diff --git a/scripts/cutover-checklist.md b/scripts/cutover-checklist.md
index 3a0a84c..0d457fc 100644
--- a/scripts/cutover-checklist.md
+++ b/scripts/cutover-checklist.md
@@ -9,8 +9,8 @@ Status: [x] = done, [ ] = pending
 - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
 - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
-- [ ] **Secrets**: Infisical not yet bootstrapped (profile: infisical — pending Phase 5 production)
-- [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`)
+- [ ] **Secrets**: Infisical not yet bootstrapped — blocked by Infisical v0.162.0 KMS migration bug (ERR_CRYPTO_INVALID_KEYLEN). SOPS fallback is active and working. Deferred pending upstream fix or version pin.
+- [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path).
 
 ## Cutover
 
@@ -27,7 +27,7 @@ Status: [x] = done, [ ] = pending
 - [x] **Agent activity**: `curl http://localhost:8090/api/v1/agent-activity` → returns data
 - [x] **Scheduler ticking**: 30s ticks logged
 - [x] **Notifier polling**: running
-- [ ] **Watchdog tested**: pending API stop + Matrix alert verification
+- [x] **Watchdog tested**: 2026-07-07 — API stop/reset cycle verified. Failure detection + counting + automatic reset all work. Crontab path fixed (was stale .claude/worktrees/goofy-austin-b648b8 path, now /Users/dtoro/Projects/oikos). Matrix alert path not tested — needs MATRIX_TOKEN for full end-to-end.
 
 ## Rollback drill