orchestrator: reboot-resilience + session auto-resume + full session plan/tooling

Reboot survival for the Pi orchestrator host:
- systemd unit cc-ci-plan/systemd/cc-ci-loops.service (installed + enabled): on boot
  records the reboot, starts loops+watchdog (RESUME_PHASE=1), and resumes the
  orchestrator session.
- reboot-log.sh: boot_id-gated reboot record -> REBOOTS.md (manual restarts don't count).
- launch-orchestrator.sh: injects an AGENTS.md startup nudge so an auto-resumed
  orchestrator announces itself (PushNotification) + reports reboots.
- AGENTS.md: on-startup notify routine documented.

Plans/tooling accumulated this session:
- plan-phase1d (generic suite), 1e (harness corrections), phase4 (final review),
  sso-dep-testing, orchestrator-migration (parked), test-e2e-testme-acceptance.
- launch.sh: 1d/1e/2/2b/3/4 phase sequence, machine-docs-aware state resolution,
  limit-stall re-nudge, INBOX side-channel detection.
- plan.md §6.1/§7: artifact-layer isolation, INBOX, 5-min long-run polling, DEFERRED.
- prompts: isolation discipline + INBOX + pacing.
- .gitignore: harden (.sops/, cc-ci-secrets/, .claude/, *.tmp.*).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cc-ci-plan/plan-phase1b-review-lint.md

@@ -135,3 +135,40 @@ Blocking unless noted; these are *plan-relevant invariants visible only by readi
 - Whether to add Python **type-checking** (mypy/pyright) now or defer to `IDEAS.md`.
 - The precise **blocking vs advisory** split for the checklist.
 - Whether the `.drone.yml` lint stage should **fail** the build or just warn initially.
+
+---
+
+## 7. Operator review items (added 2026-05-27) — repo layout (do in this 1b pass)
+
+Two structural-review items from the operator. Both are **blocking** for 1b. Apply them as part of
+this pass, then re-verify (RL3 covers the re-verification). **Mind the coordination caveats — these
+touch the live flake build and the running multi-agent machinery.**
+
+### RL5 — Consolidate all Nix-code folders under a root `nix/`
+- Move the folders that contain `.nix` code — **`modules/` and `hosts/`** — to **`nix/modules/` and
+  `nix/hosts/`**. (Add future Nix dirs under `nix/` too.)
+- **Keep `flake.nix` / `flake.lock` at the repo root** (entry point) so the build ref is unchanged
+  (`docs/install.md`'s `nixos-rebuild switch --flake 'git+file://…?submodules=1#cc-ci'` stays valid).
+  Just update the flake's internal paths (`./modules` → `./nix/modules`, `./hosts` → `./nix/hosts`)
+  and any `imports`/`scripts`/`.drone.yml` references.
+- **Re-verify after the move:** the byte-identical clean-room result is the bar. The toplevel store
+  hash *will* change (paths differ) — that's fine; what must hold is that a fresh recursive clone
+  still rebuilds **byte-identical to the running system** and the Adversary re-confirms it cold
+  (folds into RL3). Update `docs/architecture.md` to describe the `nix/` layout.
+
+### RL6 — Move uppercase multi-agent-protocol files into `machine-docs/`
+- Move the uppercase protocol files — **`STATUS*.md`, `REVIEW*.md`, `JOURNAL*.md`, `BACKLOG*.md`,
+  `DECISIONS.md`** — into a root **`machine-docs/`** folder. **`README.md` stays in the repo root**
+  (operator decision, 2026-05-27) — it is the human-facing repo readme, not a protocol file; do
+  **not** move it into `machine-docs/`.
+- **Update every reference** to the new paths: the `cc-ci-plan/` plans (this file, `plan.md`,
+  `plan-phase1c-*`, `README.md`, `kickoff.md`, `test-e2e-testme-acceptance.md`), `AGENTS.md`,
+  `.drone.yml`, `scripts/`, and any in-repo doc that points at `STATUS.md`/`REVIEW.md`/etc.
+- **⚠ COORDINATION CAVEAT (do not move these unilaterally mid-run):** the live **watchdog**
+  (`cc-ci-plan/launch.sh`, the orchestrator's file) reads `STATUS-<id>.md` and `REVIEW-<id>.md` at
+  the **repo root** to drive handoff pings + the 1c→1b auto-transition. Moving them breaks the
+  running watchdog until `launch.sh` is updated to the `machine-docs/` paths and the watchdog is
+  restarted. **So sequence it with the orchestrator:** the orchestrator updates `launch.sh`'s
+  `PHASES_SPEC`/path logic and restarts the watchdog **in lockstep** with the loops' `git mv`.
+  Safest to do this **near the end of 1b** (or as its final step), not while a phase transition is
+  pending. Flag the orchestrator when ready and it will handle `launch.sh` + the watchdog restart.