diff --git a/docs/hux/HANDOFF.md b/docs/hux/HANDOFF.md
index 1903b8ac..2ab5074d 100644
--- a/docs/hux/HANDOFF.md
+++ b/docs/hux/HANDOFF.md
@@ -540,3 +540,29 @@ Remaining: HUX-12 Vault key (operator); re-enforcement canary (approvals UX
 now exists - operator tries the prompts, then canary re-enable per checklist);
 worker HUX activation flip (WORKER-PLAN TODO 2); cluster_read handler
 hardening activates on the next pod roll.
+
+
+## Final webui build-29 live + verified (2026-08-24)
+
+All tenants on webui build-29 (sha256:6887c2ad, source 4d93ef5a), verified in
+the served bundle: Workspace toggle in the nav (desktop rail + mobile
+titlebar via navIconToggle/titlebarHost, no composer-obstructing floating
+pill - fixed the mobile regression that pushed the input controls off
+screen); conversation orb watermark = the Hermes CHARACTER avatar
+(hermes-agent-192.png), staff SVG removed; 'hands-free' renamed to
+'Conversation mode'; reply-language routing density-gated
+(resolveReplyLanguage) so English no longer gets a foreign voice. Also
+carries: interim-ack tail flush, natural thinking fillers, one unified audio
+sink + output-device selector, the 'Something went wrong' error-veto, and
+the cluster_read large-listing fix.
+
+STT: large-v3-turbo is live for accuracy (already correcting proper nouns);
+the beam-2 + name-prompt tuning is pending a successful hermes-voice-image
+(stt) build - the build keeps failing on an IPv6 route to azureedge while
+downloading the Whisper models (a more persistent flake than the ghcr.io
+DNS one). Durable follow-up recommended: mirror the ghcr.io webui base image
+and the Whisper models into registry.bstein.dev so builds stop depending on
+external DNS/IPv6 (3 webui + 3 stt builds lost to these flakes).
+
+Gated on the operator: HUX-12 Vault evidence key; re-enabling enforcement
+(approvals UX is live); worker HUX activation flip.