memory+journal: cc-ci host rebuild procedure; pxgate M2 deployed + verified on live host

cc-ci-plan/JOURNAL.md

@@ -654,3 +654,15 @@ session cc-ci-orchestrator-stale can be killed; recipe-mirrors org still private
   M1 = fix + controlled repro (loops), M2 = from-scratch cold-boot proof (orchestrator owns the
   live nixos-rebuild). Appended pxgate to agents.toml (idx 14); cleared SEQUENCE-COMPLETE +
   `phase set 14` + started loops → resumes the build for this one phase.
+
+## 2026-06-13 ~13:50 — pxgate M2: orchestrator nixos-rebuilt the cc-ci host (operator-authorized)
+- Operator OK'd the live rebuild (no CI running). Deployed the pxgate fix (deploy-proxy health probe
+  → traefik.ci.commoninternet.net/api/version) via nixos-rebuild switch --flake .#cc-ci.
+- Debugged 3 issues to get the build green: (1) git "not owned by current user" → chown root; (2) sops
+  `secrets/secrets.yaml does not exist` → copied operator-held secret from /etc/cc-ci/secrets/; (3) git
+  flake excludes untracked files → dropped .git (plain path flake). Procedure saved as memory
+  [[cc-ci-host-rebuild-procedure]] (the host had NO self-service rebuild path; last rebuild 05-31).
+- Result: deploy-proxy active on the dashboard-independent probe (verified in the running nix-store
+  warm_reconcile.py), all 9 infra services 1/1, no failed units, endpoints 200. Cycle broken by
+  construction. Only proxy/keycloak/sweep units rebuilt (nixpkgs pinned). Pushed BUILDER-INBOX with M2
+  evidence to unblock the loops. From-scratch *reboot* proof offered to operator, not yet done.