memory+journal: cc-ci host rebuild procedure; pxgate M2 deployed + verified on live host

memory/orchestrator-backend-switch-gotcha.md

@@ -0,0 +1,27 @@
+---
+name: orchestrator-backend-switch-gotcha
+description: How to fully switch the cc-ci agent system between claude/opencode backends without the watchdog reverting it
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: fc17c9c2-ab6e-4c11-856e-a6a6e160a0ec
+---
+
+Switching the cc-ci agents between claude and opencode backends is NOT just editing the
+`.loop-*`/`.orch-model` files: **env overrides files** in `launch.py`/`launch-orchestrator.py`,
+and the **running watchdog** (`launch.py watchdog`) carries `LOOP_BACKEND`/`LOOP_MODEL`/`ADV_MODEL`
+in its OWN environment. Its `heal_orchestrator()` kills any orchestrator whose backend ≠ the
+watchdog's expected backend and relaunches it — so a half-switch gets auto-reverted within ~30s.
+
+**Why:** the watchdog is a long-lived process; it read its env at launch and re-applies it every tick.
+
+**How to apply (full switch):** (1) kill the watchdog session FIRST (`tmux kill-session -t
+cc-ci-watchdog`) so it stops healing; (2) rewrite ALL control files coherently — `.loop-backend`,
+`.orch-model`, `.loop-model`, `.loop-model-adv`, and any per-phase `.loop-model[-adv]-<phase>` that
+held opencode `provider/model` values (claude crashes on `--model openai/gpt-5.4`); (3) stop opencode
+(tmux sessions cc-ci-orchestrator/adv/builder + the `opencode serve` server on :4096 + orphan
+`attach` clients — note the `-oc` alt-session may be **root-owned**, needs `sudo`); (4) start the
+claude orchestrator via `cc-ci-plan/launch-orchestrator.sh start`; it runs its startup routine and
+relaunches loops+watchdog on claude. **Gotchas:** `pkill -f opencode`/`pkill -f "launch.py watchdog"`
+match your OWN command line and kill your shell — kill by exact PID or `tmux kill-session` instead.
+The [[launch-system-unification]] rework removes this footgun (config is the sole source of truth).