Report-only from alkgit's LFS POC: AH-1 the shared bearer middleware is Bearer-only while real git-lfs authenticates Basic on the batch; AH-2 extras doors cannot carry a second route fallback (docs-only record). No mechanism change fixed here; dispositions session-owned.