docs(decisions): §4 weekly cron migrated to NixOS systemd timer (Sun 02:00 UTC)

Supersede the CronCreate/busybox notes: the weekly /upgrade-all now runs
via the reboot-safe cc-ci-upgrade-all systemd timer in the orchestrator
flake. Records the T0 PASS and the schedule move (Mon 23:04 -> Sun 02:00 UTC).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/DECISIONS.md

@@ -198,7 +198,16 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
 
 **V8a gap noted:** cc-ci-upgrader session self-terminates after run completion (Claude exits, tmux session closes). Plan requires "stays idle (does NOT self-terminate)." For weekly cron automation the behavior is correct (fresh start on each invocation). Operator UX gap: run summary not viewable at claude.ai/code after completion; summary is written to disk (`/srv/cc-ci/.cc-ci-logs/upgrades/upgrade-all-*.md`). Not fixed; tracked as known gap.
 
-**T0 fire verification:** pending (T0 = 23:04Z, ~55 min from cron install). Record result here once observed.
+**T0 fire verification:** PASS — T0 fired 23:04Z, Adversary-verified §4 cron PASS @23:20Z (build complete).
+
+**⚠️ SUPERSEDED 2026-06-02 — mechanism migrated to a NixOS systemd timer.** The CronCreate / busybox
+approaches above are both retired. The weekly upgrade now runs via a reboot-safe systemd timer
+(`cc-ci-upgrade-all.{service,timer}`) declared in the orchestrator flake
+(`nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix`), **OnCalendar=Sun *-*-* 02:00:00 UTC,
+Persistent=true** (operator moved the schedule from Mon 23:04 → Sun 02:00 UTC). It runs
+`launch-upgrader.py start` → `/upgrade-all` DEFAULT, timer-triggered only. This closes the boot/
+restart-durability gap noted above (the CronCreate job was in-memory/session-scoped and evaporated
+when the Builder session ended at sequence-complete). Next run: Sun 2026-06-07 02:00 UTC.
 
 ## Dead-ends
 - (none yet)