Record verified coming-soon cutover and rollback procedure

PRODUCTION.md

@@ -31,3 +31,21 @@ At launch, set `MAGENT_COMING_SOON=false` and `BACKGROUND_TASKS_ENABLED=true`,
 then recreate the container. External service records can then be imported through
 normal synchronization; no beta client data is migrated. Review quality profiles,
 root folders, invite policy and notification rules in admin settings before use.
+
+## Initial cutover — 7 September 2026
+
+- Public HTTPS cover and `/api/health` verified after cutover.
+- Caddy: AMS-CAD01, `/etc/caddy/Caddyfile`, systemd `caddy.service`.
+- SSH worked via `10.30.40.254` using `HostKeyAlias=10.30.41.254`.
+- Only the `magent.grizzlyflix.co.nz` upstream changed, from
+  `10.30.1.81:3002` to `10.30.1.32:3200`. Both beta blocks were unchanged.
+- Rollback configuration: `/etc/caddy/Caddyfile.bak-magent-prod-20260907T0130`.
+  Restore it, run `sudo caddy validate --config /etc/caddy/Caddyfile`, then
+  `sudo systemctl reload caddy`. Review subsequent edits before restoring the
+  whole file; the old application was not stopped or deleted.
+- Initial database: one newly generated bootstrap admin; zero invites, issues,
+  cached requests, actions or snapshots. Login smoke-testing subsequently creates
+  normal admin login activity only.
+- Retrieve `/home/zak/magent-production/bootstrap-admin.json` securely on
+  AMS-DEV01. Sign in at `/login`, then open `/admin` while the cover is active.
+- No SMTP message was sent as part of validation. Background jobs remain paused.