diff --git a/docs/verification/2026-10-07-persistent-account-session.md b/docs/verification/2026-10-07-persistent-account-session.md
index 4cb4e79b..9202cd59 100644
--- a/docs/verification/2026-10-07-persistent-account-session.md
+++ b/docs/verification/2026-10-07-persistent-account-session.md
@@ -109,3 +109,35 @@ the workspace, successful logout, returning-account starter exclusion/adoption,
 and a sibling tab opening while remote recovery was withheld. Together with the
 focused silent-refresh lane above, this exercises both ordinary automatic recovery
 and genuine authorization recovery through the actual app surfaces.
+
+## Production deployment
+
+Implementation commit: `a2063aab` (`fix(atproto): retain account sessions and consistent profile controls`).
+The companion SDK source is committed as `30fba22`.
+
+| Service | Immutable image digest | Machine | Version |
+| --- | --- | --- | --- |
+| `reams-ink-auth` | `sha256:4ccbec2947cd326038ce167d5af5a3ed99f4beb1398b20b2c3f8d0aad07fd509` | `857311c407d128` | 6 |
+| `reams-ink` | `sha256:d85085687e8a21befc8932fca1fd32aea176f2322f1cec3deab266dc21f25c1b` | `d8de469c51e268` | 12 |
+
+Nix tags: `reams-auth:csq2k469mj1rji3w2kivqcrx14jlxw84` and
+`reams-atmosphere:2if5l5dxklkw3cn4s3i5xlgx2gm63wkn`. The exact split images passed
+the real Docker/PostgreSQL lane: isolated read-only roles, configuration agreement,
+and broker-session persistence across auth restart. Auth rolled out before web.
+Both Fly machine health checks pass; production web/provider health endpoints pass.
+
+Prior public assets were materialized from the exact deployed version 11 digest
+`sha256:4b67b9e5f56e82a463476a84b2b9463b35dcad35dc16bbbff1da8784c199b7c7`.
+The new web image retains those assets. Production still serves
+`/assets/index-Bj61WJXQ.js` as JavaScript with its identical SHA-256
+`6575c3ad2f238bb3314e09a269d225e4622708545e5586a7a69a88bc65b9e7b5`.
+
+Fresh Chromium at `https://reams.ink/` opened the editor and account card, verified
+the shared 44px action controls with 8px/16px padding, and reloaded without page
+errors. Screenshot: `/tmp/opencode/reams-session-production.png`. Production smoke
+uses anonymous startup; authenticated account-lifecycle proof uses the real local
+services documented above.
+
+Commit reflection updated `problems.md` with causal browser-test timing checks,
+cross-repository review access, and the still-open ambiguous refresh-result recovery
+contract. `AGENTS.md` now explicitly requires a user release request before deployment.