Status: A2-A6 and C done on production (release e0dc1b46fd99, public bind, Live wired, preflight PASS, drill passed); A4 not needed — 1936 answers from outside

ddiff --git a/STATUS.json b/STATUS.json
iindex dbfb98b..2b9a903 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -16,10 +16,18 @@
      "webrtc-sfu": "not ported (worker interface only)",
      "jsmpeg": "not ported (worker interface only)"
    },
--  "capabilities": ["openre.stream.read", "openre.stream.write", "openre.key.rotate", "openre.session.read", "openre.session.end", "openre.output.read", "openre.output.write"],
++  "capabilities": [
++    "openre.stream.read",
++    "openre.stream.write",
++    "openre.key.rotate",
++    "openre.session.read",
++    "openre.session.end",
++    "openre.output.read",
++    "openre.output.write"
++  ],
    "capabilitiesRegistered": true,
    "livePatch": "applied in Live f0ca18b and deployed, but inert: live.env has no OPENRE_URL/OPENRE_PUBLIC_URL/OPENRE_EVENTS_SECRET and there is no Events subscription openre.session.* -> Live; 102 of 102 Live slots have ingest_authority=live, so no broadcaster uses OpenRe",
    "deployed": true,
--  "deployment": "openvibe-ovh since 2026-09-23 ~02:45 UTC, internal only (not launched): /opt/openre.stream (current release 655b98a10aaa; 6dc78a5, an nginx-copy change, is not in a release yet), units openre-api (127.0.0.1:4500), openre-session-coordinator, openre-rtmp-ingest@655b98a10aaa (RTMP bound to 127.0.0.1:1936, not reachable from outside) and openre-restream-worker@655b98a10aaa, generation 1; DB /var/lib/openre/openre.db holds one rehearsal session and 0 destinations; one ffmpeg rehearsal passed (session live->ended, wrong key refused, openre.session.* in Events). https://openre.stream still serves the OpenVibe.Sites placeholder. To go public: 1936/tcp open at the firewall and provider edge (owner), OPENRE_RTMP_BIND public, then the per-slot cutover",
++  "deployment": "Production release e0dc1b46fd99 (2026-09-23 19:23 UTC): API + coordinator on 127.0.0.1:4500, RTMP ingest public on 0.0.0.0:1936 (ingest.openre.stream, DNS-only; reachable from outside), Live wired (OPENRE_URL, openre.session.* subscription), preflight all PASS, restore drill passed. No slot switched yet: every slot is still ingested by Live until the per-slot cutover (docs/cutover.md phase B).",
    "updated": "2026-09-23"
  }
ddiff --git a/docs/cutover.md b/docs/cutover.md
iindex 2293fbf..7dc5a08 100644
---- a/docs/cutover.md
++++ b/docs/cutover.md
@@@ -130,7 +130,7 @@ pf --only service,env,bind        # ready generation on $SHA; 0.0.0.0:1936 liste
    Remove the rule with the same line using `-D` instead of `-I`. Never enable ufw for this: it has
    no rule for SSH on this host.
  
--### A4. Open 1936/tcp at the provider edge (OWNER)
++### A4. Open 1936/tcp at the provider edge (OWNER) — not needed: 2026-09-23 19:24 UTC the off-host check passed as soon as the public bind was up
  
  Open **1936/tcp inbound** to `15.204.79.215` in the provider's network firewall, the same place that
  already allows 1935. The host firewall (ufw) is inactive and needs nothing. The DNS record