P38 forge: remaining lifecycle, resource and auth-budget follow-ups #316

Carried from the implementation notes on #297. These are unresolved limits and evidence gaps, separate from the F0 conformance checklist. Keep them open when #297 closes.

• Serialize PATCH default_branch against a receive-pack deletion of the new default. The pre-receive hook currently reads the row without the lifecycle lock; the exclusive API lock does not exclude receive-pack. Add a real transport race regression before changing the ownership protocol. See the spec's F2b "Known race". Done in fix(forge): stop a default-branch change from landing on a branch a push is deleting #331: the PATCH takes a lease from the transport registry and answers 503 while a push could delete the new default; e2e_default_race.rs reproduces the race.

• Exercise Linux --git-memory-limit (RLIMIT_DATA) with a real child in CI; compilation alone is not runtime evidence. Done in test(forge): prove --git-memory-limit stops an oversized push on Linux #333: on Linux a push needing more memory fails with git's out-of-memory error and moves no ref; CI's ubuntu job runs the test.

• Prove a cancelled push removes its actual ref lock and quarantine directory, and that deletion during a clone produces a client error rather than a clean truncated transfer. Existing maintenance tests cover stale-artifact cleanup, not every cancellation path. Done in test(forge): prove cancelled pushes and clones clean up, and SIGTERM drains transfers #332: a push cancelled while holding its ref lock releases it, a push cancelled mid-pack moves no ref, and a delete during a clone ends the response without its terminating chunk. With Apple git 2.54 a quarantine directory can survive; maintenance reclaims it.

• Send a real Git transfer across SIGTERM and check the drain/cancel outcome. The current ops tests do not cover it; docs/THREAT-MODEL.md names this gap. Done in test(forge): prove cancelled pushes and clones clean up, and SIGTERM drains transfers #332: a clone within the drain completes, one still running at the deadline is cut, and no git process group outlives the server.

• Revisit password-attempt budgets for NAT64 /96, disconnects before the delayed response, and more than 10,000 live source keys. limits.rs currently groups IPv6 by /64 and clears a full map; its source budget is the guessing bound.

• Record whether Gitea requires repository scopes in addition to user scopes on /user/repos; the existing recordings establish the user-scope requirement only.

• Choose per-owner disk and per-user transport budgets before implementing quotas. Shared service accounts make an arbitrary per-user limit unsafe to choose from this repository alone.

• A client that disconnects mid-push body is sometimes noticed only at --git-idle-timeout (default 120 s): in about 1 run in 8 locally, cgi.rs Pump::run's body.frame() never reports the EOF. Cleanup is the same, just later. Found while writing test(forge): prove cancelled pushes and clones clean up, and SIGTERM drains transfers #332, which bounds its test with a 5 s idle timeout. Fixed in fix(forge): cancel a vanished client's transport within seconds, not after 120 s #334: TCP keepalive (probes after 15 s) finds the vanished peer; the idle timeout still bounds a blackholed one.

Operational boundaries already documented: Unix-only forge, no SQLite down migrations, no power-loss proof beyond fsync/crash tests. F6 remains a consumer deployment acceptance gate, not a claim made by conformance CI.