diff --git a/docs/CUTOVER-MAIN-ONLY.md b/docs/CUTOVER-MAIN-ONLY.md
index 12820206..a2559166 100644
--- a/docs/CUTOVER-MAIN-ONLY.md
+++ b/docs/CUTOVER-MAIN-ONLY.md
@@ -1,23 +1,19 @@
 # Cutover checklist (main-only + gated deploy) — human, once
-#
-# After merging the CI cutover PR to main:
-#
-# 1. Repo secrets (Settings → Secrets and variables → Actions):
-#    - VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID
-#    - POOL_GITHUB_TOKEN (PAT: actions:write, issues:write, contents:read)
-#
-# 2. Branch protection:
-#    pnpm configure:branch-protection
-#    (main: required checks `checks` + `migration-lock`, strict=false, 0 reviews)
-#    Optionally remove protection from `stage` and delete the branch when idle.
-#
-# 3. Open PRs still targeting `stage`:
-#    gh pr list --base stage
-#    Retarget each to main (`gh pr edit <N> --base main`) or merge/close first.
-#
-# 4. Validate:
-#    - Push/no-op on main → Vercel Git build SKIPPED (ignoreCommand exit 0)
-#    - ci.yml runs full suite; deploy job runs (or fail-closed if Vercel secrets missing)
-#    - agent-pool doctor: `POOL_GITHUB_TOKEN=… pnpm agent:pool -- doctor` reads variables
-#
-# See docs/AGENT-OPS.md.
+
+Status after agent delivery (2026-07-31):
+
+- [x] Code PR opened (main-only cutover) — see PR targeting `main`
+- [x] `pnpm configure:branch-protection` applied on `main` (required: `checks` + `migration-lock`, `strict=false`, 0 reviews)
+- [x] No open PRs targeting `stage` at cutover time
+- [ ] Repo secrets still needed:
+  - `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` (deploy job fail-closed until set)
+  - `POOL_GITHUB_TOKEN` (PAT: `actions:write` + `issues:write` + `contents:read`) — `PROMOTE_GITHUB_TOKEN` already exists; reuse/rename if scopes cover Actions variables, else mint a new PAT
+
+After the cutover PR merges to `main`:
+
+1. Validate Vercel Git skip: push to `main` must **not** start a Vercel Git build (`ignoreCommand` exit 0). Production comes only from `ci.yml` → deploy.
+2. Confirm `ci.yml` runs full suite; deploy job runs or fails closed with a clear missing-secrets message until `VERCEL_*` are set.
+3. `POOL_GITHUB_TOKEN=… pnpm agent:pool -- doctor` must read repo variables.
+4. Optionally delete branch `stage` and its Environment/secrets when idle.
+
+See [AGENT-OPS.md](AGENT-OPS.md).