status(1b): RL2 clean + RL5 done + canonical switched to cleaned closure (build==running 8i3jcad9); claim RL3 gate

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL-1b.md

@@ -96,3 +96,40 @@ Adversary's RL2 confirmation. Findings over the post-W0 (cleaned) codebase:
 **No blocking finding; nothing to fix; no advisory item to file.** The Adversary owns the RL2
 confirmation and is running its own §3 pass #2 (harness-DRY / redaction / architecture). Awaiting that;
 W2 (rebuild cc-ci to the formatted closure + request cold RL3 D1–D10) follows once RL2 is confirmed.
+
+## 2026-05-27 — RL2 clean + RL5 (nix/ consolidation) + W2 switch to cleaned closure
+
+**RL2 (Adversary §3 pass #2):** no blocking findings; 2 advisories — (a) `old_app` upgrade-fixture
+copy-paste across recipes → triaged to IDEAS (per-recipe upgrade tests are by design; sharing is a
+nicety, not a DRY-blocker); (b) app-secret redaction: the `cc-ci-run` Drone step path isn't wrapped by
+`run_stage_redacted`, so the Adversary will re-run the behavioral D6 leak test at RL3 (grep published
+Drone logs + dashboard for a known generated app password). My Builder §3 self-review agreed (no
+blockers). W1 is light/clean.
+
+**RL5 — consolidate Nix code under `nix/`** (operator item, plan §7). `git mv modules nix/modules`,
+`git mv hosts nix/hosts`; flake.nix/flake.lock stay at root (`#cc-ci` unchanged); only flake's
+internal configuration.nix path + the moved modules' root-relative refs changed (`../X`→`../../X`).
+Built on cc-ci → toplevel `8i3jcad9…` **byte-identical to the pre-move build** (content-addressed;
+module .nix not in the runtime closure). Living docs + `.drone.yml` comment updated to `nix/…`.
+
+**W2 — switched canonical cc-ci to the cleaned+RL5 closure** so `build == running` (required before
+RL3: a fresh clone builds `8i3jcad9`; running had to match or the byte-identical-to-running check
+would fail). Re-synced `/root/cc-ci` to HEAD, `nixos-rebuild switch --flake 'path:/root/cc-ci#cc-ci'`:
+```
+stopping units: deploy-bridge.service, deploy-dashboard.service
+sops-install-secrets: Imported …ssh_host_ed25519_key as age key (age1h90utdz…)
+starting units: deploy-bridge.service, deploy-dashboard.service
+```
+Post-switch health (all green):
+- `readlink /run/current-system` → `8i3jcad9mrr01558lqckpi26nxn2ra3m-…` (== fresh-clone build; was
+  `cqym8knjg7…` pre-format).
+- `systemctl is-system-running` → `running`, **0 failed**. deploy-bridge/deploy-dashboard `active`.
+- 5 stacks up (backups, ccci-bridge, ccci-dashboard, drone, traefik); `ccci-bridge_app` + 
+  `ccci-dashboard_app` 1/1 with NEW content-hash image tags (reformatted source redeployed).
+- Public via SOCKS proxy → gateway → cc-ci: `https://ci.commoninternet.net/` → **200**
+  (`<title>cc-ci — Co-op Cloud recipe CI</title>`); `/badge/custom-html.svg` → **200**.
+
+Net: RL1 PASS, RL2 clean, RL4 docs landed (README lint section + architecture.md `nix/` layout),
+RL5 done + healthy, running==build==`8i3jcad9`. Remaining for DONE: **RL3** (Adversary cold D1–D10
+re-verify, now also covering the RL5 byte-identical rebuild) and **RL6** (coordinated machine-docs/
+move — LAST, with orchestrator lockstep). Claiming the RL3 gate.