current one. Locally, `scripts/run-e2e.sh` uses `mktemp` to allocate a unique workdir per invocation
+and removes it after cleanup. `E2E_KEEP_BRANCH=1` deliberately preserves both the container/branch
+and workdir for debugging.
 
 ## Running locally
 
@@ -205,9 +201,11 @@ npm run test:e2e -- --provider gitlab   # needs E2E_GITLAB_* below
 | `E2E_GITLAB_BASE_URL` | gitlab (optional) | defaults to `https://gitlab.com` |
 | `E2E_GITEA_IMAGE` | gitea (optional) | defaults to `gitea/gitea:1.22` |
 | `E2E_KEEP_BRANCH` | any (optional) | `1`/`true` skips teardown (branch for GitHub/GitLab, container for Gitea) so you can inspect a failing run |
-| `E2E_WORKDIR` | any (optional) | shared scratch dir across provision/seed/vitest/cleanup; defaults to a provider-namespaced tmp dir |
+| `E2E_WORKDIR` | any (optional) | shared scratch dir across provision/seed/vitest/cleanup; the wrapper defaults to a unique temporary directory |
 
-Gitea needs Docker locally and nothing else.
+Gitea needs Docker locally and nothing else. Its disposable container publishes port 3000 on a
+Docker-assigned `127.0.0.1` port, so it never depends on the host's bridge subnet and parallel runs
+do not contend for a fixed port.
 
 ### Git authentication
 
@@ -222,7 +220,7 @@ source of truth after its container is created, so it's the one credential persi
 
 ## CI
 
-`.github/workflows/ci.yml` runs four validation jobs **in parallel** right after a push/PR, with no
+`.github/workflows/ci.yml` runs five validation jobs **in parallel** right after a push/PR, with no
 validation waiting on E2E:
 
 - `CI / Lint` — `eslint .`
@@ -230,18 +228,20 @@ validation waiting on E2E:
 - `CI / Build` — `tsc -noEmit` + Obsidian 1.11.0 compat typecheck + esbuild; uploads
   `main.js`/`manifest.json`/`styles.css` as an artifact for ad-hoc PR install (non-main branches
   only)
-- `CI / Provider E2E / <provider>` — the real-provider matrix below
-
-`CI / Provider E2E / <provider>` is the matrix job (`github`, `gitlab`, `gitea`): provision, seed,
-the real vitest run, independent verify, cleanup (`if: always()` so cleanup runs even if an
-earlier step failed). Only this job depends on the `changes` job's path gate (`src/services/**`,
+- `CI / Provider E2E / gitea` — disposable Gitea on `ubuntu-latest`
+- `CI / Provider E2E / <provider>` — the credentialed GitHub/GitLab matrix below
+
+The E2E jobs are separated by trust boundary. Gitea runs on a fresh GitHub-hosted VM with only
+`contents: read`; it is safe for fork PRs because it receives no repository secrets and cannot
+access the persistent runner fleet. The credentialed `github`/`gitlab` matrix remains self-hosted,
+and its job-level condition rejects fork PRs before runner allocation. Both depend on the
+`changes` job's path gate (`src/services/**`,
 `src/logic/sync-manager.ts`, `e2e/**`, `scripts/e2e-harness.sh`, `scripts/e2e-namespace.sh`, etc. —
 computed by the `CI / Detect Changes` job, since GitHub Actions' own `on.*.paths` would gate the
 *entire* workflow file, including the always-must-run validation/release jobs). It always runs in
 full on `workflow_dispatch`, `schedule` (weekly, Monday 06:00 UTC, for API-drift detection), and
-pushes to `main`. The job carries a per-source/provider `concurrency` group (see "Isolation model"
-above) and sets `E2E_WORKDIR`/`E2E_PR_NUMBER`/`E2E_SOURCE_BRANCH` once at job level, shared by every
-step.
+pushes to `main`. Each job carries a per-source/provider `concurrency` group (see "Isolation model"
+above) and a run/attempt/provider-scoped workdir.
 
 Two more workflows round out the isolation model's other cleanup layers — see "Isolation model"
 above for what each does and why:
@@ -260,11 +260,8 @@ above for what each does and why:
 | `E2E_GITLAB_PROJECT_ID` | secret (not a variable — it's treated as sensitive here) |
 | `E2E_GITLAB_TOKEN` | secret |
 
-**Fork PRs** only run the Gitea cell (checked in the `Determine whether this provider leg should
-run` step — GitHub Actions job-level `if:` can't reference the `matrix` context, so this can't
-live on the job itself; it gates every later step instead) — GitHub/GitLab need real credentials
-that must never be exposed to an untrusted fork's workflow run. Gitea needs no repo secrets at
-all, so it's safe to run unconditionally.
+**Fork PRs** only run the Gitea job on `ubuntu-latest`. The credentialed GitHub/GitLab job is
+rejected at job level, so untrusted code is never scheduled on the self-hosted runner fleet.
 
 **Missing credentials are always a hard failure**, never a silent skip, for any cell that
 actually runs (`scripts/e2e-harness.sh`'s `normalize_env`/`: "${VAR:?...}"` checks required env
@@ -274,13 +271,14 @@ given event; once it runs, it's expected to have what it needs.
 ## Release gating
 
 ```
-changes ──► provider-e2e [github | gitlab | gitea, parallel] ──┐
+changes ──► gitea-e2e [GitHub-hosted] ────────────────────────┐
+        └─► provider-e2e [github | gitlab, self-hosted] ──────┤
 lint ─────────────────────────────────────────────────────────┤
 unit-test (Node 22|24) ───────────────────────────────────────┤──► required-checks ──► package
 build ────────────────────────────────────────────────────────┘                  └──► publish (main only)
 ```
 
-All four validation jobs start in parallel; a lint/unit/build error now surfaces in <1-2 min
+All five validation jobs start in parallel; a lint/unit/build error now surfaces in <1-2 min
 instead of after the real-provider matrix. `CI / Required Checks` runs with `if: always()` and
 passes only when every validation job reports `success` or `skipped` (a path-filtered-out or
 fork-gated-off `provider-e2e` leg reports `success` because its steps are skipped, not failed).
@@ -293,10 +291,9 @@ only releases on those branches — see `.releaserc.json`).
 
 **Branch protection** (not something this repo checkout can change — a GitHub repo-settings
 change, left for whoever has admin access): add `CI / Required Checks` as the single required
-status check. GitHub/GitLab (`CI / Provider E2E / github`, `CI / Provider E2E / gitlab`) are
-deliberately **not** required at the branch-protection level, and Gitea is currently disabled in
-CI (see the "Determine whether this provider leg should run" step), so a fork PR (which runs no
-real-provider leg) is never wedged by checks it structurally cannot produce.
+status check. It aggregates Gitea, credentialed providers, lint, tests, and build while still
+allowing structurally skipped jobs. Requiring only the aggregate avoids wedging a fork PR on
+GitHub/GitLab checks it cannot produce.
 
 ## Cleanup / troubleshooting
 
@@ -311,23 +308,18 @@ real-provider leg) is never wedged by checks it structurally cannot produce.
 - **Inspecting a failing run**: set `E2E_KEEP_BRANCH=1` before running so teardown is skipped,
   then look at the branch/container directly. Remember to clean it up yourself afterward (see
   above) — or just let the janitor catch it within its TTL.
-- **Gitea container port/name clashes**: each run's container is named `gfs-e2e-gitea-$$` (PID)
-  and binds to a Docker-assigned host port, so concurrent local runs don't collide; a leftover
-  container from an interrupted run can be removed manually (`docker rm -f <name>`).
+- **Gitea container port/name clashes**: each name includes run ID, attempt, and PID, while Docker
+  assigns its loopback host port. Concurrent runs also use separate `mktemp` workdirs. A container
+  left by a hard-killed local process can be removed manually (`docker rm -f <name>`).
 - **`E2E_PROVIDER is not set` error**: `vitest.e2e.config.ts` refuses to run directly under
   `npx vitest` — always go through `npm run test:e2e -- --provider <name>` (or the CI steps),
   which set it.
 
 ## Known gaps
 
-- SyncManager E2E against GitHub/GitLab uses the same harness as Gitea (no provider-specific
-  code) but has only been exercised end-to-end locally against Gitea (Docker, no external
-  credentials available in this environment) — not yet actually executed against live
-  GitHub/GitLab sandboxes from this checkout.
-- The `provider-e2e` matrix job targets `runs-on: [self-hosted, linux, x64, 32gb-ram]`; its
-  actual execution on that fleet, and the parallel-validation DAG → `required-checks` →
-  `publish` chain end-to-end in a real workflow run, are unverified from this checkout (no
-  self-hosted runner access here).
+- A real external fork PR has not yet exercised the fork event context end to end. Workflow
+  contracts enforce the trust split, and targeted run 33048613679 proved the equivalent
+  `Gitea success + credentialed providers skipped` path through downstream validation.
 - Branch-protection required-check configuration (`CI / Required Checks`) is a manual follow-up
   for whoever has admin access to the repo.
 - The official Obsidian community-plugin scanner rescan (as opposed to this repo's own
diff --git a/feature_list.json b/feature_list.json
index 74d6b91..51e8783 100644
--- a/feature_list.json
+++ b/feature_list.json
@@ -1,14 +1,14 @@
 {
   "_note": "GitHub Issues (firstsun-dev/git-files-sync, Project #6) is the source of truth for the full backlog and priority/estimate fields. This file mirrors only the active feature and the next few candidates so an agent session has a local, offline checkpoint — sync it against `gh issue list --repo firstsun-dev/git-files-sync --state open` at the start of a session rather than treating it as authoritative.",
-  "_lastSync": "2026-08-19: Synced against open GitHub issues; issue #105 is the active architecture refactor.",
+  "_lastSync": "2026-08-27: Synced against open GitHub issues; issue #139 is active on PR #140.",
   "features": [
     {
-      "id": "feat-026",
-      "name": "refactor(sync): separate planning, execution, conflicts, metadata, and UI (issue #105)",
-      "description": "Preserve sync behavior while extracting SyncStatusView presentation state/controller boundaries and SyncManager scanner/planner/executor/workspace boundaries with regression and integration coverage.",
+      "id": "feat-027",
+      "name": "test(e2e): run disposable Gitea safely in local and CI environments (issue #139)",
+      "description": "Keep local Gitea runs parallel-safe, move the secretless Gitea PR gate to GitHub-hosted runners, and prevent fork code from reaching credentialed self-hosted runners.",
       "dependencies": [],
       "status": "in-progress",
-      "evidence": "Commits dff95db/948df28 on refactor/sync-domain-pipeline: unified sync decisions and CI hardening are covered; 613 tests, local Gitea E2E, and real CI run 32338116598 are green; desktop/mobile smoke pending."
+      "evidence": "Commits 920adee/18de6e0/b5884fc on PR #140: local serial/parallel Gitea and targeted real CI run 33048613679 are green; awaiting review/merge."
     },
     {
       "id": "feat-004",
diff --git a/progress.md b/progress.md
index 46680d4..88e7440 100644
--- a/progress.md
+++ b/progress.md
@@ -4,140 +4,22 @@ Completed work is archived in [archive/](./archive/), one file per calendar mont
 
 ## Current State
 
-**Last Updated:** 2026-08-23
-**Active Feature:** `feat/sync-status-auto-refresh` (uncommitted, stacked on `feat/sync-status-workflow-ui`): auto-refresh the Source Control view on local vault create/modify/delete without a manual refresh, and distinguish a user-deleted tracked file from a never-tracked remote-only download candidate. Domain + view work. (1) New `local-deleted` `SyncStatus`/`SyncChangeKind`: a previously-tracked file removed locally classifies `local-deleted` (badge `D`, "Deleted locally", red border) instead of collapsing into `remote-only` — `SyncStatusFacts.wasTracked` drives `SyncStatusService.classify`; `FileStatusAdapter`/`SourceControlFilter`/`SourceControlSummary`/`ChangePresentation` (badge `D` + tooltip + `changeOperation: download`) updated; `identifyExtraFiles` + `orphanedMoveSourcesBySha` treat `local-deleted` like `remote-only` for move reconciliation. (2) New `RefreshReason` type threaded through `RefreshState.start(reason)` → `SourceControlViewModel.refresh(reason)` (default `'manual'`; startup uses `'startup'`); `RefreshState` now records `reason` + `lastCheckedAt`. (3) New immediate optimistic handlers `handleFileCreated` (→`unsynced`) and `handleFileDeleted` (synced/modified→`local-deleted`, unsynced/moved→drop), wired to `app.vault.on('create'/'delete')` in `main.ts` alongside the existing `modify`/`rename` handlers — all update the shared `SyncStatusService` which republishes → `ChangeRepository` → ViewModel → UI (no direct filesystem→UI path; no `syncMetadata` cleared on delete so out-of-band move reconciliation still works). (4) "Last checked: just now / <time>" line in the header info strip, fed by `refreshState.getLastCheckedAt()` via `SourceControlWorkspaceInfo.lastCheckedAt`. (5) i18n keys `deletedLocally`(+tooltip), `info.lastChecked`/`info.justChecked` across en/zh-cn/zh-tw. Tests: `SyncStatusRefreshService.test.ts` (new, +13: handleFileCreated/handleFileDeleted/identifyExtraFiles local-deleted), `RefreshState.test.ts` (+reason/lastCheckedAt), `sync-status-service.test.ts` (+local-deleted classification), `FileStatusAdapter`/`SourceControlFilter`/`SourceControlSummary`/`ChangePresentation` (+local-deleted), `SourceControlViewModel` (+refresh reason threading), `SourceControlView` (+header "Last checked" line), `SourceControlItemView` (mock `refreshState`). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 63 files / 699 tests pass. Manual Obsidian verification (create/modify/delete auto-refresh, `D` badge + tooltip, "Last checked" line) remains.
-**Parallel Work:** PR #87 (4x Dependabot security alerts via npm overrides) and Issue #57 (live-credential smoke test).
+**Last Updated:** 2026-08-27
+**Active Feature:** feat-027 / issue #139 — disposable Gitea local/CI portability and runner trust separation.
+**Branch / PR:** `codex/test-gitea-e2e-ci` / PR #140, based on `claude/source-control-foundation`.
 
 ## Outstanding Items
 
-1. **feat/sync-status-auto-refresh verification** — code complete (domain + view): `local-deleted` `SyncStatus`/`SyncChangeKind` (tracked file removed locally, distinct from `remote-only`), `RefreshReason` threaded through `RefreshState`→`ViewModel.refresh`, `handleFileCreated`/`handleFileDeleted` wired to `app.vault.on('create'/'delete')`, "Last checked" header line. `npx eslint .` — 0 errors; `npm run build` — clean (tsc + Obsidian 1.11.0 compat + esbuild); `npx vitest run` — 63 files / 699 tests pass. Remaining: manual Obsidian verification (create/modify/delete auto-refresh the panel without a manual refresh, `D` badge + "Deleted locally" tooltip, "Last checked" line). Not yet committed (stacked on `feat/sync-status-workflow-ui`).
-2. **feat/sync-status-remote-actions verification** — code complete (view-layer only): `remote-only` badge `↓` + `remote-modified` `↕`, inline Download button → `actionService.pull`, Sync Queue Upload/Download grouping, Sync button per-kind routing via `changeOperation` + new `onPull`/`onDownload` callbacks. `npx eslint .` — 0 errors; `npm run build` — clean; `npx vitest run` — 668 tests pass. Remaining: `npm run test:e2e -- --provider gitea` (new download E2E in `source-control-flows.e2e.test.ts`), manual Obsidian verification of the ↓/↕ badges + Download button + mixed-queue labels. Not yet committed (stacked on `feat/sync-status-workflow-ui`).
-3a. **Re-enable the gitea leg in CI** (`.github/workflows/ci.yml`, "Determine whether this provider leg should run" step) — disabled 2026-08-13 after two rounds of real-CI-only failures (host-port/127.0.0.1 unreachable from this self-hosted fleet's sibling-container topology, then a curl hang) got fixed but a third run wasn't attempted before the user asked to pause it; harness code (`scripts/e2e-harness.sh`'s gitea path, `e2e/suites/gitea.e2e.test.ts`) is unchanged and passes locally every time (`npm run test:e2e -- --provider gitea`, most recently re-confirmed 14/14 twice this session). While disabled, fork PRs get zero E2E coverage (gitea is normally the only leg that needs no secrets). PR #124 is already open and green with this leg gated off; re-enabling is a follow-up, not a blocker.
-3b. **Update GitHub branch protection to require `CI / Required Checks`** (manual, needs repo admin) — the parallel-validation DAG refactor added a single `CI / Required Checks` aggregate gate as the only status branch protection should require. The old per-job required checks (`E2E / gitea`, etc.) should be replaced. Not doable from this checkout.
-3c. **CI DAG parallel refactor unverified against real CI** — `.github/workflows/ci.yml` was restructured (lint/unit-test/build/provider-e2e now start in parallel; `preflight`, `e2e-gate`, the shared reusable `CI` call, and standalone `build-artifact` were removed; `required-checks` gate added; `package`/`publish` run only after the gate). Verified locally only: `actionlint v1.7.7` 0 errors (only the known `32gb-ram` self-hosted-label false positive), YAML parse OK. Needs a real PR run + 3-5 PR-execution-time comparisons per the rollout plan before removing old assumptions; branch protection switch (3b) is the final step.
-4. **feat-025 manual verification** — Tree view code is complete and all automated checks pass; manual Obsidian verification in a real vault remains for user to confirm functionality (tree hierarchy, folder expand/collapse, checkboxes, Show synced toggle).
-5. **PR #87** — Dependabot security patches via npm overrides; awaiting review/merge.
-6. **Issue #57** — Live-credential smoke test; pre-existing, relevant before pushing major sync work.
-7. **sync-status-workflow-ui manual verification** — 8 commits landed, automated checks pass (eslint/build/vitest green; 632/633, the 1 failure is the unrelated pre-existing `ci-workflow.test.ts` vs an uncommitted `ci.yml`); manual Obsidian desktop + mobile verification of the runtime UI (refresh button states, `SYNC QUEUE` section, 5-chip filter incl. `Needs Sync` default and `Synced`, badge tooltips `Modified locally`/`Added locally`, diff-stat spans, mobile `N files selected`+`Sync` bar) remains before opening a PR.
+1. Push the conflict-resolution merge and confirm PR #140 is mergeable with green required checks.
+2. Configure `CI / Required Checks` as the single required branch-protection check when repository settings are next updated.
+3. Optionally validate the fork-only event path with a controlled external fork PR.
 
-## Latest Evidence
+## Verification Evidence
 
-- [ ] feat/sync-status-auto-refresh (2026-08-23), branch `feat/sync-status-workflow-ui` (uncommitted, stacked): auto-refresh the Source Control panel on local vault create/modify/delete and distinguish a user-deleted tracked file from a never-tracked remote-only download candidate. Domain + view work (this one legitimately touches `src/logic/**`). (1) New `local-deleted` `SyncStatus`/`SyncChangeKind`: `SyncStatusFacts.wasTracked` flag drives `SyncStatusService.classify` → a previously-tracked file removed locally is `local-deleted` (badge `D`, subtitle "Deleted locally", red border, `changeOperation: download`) instead of merging into `remote-only`; `FileStatusAdapter`/`SourceControlFilter`/`SourceControlSummary`/`ChangePresentation` updated; `identifyExtraFiles` (`wasTrackedBeforeDelete` helper, extracted to keep cognitive complexity ≤15) + `orphanedMoveSourcesBySha` treat `local-deleted` like `remote-only` for move reconciliation. (2) New `RefreshReason` type (`startup`/`manual`/`local-change`/`remote-change`/`sync-complete`) threaded through `RefreshState.start(reason)` → `SourceControlViewModel.refresh(reason)` (default `'manual'`; `refreshSyncStatusOnStartup` now goes through the ViewModel with `'startup'` so `RefreshState` is populated); `RefreshState` records `reason` + `lastCheckedAt` (epoch-ms on `succeed`). (3) New immediate optimistic handlers — `handleFileCreated` (→`unsynced`) and `handleFileDeleted` (synced/modified→`local-deleted`, unsynced/moved→drop, remote-only/local-deleted/checking→no-op) — wired to `app.vault.on('create'/'delete')` in `main.ts` alongside the existing `modify`/`rename` handlers; all update the shared `SyncStatusService` which republishes → `ChangeRepository` → ViewModel → UI (no direct filesystem→UI path; deliberately no `syncMetadata` cleared on delete so out-of-band move reconciliation keeps working, #66). (4) "Last checked: just now" (<60s) / "Last checked: <time>" line in the header info strip, fed by `refreshState.getLastCheckedAt()` via `SourceControlWorkspaceInfo.lastCheckedAt`; hidden before the first refresh. (5) i18n keys `deletedLocally`(+tooltip), `info.lastChecked`/`info.justChecked` across en/zh-cn/zh-tw. Tests: `SyncStatusRefreshService.test.ts` (new, +13: handleFileCreated/handleFileDeleted/identifyExtraFiles local-deleted classification incl. pending-rename stays remote-only), `RefreshState.test.ts` (+reason/lastCheckedAt), `sync-status-service.test.ts` (+local-deleted classification), `FileStatusAdapter`/`SourceControlFilter`/`SourceControlSummary`/`ChangePresentation` (+local-deleted), `SourceControlViewModel` (+refresh reason threading + lastCheckedAt), `SourceControlView` (+3 header "Last checked" line tests), `SourceControlItemView` (mock `refreshState`). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 63 files / 699 tests pass. Remaining: manual Obsidian verification (create/modify/delete auto-refresh, `D` badge + tooltip, "Last checked" line). Note: a debounced full remote-refresh on local-change bursts was deliberately NOT added — the immediate optimistic handlers deliver the auto-update goal with no remote round-trip per save; a debounced `RefreshReason='local-change'` full refresh would fetch the remote tree on every save burst (perf-sensitive) and is left for a separate decision.
+- Commits `920adee`, `18de6e0`, `b5884fc`: Gitea uses a Docker-assigned loopback port and each local invocation owns a `mktemp` workdir; Gitea CI runs on `ubuntu-latest` with `contents: read`; GitHub/GitLab stay on self-hosted runners with fork rejection at job level; manual/scheduled concurrency cannot cancel normal push/PR checks.
+- Pre-merge local verification: `npx eslint .` — 0 errors; `npm run build` — pass including Obsidian 1.11 compatibility; `npx vitest run` — 56 files / 554 tests; shell syntax/ShellCheck/actionlint/diff checks — pass; Gitea E2E — 3 files / 27 passed, 17 skipped, including concurrent-run isolation.
+- Pre-merge real CI: targeted Gitea run 33048613679 passed through Gitea and downstream validation. Concurrent push run 33048499785 retained a successful Gitea check, proving concurrency isolation. SonarCloud passed on PR #140.
+- Conflict resolution integrates base commit `257b2a4` and its parallel lint/unit/build/release DAG with the separate hosted Gitea job and self-hosted GitHub/GitLab matrix.
+- Post-merge local verification: `./init.sh` — lint 0 errors, build/Obsidian 1.11 compatibility pass, 64 files / 723 tests pass; Gitea E2E — 3 files / 30 passed / 18 skipped; workflow contract tests — 8 passed; bash syntax, ShellCheck, actionlint, and `git diff --check` pass.
 
-- [ ] feat/sync-status-remote-actions (2026-08-23), branch `feat/sync-status-workflow-ui` (uncommitted, stacked on the 8 commits): fixed the misleading `D` (deleted) badge on `remote-only` — now `↓` with subtitle "Remote available" + tooltip "download to add it"; `remote-modified` `M`→`↕`. Added an inline Download button on `remote-only` rows (stops propagation, calls `actionService.pull([id])`) so a remote-only file pulls without first entering the Sync Queue. Added `changeOperation(kind)` classifier (`upload`/`download`) and routed the Sync button + mobile sync bar through `runSync(queue)`: upload kinds → `onPush`, download kinds → new `onPull` callback. Sync Queue now splits into Upload/Download sub-groups with `scv-queue-group-label` headers, shown only when the queue is mixed (single-operation queues stay flat — preserves existing tests). New optional `onPull`/`onDownload` on `SourceControlViewCallbacks`, wired in `SourceControlItemView` to `actionService.pull`. i18n keys added/removed across en/zh-cn/zh-tw. View-layer only — no `src/logic/**` changes. Tests updated: `ChangePresentation.test.ts` (badges + `changeOperation` matrix), `ChangeTree.test.ts` (↓ badge + download button presence/absence), `SourceControlView.test.ts` (+8 tests: mixed routing, download-only routing, mixed/single group labels, inline download → onPull, no download on local-only); new E2E in `source-control-flows.e2e.test.ts` (download a remote-only change via `actionService.pull`, metadata advances; isolation test). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 62 files / 668 tests pass. Remaining: gitea E2E run + manual Obsidian verification.
-
-- [x] refactor(source-control): slim SourceControlViewModel via SyncQueue rename, DiffStatProvider, SelectionController (issue #136, 2026-08-23), branch `feat/sync-status-workflow-ui`, uncommitted: the three clean-code must-fixes from the PR #135 review, domain-untouched (sync pipeline untouched). (1) **Rename `selectedItems`→`syncQueue`**: `SourceControlViewState.selectedItems`→`syncQueue` (aligns with the `SYNC QUEUE` UI label); updated ViewModel projection, View (`renderSelectedSection`/`eagerLoadSelectedStats`), and `SourceControlViewModel.test.ts`. (2) **Extract `DiffStatProvider`** (`src/ui/source-control/DiffStatProvider.ts`, +9 unit tests): pulled the +/- diff-stat cache (`Map<ChangeId, ChangeStat|null>`), `eagerLocal`/`eagerSelected`/`lazyLoad` policies, and `clear()` out of `SourceControlView.ts` into its own class; the View now holds a `DiffStatProvider` (constructed in its ctor with `callbacks.loadDiffStat` + a rerender `settle`) and owns no diff cache — three private view methods removed. Null results stay cached (no retry); `lazyLoad` only settles when a stat is produced. (3) **SelectionController (minimal-expose option)**: added `PushSelectionStore.selectMany`/`deselectMany` batch methods (no boolean selector param — satisfies `sonarjs/no-selector-parameter`); exposed the store via a new `viewModel.selection` getter (ctor param renamed `selection`→`selectionStore`); `SourceControlView` dropped its direct `PushSelectionStore` constructor arg and now routes all selection through `viewModel.selection` (`includeForPush`/`excludeFromPush`/`selectMany`/`deselectMany`/`getSelectedChangeIds`) — the view no longer reaches past the ViewModel, and `clearSelection`/`toggleFolderSelect` use the batch methods instead of inline loops. `SourceControlItemView` construction updated. Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 62 files / 654 tests pass. Issue #136 created on GitHub; board add pending (token lacks `project` scopes — `gh auth refresh -s read:project,write:project` needed). Manual Obsidian verification remains.
-
-- [x] sync-status-workflow-ui queue/repository separation + List view (2026-08-23), branch `feat/sync-status-workflow-ui`, uncommitted: separated the two regions by role label per UX review, view-layer only. (1) Renamed the upper action region `CHECKED CHANGES (N)`→`SYNC QUEUE` with a `N files selected` subtitle (replaced the count badge), i18n en/zh-cn/zh-tw; dropped the now-unused `sourceControl.section.{all,readyToPush,changes,remoteChanges,conflicts,synced}` keys + the `FILTER_HEADER_KEYS` map. (2) Renamed the lower region's header from the per-filter name (`ALL`/`NEEDS SYNC`) to a single role label `Repository Changes (N)` (the active filter is conveyed by the chips above); renamed `renderActiveFilterHeader`→`renderRepositoryHeader` and `scv-active-filter-*`→`scv-repository-*` CSS. (3) Added a Tree/List segmented view toggle scoped to Repository Changes only (the queue is always a flat list) — `viewMode` state + `renderViewToggle`/`setViewMode`, icons `folder-tree`/`list`, click stopPropagation so switching presentation doesn't collapse the region; mobile hides the labels. (4) New `renderChangeList` flat renderer in `ChangeTree.ts` (sorted by path) + `ChangeItem` `folderPath`/`listMode` options rendering a dimmed right-aligned `.scv-change-path` suffix so flat rows stay disambiguated; `eagerLoadLocalStats` runs in both modes. (5) Mobile: the Sync Queue starts collapsed to a header bar (`mobileQueueExpanded` flag) so it doesn't push the repository tree off-screen; tapping the header expands it; the bottom sync bar still carries the count. Domain-untouched invariant holds (no `src/logic/**` changes). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 61 files / 642 tests pass. Manual Obsidian desktop/mobile UI verification remains. Follow-up: architecture must-fixes from the PR #135 review (rename `selectedItems`→`syncQueue`, extract `DiffStatProvider`, extract `SelectionController`) deferred to a separate issue per one-feature-at-a-time — to be filed via firstsun-pm.
-
-- [x] CI parallel-validation DAG refactor (2026-08-23), branch `feat/sync-status-workflow-ui` (uncommitted working-tree change to `.github/workflows/ci.yml` + `docs/testing/real-provider-e2e.md`): restructured the CI DAG so all four validation jobs start in parallel after a push instead of lint/test/build waiting behind the real-provider E2E matrix. Removed `preflight` (duplicated the reusable workflow's lint/test/build), `e2e-gate`, the shared reusable `firstsun-dev/.github` `CI` workflow call (its internal release fired before any E2E gate, so it couldn't be made to release-after-gate without inlining), and the standalone `build-artifact` job (its raw-artifact upload is now folded into `CI / Build`, same job as the build, so upload state can't drift from build state — Phase 5). New layout: `CI / Detect Changes` → (`CI / Lint`, `CI / Unit Test (Node 22|24)`, `CI / Build`, `CI / Provider E2E / <provider>`) all parallel → `CI / Required Checks` (`if: always()`, passes only when every validation job is `success`/`skipped`; a cancelled E2E leg is treated as a failure since the surviving run owns the latest-commit gate) → `Release / Package` (zip artifact, all branches) and `Release / Publish` (semantic-release + build-provenance attestation, `main`/`master` only). `provider-e2e` is unchanged internally (gitea-disabled notice, per-source/provider concurrency group `e2e-<branch>-<provider>`, run-scoped `E2E_WORKDIR`, retry, `if: always()` cleanup) — only its `name` and `needs: [changes]` (dropped `preflight`) changed, so the cleanup workflows' shared concurrency-group naming still matches. All third-party actions pinned to full commit SHAs (checkout/setup-node/paths-filter/retry unchanged; `actions/upload-artifact@`→`043fb46…` v7, `actions/attest-build-provenance@`→`4d10147…` v4.2.2). Verification: `actionlint v1.7.7 .github/workflows/ci.yml` — 0 errors (only the known `32gb-ram` custom self-hosted-label false positive); `python3 -c yaml.safe_load(...)` — parses. Source tree (`eslint`/`build`/`vitest`) untouched by this change. Follow-ups: real PR run + 3-5 execution-time comparisons (rollout), and the manual branch-protection switch to `CI / Required Checks`.
-
-- [x] sync-status-workflow-ui UX convergence (2026-08-23), branch `feat/sync-status-workflow-ui`, commit (pending): converged the PR's mixed workflow concepts per review feedback, view-layer only. (1) Renamed `SELECTED FOR SYNC`→`SYNC QUEUE` (i18n en/zh-cn/zh-tw); the queue stays a compact read-only action preview (badge+name+diff-stat, no checkbox). (2) Filter chips redesigned to `All / Needs Sync / Remote / Conflict / Synced` via a UI chip model mapping `(domain filter, showSynced)` — `Needs Sync` (domain `all`, actionable) is the default; `All` composes actionable+synced by concatenating `getState('all',false)` + `getState('synced',true)` in the view (the domain `all` filter still returns actionable-only, so no domain change); `Synced` re-surfaces (domain `synced`, showSynced=true); `Local` dropped. (3) Badge tooltip wording `Added`→`Added locally`, `Modified`→`Modified locally`. (4) Mobile sync bar → `N files selected` + `Sync` button (was a single full-width `SELECTED FOR SYNC (N)` button). Domain-untouched invariant verified: `git diff claude/source-control-foundation -- src/logic/source-control/` shows only `RefreshState.ts` (new) + `SourceControlViewModel.ts` (edited). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 632/633 (1 unrelated pre-existing failure in `ci-workflow.test.ts` from an uncommitted `ci.yml`, not touched by this work).
-- [x] sync-status-workflow-ui plan (2026-08-22), branch `feat/sync-status-workflow-ui`, 4 commits (`8c69cc8` → `dd8ddd5`) ahead of `claude/source-control-foundation` @ `f449125`: (1) ViewModel `selectedItems`/`refreshStatus` projections + `refresh()` delegate backed by new `RefreshState` (idle/loading/failed); (2) filter chips drop `ready-to-push` (4 chips: All/Local/Remote/Conflict) + "SELECTED FOR SYNC (N)" section; (3) refresh button (idle/loading/failed) + `OperationIndicator` text labels + `runRefresh` render-on-start-and-settle; (4) new `ChangePresentation` UI adapter (`remote-only` badged `D`, subtitles, rename display), eager local-only diff-stat from in-memory `sync.status` + lazy two-sided stat on open + clear-on-refresh cache (null results cached to stop an eager-retry rerender loop), responsive mobile (filter dropdown, hidden header push button, sticky bottom sync bar, flatter tree). Domain-untouched invariant verified: `git diff claude/source-control-foundation -- src/logic/source-control/` shows only `RefreshState.ts` (new) + `SourceControlViewModel.ts` (edited). Verification: `npx eslint .` — 0 errors; `npm run build` — clean incl. Obsidian 1.11.0 compat; `npx vitest run` — 61 files / 629 tests; husky pre-commit hook green on every commit. Manual Obsidian desktop/mobile UI verification remains.
-
-- [x] Issue #105 post-push CI hardening (2026-08-20), commit `948df28`: diagnosed run 32336155736 as two exhausted transient-provider attempts rather than a planner regression (GitHub 503/socket close; GitLab deadline exceeded). Increased provider E2E attempts from 2 to 3. A duplicate matrix cancelled by the shared push/PR concurrency group now produces a neutral aggregate gate with `run-ci=false`, so it neither creates a misleading `E2E gate` failure nor starts duplicate downstream CI; real failures still block. SyncManager E2E push preconditions now include `success`, `failed`, and provider `errors` in assertion diagnostics instead of surfacing only a secondary count mismatch. Added workflow contract and diagnostic unit tests and updated the E2E documentation. Verification: `actionlint v1.7.12 .github/workflows/ci.yml` — 0 errors; `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 56 files / 613 tests; `npm run test:e2e -- --provider gitea` — 2 files / 14 tests and container cleanup; `git diff --check` — clean. Real CI run 32338116598 passed GitHub/GitLab production E2E, independent verification, cleanup, aggregate gate, Node 22/24 tests, lint, package, and build/release. The initial disabled-Gitea job landed on offline runner `heavenweb-runner-8`; failed-only rerun completed its skip in 11s and the full run concluded success. Provider API checks found no remaining `e2e/pr/127/**` or branch-source E2E refs. AGENTS-required Haiku was unavailable, so verification ran locally and through real CI.
-
-- [x] Issue #105 unified sync decisions and move regression (2026-08-20): added operation-aware `SyncPlanner.planFor(push|pull)`, `MoveFacts`, and the `move` domain action. Normal push, batch pull and preview, single pull, and tracked moves now consume planner decisions instead of reimplementing SHA conflict checks. Removed `PushCoordinator.queueMove`'s stale-metadata gate, so an edited tracked rename with a free destination appears under Moves and commits once; occupied destinations remain conflicts. Fixed the complementary pull false positive: a remote-only change now pulls, while real two-sided divergence still resolves as conflict. Content-fetched text/binary paths normalize equal bytes to the provider blob SHA before planning, preserving binary and GitLab legacy-baseline behavior. Added planner operation matrix, coordinator move regression, batch pull, and single pull coverage. Verification: `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 54 files / 610 tests; `git diff --check` — clean. Manual Obsidian verification remains.
-
-- [x] Issue #105 architecture implementation (2026-08-19): extracted `SyncStatusRenderer` and `SyncStatusComposition`; `SyncStatusView.ts` is 11.5 KB / 251 lines. Extracted `PullCoordinator` and `PushCoordinator`; `SyncManager.ts` is 13.7 KB / 298 lines and retains its public compatibility API. `SyncManagerWorkspace` now owns refresh/tree-snapshot reuse, push/pull, diff, local/remote deletion, move, metadata mutations, provider URLs and UI-safe workspace info; sync-status UI code no longer reaches provider/tree/settings/vault mutation helpers, and `src/logic/**` has no UI imports. Legacy refresh characterization cases now target the extracted service instead of private View delegates; legacy modal tests explicitly inject the Obsidian interaction adapter. Added real refresh integration plus focused push-coordinator/workspace regression tests. Independent verification: `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 54 files / 598 tests; `npm run test:e2e -- --provider gitea` — 2 files / 14 tests with container cleanup; `git diff --check` — clean. Desktop/mobile Obsidian smoke remains manual.
-
-- [x] Issue #105 architecture slice 3 (2026-08-19): added tested `SyncDiffService` and `SyncStatusNavigator`, so lazy blob loading/cache/content-kind projection is a domain `FileDiff` boundary. Extracted single-file, batch push/pull, local/remote delete, move revert, remote-tree reuse, progress/confirmation, and optimistic-status orchestration into `SyncStatusOperations`; all View row/group events now enter through `SyncStatusController`. The actual View is about 40 KB (down from 58 KB this slice and 80 KB initially). Independent verification: `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 52 files / 594 tests; `npm run test:e2e -- --provider gitea` — 2 files / 14 tests with container cleanup; `git diff --check` — clean. Feature remains in progress because renderer composition and the ~50 KB manager facade are still oversized.
-- [x] Issue #105 architecture slice 2 (2026-08-19): extracted `SyncStatusRefreshService` for local/remote discovery, hidden files, symlinks, SHA/content classification, out-of-band move reconciliation, and live modify/rename transitions. The actual View fell from about 80 KB to 58 KB while legacy characterization entrypoints remain thin delegates. Added `SyncInteractionPort` plus `ObsidianSyncInteraction`; `logic/sync/SyncManager.ts` no longer imports Modal or Notice classes. Independent verification: `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 51 files / 585 tests; `npm run test:e2e -- --provider gitea` — 2 files / 14 tests with container cleanup; `git diff --check` — clean. Feature remains in progress: action orchestration is still View-owned, the manager core is about 50 KB, and desktop/mobile manual smoke tests remain pending.
-- [x] Issue #105 architecture slice (2026-08-19): moved compatibility entrypoints to thin re-exports; added presentation state, pure selectors, path-only controller commands, pure planner matrix, scanner, metadata store, push/pull/remote-delete/conflict executors, `SyncManagerWorkspace`, `FileDiff`, and four workspace integration paths. `npx eslint .` — 0 errors; `npm run build` — clean including Obsidian 1.11 compatibility; `npx vitest run` — 51 files / 585 tests passed; `npm run test:e2e -- --provider gitea` — 2 files / 14 tests passed with sandbox cleanup. Feature remains in progress: the implementation files are still oversized (`sync-status/SyncStatusView.ts` ~80 KB, `sync/SyncManager.ts` ~50 KB), domain still imports modal adapters, and manual Obsidian desktop/mobile checks are pending.
-- [x] Real-provider E2E Phase 2, PR #124 fully green (2 more follow-up commits, same branch/PR):
-  (1) NOSONAR placement fix — the previous commit's `# NOSONAR` comments on the gitea-provisioning
-  `curl` calls landed on the *closing* line of each multi-line statement, but SonarCloud attributes
-  shell:S5332 to the *opening* `curl` line, which can't carry a trailing comment while also ending
-  in a `\` continuation; collapsed those two calls to single lines (payload JSON pulled into a
-  local var first) so the marker lands correctly — confirmed via SonarCloud's issues API (2 of 7
-  findings were still OPEN after the first fix, both on the curl lines themselves; 0 after this
-  one, Security Rating A). (2) Dedup push/pull_request races — `provider-e2e`'s concurrency group
-  keyed PR runs by PR number and branch-only runs by branch name, so a push to a branch with an
-  open PR (this branch, since it has an open PR) fired both a `push` and a `pull_request` run in
-  *different* concurrency groups for the same commit, running fully concurrently against the same
-  shared GitLab sandbox; reproduced twice (rerunning the `pull_request`-triggered run's GitLab leg
-  failed both times — first with 3 different real-API errors including `400: Deadline Exceeded`,
-  then with a plain `testConnection` 120s timeout — while the `push`-triggered run for the
-  identical commit passed cleanly both times). Fixed by keying the group by branch name alone
-  (`github.head_ref || github.ref_name`, same expression `E2E_SOURCE_BRANCH` already used)
-  regardless of trigger event, and updated `e2e-pr-cleanup.yml`/`e2e-branch-cleanup.yml`'s groups
-  to match (documented as sharing `provider-e2e`'s group so cleanup queues behind rather than races
-  an active run). Verified end-to-end: pushed the fix, both a `push` and a `pull_request` run fired
-  again for the same commit as expected, and this time the concurrency group correctly cancelled
-  one of them instead of letting them race — the surviving run passed 100% clean (GitHub/GitLab/
-  Gitea E2E, full CI, SonarCloud A). User explicitly chose "fix the dedup now" over deferring or
-  just re-running until green, when asked.
-  Verification: `actionlint` — 0 errors; `npx eslint .` — 0 errors; `npm run build` — clean;
-  `npx vitest run` — 527 passed; real end-to-end Gitea sandbox run (`npm run test:e2e --
-  --provider gitea`) — 14/14 passed, twice, exercising the edited curl calls directly; real CI —
-  PR #124's surviving run fully green including all three real-provider E2E legs and SonarCloud
-  Security Rating A.
-- [x] Real-provider E2E Phase 2 follow-up fix (same branch/PR #124): `ci.yml`'s `provider-e2e` job
-  set `E2E_WORKDIR` in job-level `env:` using `${{ runner.temp }}` — `runner` isn't an allowed
-  context there (only `github`/`inputs`/`matrix`/`needs`/`secrets`/`strategy`/`vars` are), which
-  makes GitHub Actions reject the whole workflow file at parse time; confirmed via `actionlint`
-  and via the GitHub API (`jobs_url` for the c8382cb push run returned `total_count: 0` — no job
-  was ever created). Fixed by computing `E2E_WORKDIR` in an unconditional first step instead,
-  exporting it through `$GITHUB_ENV` (uses `$RUNNER_TEMP`, the step-level equivalent). Also fixed
-  the SonarCloud Quality Gate failure (Security Rating D on new code, required ≥ A):
-  `scripts/e2e-namespace.sh`'s `e2e_branch_hash` used `sha1sum`/`shasum` (CRITICAL, shell:S4790
-  weak-hash — not a real security use, just a collision-avoidance digest, but Sonar flags SHA-1
-  regardless of context) — switched to `sha256sum`/`shasum -a 256`; five `curl`/log lines in
-  `scripts/e2e-harness.sh`'s gitea provisioning that talk `http://` to a per-run Docker-bridge-only
-  container (shell:S5332 clear-text-protocol) — annotated `# NOSONAR` with an inline justification
-  (address never leaves the run's own Docker network, credentials are freshly random and
-  discarded at cleanup); `.github/workflows/ci.yml`'s new `npm ci` (githubactions:S6505, missing
-  `--ignore-scripts`) and `actions/checkout@v6`/`actions/setup-node@v6`/`dorny/paths-filter@v3` in
-  the two new jobs plus the three new standalone workflow files (githubactions:S7637, unpinned
-  action refs) — pinned to full commit SHAs, `npm ci` in the new job got `--ignore-scripts`
-  (husky's `prepare` hook isn't needed in CI). Left the pre-existing `build-artifact` job's
-  checkout/setup-node/npm ci untouched (not flagged, out of this fix's scope).
-  Verification: `actionlint` (downloaded v1.7.12 binary) — 0 errors on all 4 workflow files
-  (aside from an expected false-positive on the `32gb-ram` custom self-hosted label, which
-  actionlint can't know about); `bash -n` on all 5 changed/touched shell scripts — all parse;
-  `npx eslint .` — 0 errors; `npm run build` (incl. Obsidian 1.11.0 compat typecheck) — clean;
-  `npx vitest run` — 527 passed. Not yet re-verified against real CI/SonarCloud (push pending).
-- [x] Real-provider E2E Phase 2 (multi-run isolation): added `scripts/e2e-namespace.sh` (single
-  canonical `e2e/pr/<n>/<provider>/run-<id>-<attempt>` / `e2e/branch/<sanitized-id>/<provider>/
-  run-<id>-<attempt>` identity generator, sourced by every other layer — no branch-naming logic
-  duplicated anywhere else), `scripts/e2e-namespace-cleanup.sh` (layer 2: deletes a whole PR/branch
-  namespace), `scripts/e2e-janitor.sh` (layer 3: TTL sweep, default 24h, of any leftover `e2e/**`
-  branch, generic `git for-each-ref`/`push --delete`, tolerant of already-deleted refs — no
-  Node-based sweeper reintroduced). Removed `e2e-harness.sh`'s old `sweep` subcommand (superseded
-  by the janitor) and its ad hoc `gfs-e2e-<provider>-<run>` naming. `ci.yml`'s `provider-e2e` job
-  now sets `E2E_WORKDIR` to `$RUNNER_TEMP/git-files-sync-e2e/<run-id>/<run-attempt>/<provider>`
-  (was a shared `e2e-<provider>` dir), passes `E2E_PR_NUMBER`/`E2E_SOURCE_BRANCH` through for
-  `provision`, and carries a per-source/provider `concurrency` group
-  (`e2e-pr-<n>-<provider>`/`e2e-branch-<branch>-<provider>`, `cancel-in-progress: true`) so a
-  repeated push/rerun cancels its own predecessor instead of both running. Added
-  `.github/workflows/e2e-pr-cleanup.yml` (`pull_request_target: [closed]`, no `ref:` override on
-  checkout so it only ever runs this repo's own trusted code/secrets, never the closing PR's
-  branch) and `e2e-branch-cleanup.yml` (`delete` event) — both share the same concurrency-group
-  naming as `provider-e2e` with `cancel-in-progress: false` so cleanup queues behind rather than
-  races an active run. Added `.github/workflows/e2e-janitor.yml` (schedule, every 6h, plus
-  `workflow_dispatch`). Rewrote `docs/testing/real-provider-e2e.md`'s "Isolation model" section
-  (namespace scheme, concurrency/cancellation semantics, 3-layer cleanup hierarchy with a Mermaid
-  diagram, self-hosted workdir isolation) and updated Layout/CI/Cleanup/Known-gaps to match.
-  Verification: `npx eslint .` — 0 errors; `npm run build` (incl. Obsidian 1.11.0 compat
-  typecheck) — clean; `npx vitest run` — 527 passed; `python3 -c yaml.safe_load(...)` on all 4
-  touched/new workflow YAML files — all parse; `bash -n` on all 4 shell scripts — all parse;
-  functional dry-runs against throwaway local git repos (not the real sandboxes) for
-  `e2e_test_branch`/`e2e_branch_id` collision resolution (`feature/foo-bar` vs `feature-foo/bar`
-  hash to different identities), the janitor's TTL sweep (old branch deleted, recent branch and an
-  unrelated `feature/keep-me` branch both left untouched), and `e2e-namespace-cleanup.sh`'s prefix
-  match (`e2e/pr/123/**` matches only that PR's two provider branches, not PR 456 or the
-  branch-only namespace); **real end-to-end run against a live local Gitea sandbox**
-  (`npm run test:e2e -- --provider gitea`) with the new harness/namespace code — 14/14 E2E tests
-  passed including a real Docker provision/seed/cleanup cycle; confirmed
-  `E2E_PROVIDER=github scripts/e2e-harness.sh provision` still hard-fails on missing
-  `E2E_GITHUB_OWNER` (never a silent skip) with the new identity plumbing in place. Not yet
-  exercised against live GitHub/GitLab sandboxes or the real self-hosted runner fleet from this
-  checkout (no credentials/runner access here) — see `docs/testing/real-provider-e2e.md`'s "Known
-  gaps".
-- [x] Real-provider E2E: pushed to `origin/test/real-provider-e2e`, real CI run against `firstsun-dev/git-files-sync`'s self-hosted fleet (run 31666859288) fully green: `E2E / github` (3m15s) and `E2E / gitlab` (3m54s) both passed for real against live sandboxes, `E2E / github`+`gitlab`+`gitea` gate, and the full downstream `CI` (lint, test Node 22/24, package, build/release) all green. Getting there took 3 fix-and-repush rounds off real CI failures the local-only verification hadn't caught: (1) the generated `GitVerifier`'s git calls had no `GIT_ASKPASS`/`GIT_TERMINAL_PROMPT` in the separate vitest-step process — fixed by persisting them (paths/flags only, not the token itself) into `e2e.env`; (2) gitea provisioning timed out on `127.0.0.1:<host-port>` — this runner fleet is itself a sibling container of the Docker daemon, so a published host port isn't reachable from it; switched to the container's own bridge IP; (3) that same curl call could hang indefinitely with no `--max-time`, silently blowing past the health-check loop's own retry budget — added `--max-time` everywhere and a retry-with-backoff on `docker inspect` returning an empty IP. Gitea leg then temporarily disabled in CI per user request (still passes locally) — see Outstanding Items.
-- [x] Real-provider E2E Phase 1 (Shell/Git harness rewrite): replaced the Node-based `e2e/provision`/`e2e/verifier`/`e2e/providers`/`e2e/shim/{obsidian-request-url,window-timers}`/`scripts/run-e2e*.mjs` (fetch/globalThis/node:child_process/node:crypto in committed `.ts` — the exact APIs `docs/obsidian-scanner-audit.md` flagged) with `scripts/e2e-harness.sh` (provision/seed/verify/cleanup/sweep — Shell + Git CLI: `git push <sha>:refs/heads/<branch>` for GitHub/GitLab branch isolation, plain `docker`/`curl` for Gitea's disposable container+repo, `GIT_ASKPASS` generated per-run under `$RUNNER_TEMP`/`$E2E_WORKDIR`, never persisted) plus `scripts/run-e2e.sh` (local orchestration wrapper). Node-only glue the suites still need at runtime (real `requestUrl` shim, `window` timer alias, a git-CLI-backed verifier) is generated by `provision` into `$E2E_RUNTIME_DIR` and loaded via runtime-computed dynamic `import()` — never committed — so `e2e/**/*.ts` went back into `tsconfig.json`'s `include`/`eslint.config.mts`'s scope clean. Ported all 4 suites (github/gitlab/gitea/sync-manager) to the new `SyncManager.pushFiles` API and the generated verifier. `npx eslint .` — 0 errors; `npm run build` — clean; `npx vitest run` — 527 passed; **real end-to-end run against a live local Gitea sandbox** (`npm run test:e2e -- --provider gitea`) — 14/14 E2E tests passed (gitea contract suite + SyncManager suite), including a real Docker container provision/seed/cleanup cycle. GitHub/GitLab E2E legs are written and typecheck/lint clean but weren't run live (no sandbox credentials in this environment) — same known gap the pre-Phase-1 harness had, documented in `docs/testing/real-provider-e2e.md`'s "Known gaps". Self-audit of `docs/obsidian-scanner-audit.md`'s grep method against the new tree: zero hits for `fetch`/`globalThis`/`node:crypto`/`node:child_process`/`node:util`/bare-timers in `e2e/**` or `src/**`.
-- [x] Real-provider E2E Phase 0 reconcile: merged `origin/main` (scanner-driven E2E removal, v1.5.8) into `test/real-provider-e2e-work`, keeping the old `e2e/**` tree temporarily (added `e2e/**`/`vitest.e2e.config.ts` to `eslint.config.mts` `globalIgnores` as an interim measure — not in `tsconfig.json` `include` either, both to be resolved for real by the Phase 1 harness rewrite), then merged `origin/claude/unify-push-pull-pipeline` (new unified `SyncManager.pushFiles` API) cleanly (disjoint file sets, only `package-lock.json` auto-merged). `npx eslint .` — 0 errors; `npm run build` (incl. Obsidian 1.11.0 compat typecheck) — clean; `npx vitest run` — 527 tests passed.
-- [x] `fix(sync): ensure parent dirs exist when reverting file moves` (issue #94): extracted `ensureParentDirs()` to `src/utils/vault-path.ts` and called it before rename in both `revertMove` and `revertMoveGroup`, fixing "folder does not exist" error when reverting moves to deleted parent folders. `npx eslint .` — 0 errors; `npm run build` — clean; `npx vitest run` — 502 tests passed.
-- [x] `fix(gitlab): fix sha/revision semantics for optimistic locking` (issue #101, PR #113, merged): `GitFile.sha` now consistently represents blob identity across providers; added `GitFile.revision` for provider-specific write control.
-
-Full history of completed features (feat-001 through feat-024) archived to [archive/2026-07.md](./archive/2026-07.md). August work archived to [archive/2026-08.md](./archive/2026-08.md).
+The AGENTS-required Haiku verifier is unavailable in this environment; verification runs locally and through real CI.
diff --git a/scripts/e2e-harness.sh b/scripts/e2e-harness.sh
index c19ca5c..1f6cad3 100755
--- a/scripts/e2e-harness.sh
+++ b/scripts/e2e-harness.sh
@@ -394,41 +394,33 @@ EOF
 
 provision_gitea_container() {
     local image="${E2E_GITEA_IMAGE:-gitea/gitea:1.22}"
-    local name="gfs-e2e-gitea-$$"
+    local run_id="${GITHUB_RUN_ID:-local-$(date +%s)}"
+    local run_attempt="${GITHUB_RUN_ATTEMPT:-1}"
+    local name="gfs-e2e-gitea-${run_id}-${run_attempt}-$$"
     log "Starting gitea container ($image)"
-    # No -p host-port mapping: on a self-hosted runner that is *itself* a
-    # sibling container of the Docker daemon (confirmed to be this fleet's
-    # topology -- a published host port + `127.0.0.1` is only reachable from
-    # the Docker host's own network namespace, not from a sibling container's),
-    # a host-port + 127.0.0.1 URL is unreachable. The container's own bridge
-    # IP is reachable from any container on the same (default) Docker
-    # network, including the runner itself, whether the runner is bare-metal
-    # or a sibling container -- so use that instead.
+    # Gitea runs beside this script on a developer machine or fresh
+    # GitHub-hosted VM. Publishing to loopback avoids Docker bridge-IP routing
+    # assumptions and asks Docker for a collision-free host port.
     docker run -d --name "$name" \
+        -p 127.0.0.1::3000 \
         -e GITEA__security__INSTALL_LOCK=true \
         "$image" >/dev/null
     echo "$name" >"$workdir/gitea-container-name"
 
-    # Retry: docker run -d returns before the network attachment always has
-    # an IP assigned yet on every runner/docker version observed.
-    local container_ip=""
+    local host_port=""
     for _ in 1 2 3 4 5 6 7 8 9 10; do
-        container_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name")
-        [ -n "$container_ip" ] && break
+        host_port=$(docker port "$name" 3000/tcp | sed -n 's/^127\.0\.0\.1://p' | head -n 1)
+        [ -n "$host_port" ] && break
         sleep 1
     done
-    if [ -z "$container_ip" ]; then
-        echo "gitea container never got a network IP (docker inspect empty)" >&2
+    if [ -z "$host_port" ]; then
+        echo "gitea container never published a localhost port" >&2
         docker logs "$name" >&2 || true
         exit 1
     fi
     # NOSONAR-justified plain HTTP (shell:S5332, x5 below): base_url never
-    # leaves the Docker bridge network this run created -- container_ip is a
-    # per-run internal address, admin_pass/token are freshly random and
-    # discarded when the container is torn down at cleanup, and there is no
-    # TLS-terminating endpoint to speak to on an ephemeral local sandbox
-    # container. Not a real clear-text-credential exposure.
-    local base_url="http://${container_ip}:3000" # NOSONAR
+    # leaves loopback; credentials are per-run and discarded at cleanup.
+    local base_url="http://127.0.0.1:${host_port}" # NOSONAR
 
     local ready_ms="${E2E_CONTAINER_READY_MS:-60000}"
     local poll_ms="${E2E_POLL_INTERVAL_MS:-500}"
diff --git a/scripts/run-e2e.sh b/scripts/run-e2e.sh
index dbdd9fc..d946c58 100755
--- a/scripts/run-e2e.sh
+++ b/scripts/run-e2e.sh
@@ -40,10 +40,22 @@ fi
 
 export E2E_PROVIDER="$provider"
 export E2E_TIER="$tier"
-export E2E_WORKDIR="${E2E_WORKDIR:-${TMPDIR:-/tmp}/gfs-e2e-${provider}}"
+created_workdir=0
+if [ -z "${E2E_WORKDIR:-}" ]; then
+    E2E_WORKDIR=$(mktemp -d "${TMPDIR:-/tmp}/gfs-e2e-${provider}.XXXXXX")
+    created_workdir=1
+fi
+export E2E_WORKDIR
 
 cleanup() {
     scripts/e2e-harness.sh cleanup || true
+    if [ "$created_workdir" -eq 1 ] \
+        && [[ ! "${E2E_KEEP_BRANCH:-}" =~ ^(1|true)$ ]]; then
+        # Only remove the exact mktemp directory this invocation created.
+        case "$E2E_WORKDIR" in
+            "${TMPDIR:-/tmp}/gfs-e2e-${provider}."*) rm -rf -- "$E2E_WORKDIR" ;;
+        esac
+    fi
 }
 trap cleanup EXIT
 
diff --git a/session-handoff.md b/session-handoff.md
index b6257bd..dc840fc 100644
--- a/session-handoff.md
+++ b/session-handoff.md
@@ -1,47 +1,21 @@
 # Session Handoff
 
-**Date:** 2026-08-23
-**Branch:** `feat/sync-status-workflow-ui` (uncommitted, stacked on 8 commits)
-**Active Feature:** `feat/sync-status-remote-actions` — remote-only download actions + Sync Queue upload/download routing. Code complete; gitea E2E + manual Obsidian verification remain. Not yet committed.
+**Date:** 2026-08-27
+**Branch:** `codex/test-gitea-e2e-ci`
+**Active Feature:** issue #139 / PR #140
 
-## Done This Session — remote-actions (sync-status-remote-actions)
+## Completed This Session
 
-View-layer only (no `src/logic/**` changes), stacked on the prior `feat/sync-status-workflow-ui` uncommitted UX work:
+Implemented the local/CI Gitea split in commits `920adee`, `18de6e0`, and `b5884fc`. Local Gitea uses a Docker-assigned loopback port, collision-safe container identity, and a unique temporary workdir. CI runs secretless Gitea on `ubuntu-latest`, keeps credentialed GitHub/GitLab E2E on self-hosted runners, and rejects fork PRs before runner allocation.
 
-1. **Badges fixed**: `remote-only` was badged `D` (read as "deleted locally" — misleading; `pushFiles` never propagates local deletes anyway) → now `↓` with subtitle "Remote available" + tooltip "Exists on remote but not locally — download to add it". `remote-modified` `M`→`↕`. Kept `local A`, `moved R`, `conflict !` unchanged (minimal scope). Removed the stale `deletedLocally` i18n keys; added `remoteAvailable` + tooltip, `queue.upload`/`queue.download`, `action.download`(+tooltip) across en/zh-cn/zh-tw.
-2. **`changeOperation(kind)` classifier** (`ChangePresentation.ts`): `local-only`/`local-modified`/`moved`/`conflict`→`upload`; `remote-only`/`remote-modified`→`download`.
-3. **Inline Download button** on `remote-only` rows (`ChangeItem.ts` `renderDownloadAction`): stops propagation, calls `onDownload(item)` → `actionService.pull([id])`. Only on `remote-only` (safe — no local file to lose), NOT `remote-modified` (two-sided change = overwrite risk). Icon `download` added to `icons.ts`.
-4. **Sync button routing** (`SourceControlView.runSync`): splits the Sync Queue by `changeOperation`, upload ids → `callbacks.onPush`, download ids → new `callbacks.onPull`. Mobile sync bar now calls `runSync(queue)` too (was `onPush(selectedIds)`). Header push button passes `onPush: () => this.runSync(state.syncQueue)`.
-5. **Sync Queue grouping** (`renderSelectedSection`): Upload/Download sub-groups with `.scv-queue-group-label` headers, shown ONLY when the queue is mixed (`upload.length>0 && download.length>0`); single-operation queues stay flat → existing tests unaffected.
-6. **New optional callbacks** on `SourceControlViewCallbacks`: `onPull?(changeIds)`, `onDownload?(item)`. Wired in `SourceControlItemView.ts` to `this.plugin.sourceControlActions.pull(...)`. `onDownload` threads through `ChangeItemCallbacks` → `ChangeTreeCallbacks` → `treeCallbacks`.
-7. **styles.css**: `.scv-change-download` button + `.scv-queue-group-label` styles.
+Conflict resolution merges the latest `claude/source-control-foundation` (`257b2a4`) into PR #140. The base branch's parallel lint/unit/build/provider validation and single `CI / Required Checks` release gate are retained; Gitea is added as a fifth parallel validation dependency. The base branch's new E2E tier support is retained alongside the random local workdir cleanup.
 
-Verification evidence (all green):
-```text
-npx eslint .            -> 0 errors
-npm run build           -> clean (tsc + Obsidian 1.11.0 compat + esbuild)
-npx vitest run          -> 62 files / 668 tests pass
-```
+## Verification Evidence
 
-Tests updated/added:
-- `ChangePresentation.test.ts`: `↓`/`↕` badges + tooltips; `changeOperation` upload/download matrix.
-- `ChangeTree.test.ts`: `↓` badge; Download button on `remote-only` (calls `onDownload`), absent on `remote-modified`.
-- `SourceControlView.test.ts` (+8): mixed routing (upload→onPush, download→onPull), download-only routing (onPush not called), mixed group labels present, single-op group labels absent, inline Download button → onPull, no download button on local-only.
-- `source-control-flows.e2e.test.ts`: new "download (remote-only) action" describe — downloads a remote-only change via `actionService.pull`, asserts local file created + content + metadata sha advances; isolation test (local-only change stays idle).
+Pre-merge evidence remains green: targeted CI run 33048613679 and SonarCloud. Post-merge local verification is green: `./init.sh` passed lint/build/Obsidian 1.11 compatibility and 64 files / 723 tests; Gitea E2E passed 3 files / 30 tests with 18 tier-skipped; 8 workflow contract tests, bash syntax, ShellCheck, actionlint, and `git diff --check` all passed.
 
-## Exact Next Steps
+The AGENTS-required Haiku verifier is unavailable, so verification runs locally and in real CI.
 
-1. **Run gitea E2E locally**: `npm run test:e2e -- --provider gitea` — exercises the new download E2E (real Docker provision/seed/cleanup). This is the remaining automated gate.
-2. **Manual Obsidian verification** (desktop + mobile): `↓`/`↕` badges + tooltips, inline Download button on a remote-only row pulls the file into the vault, mixed Sync Queue shows Upload/Download labels, Sync button pulls download-kind rows.
-3. **Commit** (only when the user explicitly asks): the change is view-layer only; stage `src/ui/source-control/`, `src/ui/components/icons.ts`, `src/i18n/locales/*`, `styles.css`, `tests/ui/source-control/*`, `e2e/suites/source-control-flows.e2e.test.ts`, `progress.md`, `session-handoff.md`. NOTE: an unrelated uncommitted `ci.yml` change from a prior session is still in the working tree — stage selectively.
+## Exact Next Step
 
-## Deferred — architecture must-fixes (separate issue, per one-feature-at-a-time)
-
-From the PR #135 clean-code review. To be filed via firstsun-pm as a follow-up issue, NOT bundled here:
-- Rename `SourceControlViewModel.selectedItems`→`syncQueue` (aligns domain naming with the `SYNC QUEUE` UI label).
-- Extract `DiffStatProvider` (cache + load + invalidate) out of the ViewModel.
-- Extract `SelectionController` from the ViewModel.
-
-## Prior Session — Queue/Repository UX separation + List view (uncommitted, on this branch)
-
-Separated the two Source Control regions by role label per UX review (view-layer only): `SYNC QUEUE` (flat action preview) + `Repository Changes` (tree/list toggle, flat list with folder-path suffix), mobile queue collapse-by-default. See `progress.md` "Latest Evidence" for detail. Domain-untouched invariant holds.
\ No newline at end of file
+Commit and push the merge, then confirm PR #140 is mergeable and `CI / Required Checks` passes.
diff --git a/tests/ci-workflow.test.ts b/tests/ci-workflow.test.ts
index 1948e1c..d70f958 100644
--- a/tests/ci-workflow.test.ts
+++ b/tests/ci-workflow.test.ts
@@ -4,12 +4,32 @@ import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
 
 const workflow = readFileSync('.github/workflows/ci.yml', 'utf8');
+const harness = readFileSync('scripts/e2e-harness.sh', 'utf8');
+const runner = readFileSync('scripts/run-e2e.sh', 'utf8');
 
 describe('CI workflow contracts', () => {
     it('retries transient provider failures three times', () => {
         expect(workflow).toContain('max_attempts: 3');
     });
 
+    it('runs secretless Gitea E2E on an ephemeral GitHub-hosted runner', () => {
+        expect(workflow).toMatch(/gitea-e2e:[\s\S]*?runs-on: ubuntu-latest/);
+        expect(workflow).toMatch(/gitea-e2e:[\s\S]*?permissions:\n\s+contents: read/);
+        expect(workflow).toContain('scripts/run-e2e.sh --provider gitea');
+        expect(workflow).not.toContain('Gitea E2E is disabled in CI');
+    });
+
+    it('keeps credentialed providers on self-hosted runners away from fork PRs', () => {
+        expect(workflow).toContain('provider: [github, gitlab]');
+        expect(workflow).toContain("github.event_name != 'pull_request'");
+        expect(workflow).toContain('github.event.pull_request.head.repo.full_name == github.repository');
+    });
+
+    it('allocates isolated concurrency identities to manual and scheduled E2E', () => {
+        const independentRunIdentity = "format('{0}-{1}', github.event_name, github.run_id)";
+        expect(workflow.split(independentRunIdentity)).toHaveLength(3);
+    });
+
     it('runs lint, unit-test, build, and provider-e2e in parallel (no validation waits on E2E)', () => {
         // The old preflight -> provider-e2e -> e2e-gate -> reusable-CI serial
         // chain is gone; every validation job starts right after the push.
@@ -21,7 +41,7 @@ describe('CI workflow contracts', () => {
 
     it('gates release behind a single required-checks aggregate that runs even on failure', () => {
         expect(workflow).toContain('name: CI / Required Checks');
-        expect(workflow).toContain('needs: [lint, unit-test, build, provider-e2e]');
+        expect(workflow).toContain('needs: [lint, unit-test, build, gitea-e2e, provider-e2e]');
         expect(workflow).toContain('if: always()');
         // Release only starts after the gate; a cancelled matrix leg is a hard
         // failure here (the surviving run owns the latest-commit gate), not a
@@ -30,4 +50,18 @@ describe('CI workflow contracts', () => {
         expect(workflow).not.toContain('run-ci=false');
         expect(workflow).not.toContain('needs.e2e-gate.outputs.run-ci');
     });
-});
\ No newline at end of file
+});
+
+describe('local Gitea harness contracts', () => {
+    it('publishes Gitea on a Docker-assigned localhost port', () => {
+        expect(harness).toContain('-p 127.0.0.1::3000');
+        expect(harness).toContain('docker port "$name" 3000/tcp');
+        expect(harness).toContain('local base_url="http://127.0.0.1:${host_port}"');
+        expect(harness).not.toContain("docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'");
+    });
+
+    it('allocates an isolated default workdir for concurrent local runs', () => {
+        expect(runner).toContain('mktemp -d "${TMPDIR:-/tmp}/gfs-e2e-${provider}.XXXXXX"');
+        expect(runner).toContain('created_workdir=1');
+    });
+});