@@ -77,10 +77,10 @@
 @test "Create platform Package and reconcile previous version" {
   # Minimal, version-stable platform config: networking + publishing only. These
   # keys have been valid since the 1.4 line, so the same manifest installs on the
-  # baseline AND is what the current chart re-renders on upgrade. Deliberately
-  # lean (no monitoring/seaweedfs bundle) — the seeded canaries don't need them,
-  # and a leaner baseline is faster and less flaky while still exercising the
-  # operators/CRDs/storage/tenant/app upgrade surface.
+  # baseline AND is what the current chart re-renders on upgrade. Monitoring is
+  # left off (the seeded canaries don't need it); object storage is NOT — it is
+  # enabled at the root-tenant level below (seaweedfs), because the etcd
+  # v1alpha2 adoption migration needs the backup target it provides.
   kubectl apply -f - <<EOF
 apiVersion: cozystack.io/v1alpha1
 kind: Package
@@ -128,14 +128,35 @@ EOF
 }
 
 @test "Configure root tenant (baseline)" {
-  # Enable just enough of the root tenant to host a child tenant + apps: etcd
-  # (tenant control plane) and ingress. Monitoring/seaweedfs are intentionally
-  # left off (see the lean-baseline rationale above).
+  # Enable etcd (a legacy etcd.aenix.io cluster for the v1alpha2 adoption
+  # migration to exercise), ingress, and seaweedfs. seaweedfs is REQUIRED here,
+  # not optional: migration 50 (etcd v1alpha2 adoption, run during the upgrade)
+  # refuses to adopt live etcd without a pre-adoption S3 safety snapshot, and the
+  # backupstrategy-controller only projects the cozy-backups-creds Secret it needs
+  # once the cozy-backups Bucket binds against tenant-root's object store. Without
+  # seaweedfs the bucket never binds, the creds never project, and the upgrade's
+  # pre-upgrade migration hook fails BackoffLimitExceeded.
   kubectl patch tenants/root -n tenant-root --type merge \
-    -p '{"spec":{"host":"example.org","ingress":true,"etcd":true,"isolated":true}}'
+    -p '{"spec":{"host":"example.org","ingress":true,"etcd":true,"isolated":true,"seaweedfs":true}}'
 
-  timeout 60 sh -ec 'until kubectl get hr -n tenant-root etcd ingress tenant-root >/dev/null 2>&1; do sleep 1; done'
-  kubectl wait hr/etcd hr/ingress hr/tenant-root -n tenant-root --timeout=10m --for=condition=ready
+  timeout 60 sh -ec 'until kubectl get hr -n tenant-root etcd ingress seaweedfs tenant-root >/dev/null 2>&1; do sleep 1; done'
+  # seaweedfs installs as a serial chain (seaweedfs-db CNPG -> seaweedfs-system
+  # raft -> seaweedfs wrapper), ~5-6min idle and longer under load; the
+  # tenant-root parent flips Ready only after every child, so gate at 20m.
+  kubectl wait hr/etcd hr/ingress hr/seaweedfs hr/tenant-root -n tenant-root --timeout=20m --for=condition=ready
+}
+
+@test "Wait for platform backup target (etcd-adoption prerequisite)" {
+  # The etcd v1alpha2 adoption migration's only hard boundary is the
+  # backupstrategy-controller-projected cozy-backups-creds Secret (AWS creds) in
+  # cozy-velero — see packages/core/platform/images/migrations/migrations/50
+  # ("The real boundary is the credentials Secret, not the path"). Gate on it
+  # here so the pre-upgrade hook in Phase 3 can resolve the snapshot target.
+  # 10m: the projection chains cozy-backups Bucket bind -> COSI access grant ->
+  # projector copy into cozy-velero, all downstream of the seaweedfs wait above.
+  timeout 600 sh -ec 'until kubectl -n cozy-velero get secret cozy-backups-creds >/dev/null 2>&1; do sleep 5; done'
+  kubectl -n cozy-velero get secret cozy-backups-creds \
+    -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | grep -q .
 }
 
 @test "Create isolated test tenant (baseline)" {