docs: clarify server checkout preparation for cutover

TANGLED-MIGRATION.md

@@ -115,10 +115,23 @@ Do not garbage-collect the server store between staging and activation.
 The signature exception applies to this one root-authorized import, not to
 persistent Nix configuration. Importing and rooting paths do not activate them.
 
-After committing the encrypted secret on the server if necessary, pull the
-configuration with `git pull --ff-only` in `/etc/commonscomputing-nix`. Do not
-overwrite unrelated DNS edits. Activation below uses the exact built path,
-not a fresh flake evaluation or update.
+The encrypted secret and recipient rule are already committed upstream.
+The server currently has the same edits locally, including a staged new file.
+Preserve those edits in a path-limited stash before pulling; do not create
+another secret commit and diverge the server branch again:
+
+```sh
+git -C /etc/commonscomputing-nix stash push \
+  -m 'pre-cutover encrypted secret backup' -- secrets/knot-env.age secrets/secrets.nix
+git -C /etc/commonscomputing-nix pull --ff-only
+sha256sum /etc/commonscomputing-nix/secrets/knot-env.age
+```
+
+The encrypted file's SHA-256 should remain
+`b26f36d098a337a98217aa4e73d2f39eb4e8864337dfcface937093f5557f0ac`.
+Keep the stash until cutover is verified; do not pop it over the incoming
+identical secret. The path-limited stash leaves unrelated DNS edits alone.
+Activation below uses the exact built path, not a new flake evaluation/update.
 
 ## Decrypt And Rehearse With The Persistent Key