docs: record the DNS cutover as complete; flag the old box as an unresolved internet exposure

- Migration addendum: replace the 'DNS split' wording with the verified state —
  every hostname resolves to the new box (A+AAAA) per Cloudflare's public
  resolver; nothing points at the old box.
- Reframe the old box: not a benign rollback spare but a decommissioned server
  still alive and internet-exposed (22/80/443/587/993 open), holding old data and
  config, serving no member traffic. UNRESOLVED — operator decision to shut it
  down or firewall it. Do not act on it without the operator's word.
- README: add a 'Known open items' section listing the exposure, the CI failure,
  the unpushed CI-agent repo and the unconfirmed member mailbox contents.

README.md

@@ -56,6 +56,21 @@ answers proves nothing about whether a record exists. At least two listed
 records turned out not to exist, and the real record inventory is only visible
 in the registrar's own list.
 
+## Known open items — recorded, not hidden
+
+These are genuinely unresolved; a tidy document that omits them would be wrong.
+
+- **The old box `179.199.135.72` is still alive and internet-exposed** (22/80/443/587/993
+  open), holding old data and config. Nothing in DNS points at it, so it serves no
+  member traffic — but it needs an operator decision: **shut it down or firewall it**.
+  Do not act on it without the operator's word. See `migration/cloudron-server-migration.md` (addendum).
+- **CI is not green.** The Woodpecker agent is healthy but the server answers its
+  job-collection stream with HTTP 500, so no pipeline can run. See `maintenance/woodpecker-ci.md`.
+- **The CI agent image source (`/home/ubuntu/repos/woodpecker-agent`) has no git
+  remote** — it exists only on the agent host.
+- **Member mailbox contents after the migration** are still unconfirmed (needs a
+  real IMAP login).
+
 ## No secrets here
 
 Audited 2026-11-01, including the full commit history: no credentials, tokens,

migration/cloudron-server-migration.md

@@ -529,36 +529,47 @@ state at cutover, not today.
 | Woodpecker CI server | `ci.inference.coop` | `4984f95e-0c0a-4af3-9ce1-4ca4f3e8483d` |
 | Woodpecker CI agent (custom) | `ci-agent.inference.coop` | `5ac63873-cf2c-4ad9-acd6-81dc0e016c83` |
 
-## The DNS "split" is resolved — no hostname is served by the old box
+## The DNS cutover is COMPLETE — no hostname is served by the old box
 
-At one point `chat.inference.coop` and `portal.inference.coop` were observed still
-resolving to the **old** box (`179.199.135.72`) while `gateway`/`my`/`docs` were on
-the **new** box (`179.237.86.116`). **As of 2026-11-04 there is no such split:**
-every hostname — `chat`, `portal`, `gateway`, `my`, `docs`, `ci`, `ci-agent`,
-`matrix`, `git`, `www` and the apex — resolves to the **new** box.
+At one point `chat.inference.coop` and `portal.inference.coop` were *reported* as
+still resolving to the **old** box (`179.199.135.72`). **That observation was
+stale and the split does not exist.** Verified 2026-11-04 against an external
+resolver (Cloudflare, `@1.1.1.1`): **every** hostname — apex, `my`, `chat`,
+`portal`, `gateway`, `docs`, `ci`, `newsletter`, `git` — resolves to the **new**
+box `179.237.86.116` with **both A and AAAA**
+(`2001:1600:18:206::89`). No hostname resolves to the old box, and nothing in DNS
+points at it. `chat.inference.coop` serves LibreChat and `portal.inference.coop`
+returns the portal from the new box.
 
-The zone is **wildcarded**, so a resolving name proves nothing by itself. The
-decisive fact: a **made-up** hostname (`zzznope.inference.coop`) also answers the
-**new** box `179.237.86.116` at the authoritative nameservers (`ns1.yoursrs.com`).
-That means the **wildcard itself now points at the new box**, so no name is being
-served by the old box via the wildcard either.
+The zone is **wildcarded**, so a resolving name proves nothing on its own — but a
+made-up hostname (`zzznope.inference.coop`) also answers the **new** box at the
+authoritative nameservers, so the wildcard itself now points at the new box.
 
-## The old box still exists (rollback), and serves nothing
+## ⚠️ UNRESOLVED (operator decision): the old box is still alive and internet-exposed
 
-- `179.199.135.72` is **still powered on** and answers on 22/80/443/587/993, **but
-  it hosts no running app.** A request with `Host: chat.inference.coop` returns
-  Cloudron's **"app down / Not Found" fallback page**, and its TLS certificate has
-  an **empty subject** — the signature of a Cloudron whose vhost's app is stopped,
-  exactly as documented ("powered on with apps stopped").
-- **No DNS reference points at it**, so it receives no real traffic.
-- **Decommission is still pending** — this is the one open item from the cutover
-  that has not happened. Its backup schedule must remain **disabled** while it is
-  kept (two boxes on one S3 bucket interleave and prune each other's backups).
+`179.199.135.72` is **powered on, reachable from the internet, and unaltered.** This
+is not "a spare kept for rollback" — it is a **decommissioned server still running
+and still exposed.**
+
+- **Open to the internet (verified 2026-11-04):** ports **22, 80, 443, 587, 993**
+  answer. (3306/5432/8080 are closed.)
+- It answers HTTPS **for any Host header** with a **generic Cloudron-served page**
+  (its fallback / "app down" page, empty-subject certificate) rather than a real
+  app — because its apps are stopped.
+- **It still holds whatever old data and configuration it had** — the old Cloudron
+  platform, its app data, and its host config are all present on the disk.
+- **Nothing in DNS points to it**, so it serves **no member traffic** — the exposure
+  is the open ports and the retained data/config, not live traffic.
+
+**Decision needed from the operator:** either **shut it down**, or **firewall it**
+(close all but what is genuinely needed) if it is being kept as a rollback. It is
+NOT the steward's to act on: **do not shut it down or change anything on it without
+the operator's word.** Its backup schedule must stay **disabled** while it is kept
+(two boxes on one S3 bucket interleave and prune each other's backups).
 
 ## Still unresolved / for the operator
 
-- **Decommission the old box** (`179.199.135.72`) when rollback is no longer
-  wanted, after confirming the new box's backups are proven.
+- **The old box's exposure** — see above. Shut down or firewall.
 - **Member mailbox contents** — the long-standing unknown from §7 (whether
   members' mail is inside the Cloudron backup) still needs a real IMAP login to
   confirm.