diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md
index 26e6d88e..558e7f2f 100644
--- a/deploy/MIGRATION.md
+++ b/deploy/MIGRATION.md
@@ -394,7 +394,7 @@ Compare to the retired AWS stack: 2× EC2 (t4g.large prod + t4g.medium/large dev
 
 ## 9. Sea Haven Gates & Obligations
 
-- [ ] **`/sh-plan-review`** (GPT-4.1 `cross_reviewer`) on THIS plan **BEFORE prod cutover** (Phase C gate). ⚠️ `run.py` misroutes reviewer-framed prompts to the no-op `done` route — call `models.get_cross_reviewer()` directly (load orchestrator `.env`, `ChatOpenAI("gpt-4.1")`) per `feedback_orchestrator_usage`.
+- [ ] **`/sh-plan-review`** (GPT-4.1) on THIS plan **BEFORE prod cutover** (Phase C gate). Runs via `python3 ~/Documents/repositories/seahaven/security-review/cross_review.py "<task>"` (the orchestrator repo was archived 2026-07-14; the CLI has no router, so the old misroute workaround is obsolete).
 - [ ] **`/sh-security-review`** on the sensitive surface: this migration touches **auth/webhook signature verification** (the custom `http.app` is now publicly reachable on `*.langgraph.app` with no platform gate in front) and **secrets handling** (secrets move from Secrets Manager to the Deployment/Vercel env). Required, not opt-in — resolve confirmed critical/high before cutover.
 - [ ] **GPT-4.1 cross-family review** if the Bedrock-auth fix changes IAM (new Bedrock-scoped IAM user + policy = IAM change → mandatory cross-review).
 - [ ] **Confluence** — rework "AWS Architecture Map" (**1540098**) + open-swe child page (**26116098**): replace the RDS/EC2/ALB subgraph with an external-services view (LangGraph Cloud + Vercel + retained GitHub App + LangSmith sandbox). Do it in the same conversation as the cutover, not as a follow-up.