diff --git a/cloudron-server-migration.md b/cloudron-server-migration.md
index 5af205b..cf718a4 100644
--- a/cloudron-server-migration.md
+++ b/cloudron-server-migration.md
@@ -339,3 +339,67 @@ by pre-cutover DNS plus port 25 — the point is that no *unexplained* failure a
   and writing it into this runbook as "the TTL" was wrong — the configured TTL was 3600 s
   all along. Query the zone at the registrar (or trust a fresh authoritative answer) for
   planning numbers.
+
+---
+
+# STATE OF PLAY — 2026-11-02 (read this first)
+
+Written for whoever picks this up next, including a fresh agent session with none of the history.
+
+## Mail: receiving on the box, sending through a relay
+
+- **Inbound port 25 is OPEN** (operator confirmed in the Infomaniak portal, 2026-11-01). 465/587/993/995
+  were opened too; 4190 is not offered and is not needed. **Outbound 25 is not required** — do not spend
+  a support ticket on it.
+- **Scaleway Transactional Email is proven working.** A real message relayed through it produced:
+  `spf=pass`, `dkim=pass … header.s=ede94f37-204c-41ee-b388-e940520316d1` (the UUID selector in the DNS
+  sheet — 2048-bit), `dmarc=pass policy.published-domain-policy=reject`, and
+  `iprev=pass (phan-van4.scw-tem.cloud)`. SPF carries `include:_spf.tem.scaleway.com`.
+- **BUT the newsletter does NOT use it yet.** Listmonk is still configured `host=mail, port=2465` — the
+  Cloudron mail app. It is in "copy settings from Cloudron" mode, so its own SMTP settings are overwritten
+  and the host keeps reverting (its `msg_retry_delay` does persist, which is a useful tell). **Do not
+  assume a newsletter sent through Scaleway; check the host before relying on it.**
+- The **portal** also still sends through the Cloudron mail addon (`CLOUDRON_MAIL_*`). Moving it to the
+  relay needs its own SMTP env vars plus a code change, deliberately not done yet.
+- **Consequence for the window:** the newsletter and the portal can only send **before** the box goes down
+  or **after** it comes back. Not during.
+
+## DNS: 11 records, two of them wildcards
+
+See `dns-change-sheet.md`, rebuilt 2026-11-01 from the registrar's panel. The important shape:
+
+- Only **11 records exist**. `*.inference.coop` A and AAAA carry **every application hostname** — chat,
+  portal, panel, dashboard, newsletter, gateway, vault, git, registry, files, forum, email, docs, my,
+  status. They are NOT individual records. **Move the wildcards or every app stays behind.**
+- `server.inference.coop` is an A record nothing documents. Identify before moving.
+- TTL is 3600 everywhere; lower it before the window.
+- **Never read a timeout from the agent host as "blocked"** (see the port-25 lesson in §7). The agent host
+  cannot observe outbound 25 at all.
+
+## Credentials: all off-box, all confirmed
+
+Cloudron backup passphrase, Infomaniak S3 `secretAccessKey`, and the Vault passwords are held externally
+by the operator (confirmed 2026-11-01). A restore is unreadable without the first two.
+
+## Not done yet
+
+- Cloudron **setup wizard on the new box** — still unsubmitted.
+- **No snapshot** on the new box (the tier includes one — free rollback point).
+- **No restore rehearsal** has been attempted.
+- `verify-restore.py` is fixed (both blind spots) and the baseline is fresh as of `267db1f`, committed to
+  this repo. Run it after any restore; its two remaining FAILs pre-cutover are the expected
+  "not migrated yet" signature.
+
+## CAUTION: two Matrix identities
+
+The backup contains Synapse **and its signing key**. Restore it and the new box becomes a second
+homeserver claiming the same server name as the old one, signing with the same key. Federation peers see
+one identity behaving as two. **Keep the restored apps stopped except while actively testing.**
+
+## The agent running this
+
+The steward bot runs on a **third machine** (`179.237.103.165`) — neither the old nor the new Cloudron
+box — so it stays up throughout. Its **primary model route goes through the gateway on the old box**
+(`gateway.inference.coop` → `179.199.135.72`) and will fail during the move; its **fallback is GreenPT
+direct** (`api.greenpt.ai`, `glm-5.3-flash`, `GREENPT_FALLBACK_API_KEY`), verified working 2026-11-02.
+Tooling that talks to `git.`, `gateway.` or `portal.inference.coop` will be unavailable mid-move.