docs: confirm web Docker release verified in production

docs/WEB_UX_REFINEMENT.md

@@ -28,4 +28,18 @@ Final integrated offline browser selection: **43 passed** in 70.91s:
 
 JavaScript syntax and diff whitespace checks passed. Independent read-only source/contract review initially found asynchronous ownership, hidden feedback, capability refresh and revision recovery issues; these were corrected with regressions and final review approved the scope. Earlier retry test failed because it asserted before the awaited retry finished; corrected to wait for completed state, not to remove behavior coverage.
 
-No production deployment, live API request, speech/device qualification or iOS parity implementation is claimed. Existing untracked design artifacts were left untouched.
+The initial refinement was qualified offline only. Production publication was subsequently authorized; see the deployment receipt below. No speech/device qualification or iOS parity implementation is claimed. Existing untracked design artifacts were left untouched.
+
+## Production release follow-up
+
+Published web commit `41ca590`, then corrected two real CI/shutdown defects discovered by production qualification:
+
+- Run 242 failed before build: a socket-backed runner checkout cannot be bound through the host Docker daemon. Commit `5a02b8f` streams `git archive HEAD` into the throwaway qualification container instead, excluding untracked runtime/secrets and retaining all tests.
+- Run 243 revealed SQLite close racing a cancelled `asyncio.to_thread` worker. Commit `ea4e191` serializes connection close with the shared database lock; deterministic regression safely rejects the original implementation and proves the terminal event persists. Packaging assertions follow the safe source-transfer mechanism.
+- Run 244's exact Python 3.12 offline qualification passed **148 tests** in 64.69s, with one unrelated Starlette/httpx deprecation warning. Theme artifacts verified. The [production run 244](https://git.srmr.xyz/snowspeeder/hope-voice-api/actions/runs/244) completed **successfully** at 2026-10-04 12:36 UTC, rebuilding speech/web, control and Hermes WebUI images and deploying through the protected rollback-preserving script.
+
+Production checks at `https://192.168.86.2:9178` verified all seven entrypoint assets (`index.html`, `style.css`, `app.js`, `chat.js`, `features.js`, `settings.js`, `hope-themes.css`) HTTP200 and byte-for-byte equal to release `ea4e191`. Anonymous `/api/auth/me` and POST `/token` both returned401. Fresh mobile Chromium at390px rendered the live login gate without browser errors or horizontal overflow. Qualification used an exception for the installation's existing self-signed certificate only; no production TLS policy changed.
+
+Actual Docker `voice` and `hope-control` were running with new images `9475f397d2e2…` and `db756e976829…`, started at12:36:15/12:36:10 UTC respectively. Voice health was `healthy`; control `/health` returned `{"status":"ok"}`. Protected account homes/runtime/certificates and timestamped rollback containers retained. No account credentials, chats, uploads or memory were read or changed for these live checks. No authenticated CRUD/voice/device success is inferred from static assets and health checks.
+
+Neither failed qualification run reached deployment; the original production containers stayed healthy.