fix: complete production data migration rehearsal

docs/operations/production-server-migration-2026-08.md

@@ -117,6 +117,7 @@ The operator supplies these values only on the trusted migration host; do not st
 - `SUPABASE_SOURCE_DATABASE_URL`: the consistent read-only Supabase snapshot/source URL;
 - `PRODUCTION_TARGET_DATABASE_URL`: the PostgreSQL 17 target URL using the migration role;
 - `PRODUCTION_OWNER_USER_ID`: the UUID of the designated active source administrator;
+- `PRODUCTION_OWNER_EMAIL`: the canonical email that must match that UUID in source `auth.users`;
 - `PRODUCTION_CIPHERTEXT_MODE=preserve|exclude`; preserve additionally requires `PRODUCTION_CIPHERTEXT_KEYS_CONFIRMED=true`.
 
 Run each phase separately and retain its redacted JSON manifest:
@@ -136,7 +137,9 @@ Because migrated users have no portable password/session, all sessions are inval
 
 ## Rehearsal
 
-Complete at least one isolated full-data rehearsal before scheduling the final window:
+On 2026-08-09, an isolated PostgreSQL 17 rehearsal completed `--preflight`, `--apply`, and `--verify` against a read-only production Supabase transaction. It reconciled 85 identities and all 18 selected non-empty/seeded legacy public tables by count, primary-key hash, normalized row hash, credit totals, consultation states, and rectification counts. This is rehearsal evidence only; it does not authorize the final write freeze, production import, or DNS change.
+
+Complete the remaining runtime and restore rehearsal before scheduling the final window:
 
 1. Apply all target schema migrations to an empty rehearsal database using the same schema migrator path as `Migrate Production Database`.
 2. Run migration preflight, apply, post-import reconciliation, and verify.