diff --git a/doc/mainnet-cutover.md b/doc/mainnet-cutover.md
index bbc3a18..3b8b79b 100644
--- a/doc/mainnet-cutover.md
+++ b/doc/mainnet-cutover.md
@@ -30,8 +30,11 @@ on mainnet — decided 2026-09-09.
    - `expected_genesis`: the published 0x hash
    - `bootnodes`: the multiaddrs, space-separated
    Validate must print `genesis matches expected` and
-   `miner credentials present under chains/<id>/`. A genesis mismatch rolls
-   back to the previous binary and config, and planck resumes. Note `<id>`.
+   `miner credentials present under chains/<id>/`. A genesis mismatch fails
+   the run and leaves the node on the wrong spec: re-dispatch with
+   `node_version: 0.11.1` and every other input empty to return to planck
+   (the node deploy has no automatic rollback; the miner deploy does).
+   Note `<id>`.
 3. **Miners.** Dispatch quantus/miner `deploy` with `chain: <id>`. The binary
    is unchanged; the new token and TLS pin trigger the checksum-gated restart.
    Validate waits for the miner to connect and for the hash counter to move.
@@ -59,7 +62,10 @@ on mainnet — decided 2026-09-09.
 
 ## Rollback
 
-The node deploy keeps `quantus-node.prev` and the previous `node.env`; a
-failed validate restores both and restarts. Miners stay on planck credentials
-until step 3 succeeds, so a failed node cutover leaves them idle-reconnecting,
-not mining a wrong chain.
+Node: no automatic rollback. A failed validate leaves the new binary and
+config in place; re-dispatch with the previous `node_version` and empty
+spec/genesis/bootnodes to return to planck (planck's state under
+`chains/planck/` is untouched by a mainnet attempt, which lives under its own
+spec id). Miners: keep planck credentials until step 3 succeeds, so a failed
+node cutover leaves them reconnecting, not mining a wrong chain; the miner
+deploy itself restores `quantus-miner.prev` on a failed validate.