status(M2-nixenv): deployed clean (system byte-identical to M1 review); real timer fire started — gitea LFS witness in flight

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/STATUS-nixenv.md

@@ -11,9 +11,21 @@ timer, and host `systemPackages` share ONE declaration (no duplicate `pyEnv`, no
 
 ## Gate: M2 — IN FLIGHT (deploy + live parity witness)
 
-Deploying `nixos-rebuild switch --flake /etc/cc-ci#cc-ci-hetzner` (live host = hetzner config;
-`/etc/cc-ci` @ d11f8f5). Then: host health, gitea `test_lfs_roundtrip` green under BOTH Drone path
-and a real timer fire, canon-style SKIP/promote unchanged.
+**Deploy DONE** @ 2026-06-17T17:34Z. `nixos-rebuild switch --flake 'git+file:///etc/cc-ci?submodules=1#cc-ci-hetzner'`
+(live host = hetzner; `/etc/cc-ci` @ d11f8f5). Deployed system `/nix/store/dhmpm232r6m0sq3s7y5r5jpyv5kxgzwi-nixos-system-…`
+is BYTE-IDENTICAL to the M1-reviewed local build. Health: `systemctl --failed` empty; deploy-proxy /
+warm-keycloak / swarm-init / drone-runner-exec all active; `nightly-sweep.timer` active;
+drone healthz + ci.commoninternet.net → 200. Live `cc-ci-run` = `zxlx9jnylh7la5m48bsqb1wfm5l9r0bd`
+(the M1-reviewed path); git-lfs/openssl/script/bash resolve on host PATH (openssl was MISSING pre-deploy).
+
+**Live parity witness — IN FLIGHT.** Diff scope: ONLY nix/ changed (dd6712c..d11f8f5: 5 nix files,
+zero runner/tests) → sweep SKIP/promote logic byte-identical to canon's PASSed sweep.
+- Real timer fire: `systemctl start nightly-sweep.service` @ 2026-06-17T17:35:38Z. The unit's systemd
+  PATH contains ONLY coreutils/findutils/gnugrep/gnused/systemd — NOT git-lfs, NOT /run/current-system/sw/bin
+  — so git-lfs MUST now resolve from cc-ci-run's runtimeInputs (the DEFECT-3 condition). ExecStart =
+  `gh02w1kc…-cc-ci-nightly-sweep` → execs `zxlx9j…/cc-ci-run`. gitea is RUN-eligible (canonical
+  3.5.3+1.24.2 < latest tag 3.6.0+1.24.2) → will exercise `test_lfs_roundtrip`. Awaiting completion.
+- Drone-path gitea witness: pending (after the sweep, to avoid the sweep's run-active defer).
 
 ### (prior M1 claim block retained below for the record)
 ## M1 details — PASS