README day-2: regenerate the cc-ci lock on the host; plan: steps 8 + lint follow-ups done

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

README.md

@@ -329,7 +329,10 @@ stopped on the new host while its directory is copied:
   this flake's nixpkgs, so the CI server is rebuilt on the same nixpkgs.
 - **Update only cc-ci's code** (harness/tests/modules): merge in the cc-ci repo, then
   `nix flake update cc-ci` here and rebuild; also `git -C /etc/cc-ci pull --recurse-submodules`
-  so the deployed checkout the sweep runs from matches.
+  so the deployed checkout the sweep runs from matches. Run the lock update **on this host**: a
+  lock written by a newer Nix elsewhere once failed here with `NAR hash mismatch in input
+  git+https://…cc-ci.git…&shallow=1`; re-running `nix flake update cc-ci` on the host fetched the
+  input properly and the rebuild went through.
 - **Something is down**: `systemctl --failed`, `journalctl -u deploy-<x>`, `docker service ps <svc>`;
   the cc-ci repo's `docs/runbook.md`. Host unreachable: Hetzner console → reboot lands on the last
   `switch`ed generation; rescue mode + `nixos-enter` for anything worse (skill

cc-ci-plan/plan-cc-ci-combined-host.md

@@ -82,7 +82,7 @@ notplants-side uses it), tailscale hostname → `notplants-orchestrator`.
    drone, one direct `cc-ci-run` on custom-html-tiny).
 7. [x] Operator: Gandi A records `ci`, `*.ci`, `ns-acme` → 195.201.88.249. Then: old bridge +
    drone + timers off, new bridge up, one real `!testme` end-to-end, a `!testme`-driven report page.
-8. [~] Move the orchestrator: stop cc-ci units here, final rsync of `/srv/cc-ci-orch` + agent
+8. [x] Move the orchestrator: stop cc-ci units here, final rsync of `/srv/cc-ci-orch` + agent
    state, enable on the new host, operator reconnects there; notplants-nix PR removing cc-ci.
 9. [ ] Old cc-ci server: cold standby ~1 week, then operator deletes it and the stale tailnet node.
 10. [ ] Domain move to `autonomic.zone` — separate plan, after 1–9 are proven.
@@ -121,3 +121,7 @@ notplants-side uses it), tailscale hostname → `notplants-orchestrator`.
   Hetzner token; (10) autonomic.zone domains. Also re-key cc-ci-secrets to the new host's ssh host
   key (optional; master key works) and re-run the cc-ci self-test build (1324/1325 failed during
   the resolver mess).
+- 2026-09-07 21:20 UTC — notplants-nix `chore/drop-cc-ci` merged (9c785c1) and applied on the old
+  host (test → switch, generation 57, healthy, cc-ci units gone). cc-ci push self-test green again
+  after #33 (ruff format, pre-existing since 2026-08-31) + #34 (statix: acme-dns.nix systemd
+  attrset): builds 1330/1331 success. New host on generation 6 with cc-ci main 0437210.