- Migration addendum: replace the 'DNS split' wording with the verified state —
every hostname resolves to the new box (A+AAAA) per Cloudflare's public
resolver; nothing points at the old box.
- Reframe the old box: not a benign rollback spare but a decommissioned server
still alive and internet-exposed (22/80/443/587/993 open), holding old data and
config, serving no member traffic. UNRESOLVED — operator decision to shut it
down or firewall it. Do not act on it without the operator's word.
- README: add a 'Known open items' section listing the exposure, the CI failure,
the unpushed CI-agent repo and the unconfirmed member mailbox contents.