diff --git a/STATUS-1c.md b/STATUS-1c.md
index 3091331..fc2cac1 100644
--- a/STATUS-1c.md
+++ b/STATUS-1c.md
@@ -79,6 +79,15 @@ See JOURNAL-1c 2026-05-27 W2a entry for full evidence.
 **State:** `cc-nix-test` (MagicDNS) → **`100.97.167.73`** (rebuilt `ccci-w5-rebuild`); original cc-ci
 renamed `cc-nix-test-orig` @ `100.90.116.4`, **still running** (swap-back target). Public
 `ci.commoninternet.net` now served by the rebuilt VM (P2 verified 200/ssl_verify=0). Doing E2E-TESTME.
+**E2E progress (2026-05-27 ~19:45Z):** E1 PASS (public 200/ssl_verify=0). Original's bridge PAUSED
+(`ccci-bridge_app` 1/0 on cc-nix-test-orig). Rebuilt VM Drone OAuth done (admin=true, cc-ci active) —
+needed a script fix (auto-approve, committed ee585ef). **Clean-room finding (committed af46aca):**
+`DRONE_USER_CREATE` lacked `token:` → rebuilt Drone's bot token ≠ sops `bridge_drone_token` → bridge
+401. Fix injects the sops token. **NOT yet applied to the rebuilt VM** (a no-op rebuild ran with old
+config first). **NEXT:** (1) git pull af46aca on rebuilt VM + `nixos-rebuild switch` (applies token);
+(2) verify bot token == sops (else `docker volume rm` Drone DB + redeploy so DRONE_USER_CREATE recreates
+the bot w/ token; then re-run OAuth bootstrap); (3) run `!testme` on custom-html#2 (head db9a9502) →
+verify E2–E6; (4) swap-back; (5) re-deploy af46aca to cc-ci + re-verify byte-identical (Adversary re-checks C1).
 **`ssh cc-ci` (pinned 100.90.116.4) = the ORIGINAL** (cc-nix-test-orig); reach the rebuilt VM via
 `100.97.167.73` or `cc-nix-test` MagicDNS.
 **SWAP-BACK when e2e done:** rebuilt VM → `tailscale set --hostname=ccci-w5-rebuild`; then