diff --git a/.claude/memory/ai-handover.md b/.claude/memory/ai-handover.md
index 82d2241..7b08c89 100644
--- a/.claude/memory/ai-handover.md
+++ b/.claude/memory/ai-handover.md
@@ -18,15 +18,19 @@ git status --short                  # uncommitted work may be the real current s
   `f03d547` R6 crossfades, `67bdf68` R7 bold overlays, `407f6b5` Tier-2 caption-driven selection, `a2a7d7d` R8
   music swell, `4d2cea1` fix music-cut-off-early (separate video/audio crossfade passes), `9fb24e8` R6 speed-ramp.
   **The cinematic ruleset R1–R9 (docs/cinematic-quality-rules.md) is COMPLETE.**
-- **Then production-hardening started (recorded HEAD `452bab6`):** `31efe33` CI (.github/workflows/ci.yml) + README,
-  `430d71f` render-approval gate on `POST /v1/edit-projects/{id}:render` (config `require-render-approval`,
-  default true, returns 409 without `approved.flag`), `452bab6` Dockerfile + .dockerignore (app image, models
-  mounted at runtime; NOT build-validated — no Docker daemon here). `mvn -o verify` (with the tmpdir workaround)
+- **Then production-hardening started (recorded HEAD `fd22412`):** `31efe33` CI (.github/workflows/ci.yml) +
+  README, `430d71f` render-approval gate on `POST /v1/edit-projects/{id}:render` (config `require-render-approval`,
+  default true, 409 without `approved.flag`), `452bab6` Dockerfile + .dockerignore (models mounted at runtime;
+  NOT build-validated — no Docker daemon here), `c323523` Maven Wrapper (pins Maven 3.9.9; CI uses `./mvnw`),
+  `fd22412` ported the e2e runbook + local-model facts into repo docs (`docs/RUNBOOK-highlight-e2e.md`,
+  `docs/LOCAL-MODELS.md`) so any AI/human reading the repo has them. `mvn -o verify` (with the tmpdir workaround)
   = 271 tests, 0 failures, coverage met.
-- **Still remaining (large / decision-gated):** commercial licensing (P5.7 — audio models are CC-BY-NC), full
-  authN/Spring Security, PostgreSQL/Testcontainers, container build+no-egress certification, and a formal human
-  Gate-B review (P5.6). A pinned Maven Wrapper is also a small follow-up (the wrapper plugin wouldn't provision
-  offline here).
+- **Production-readiness verdict (honest, 2026-07-24):** the output is a technically-clean, much-improved
+  cinematic DRAFT, NOT a certified production deliverable. Blockers: no blinded human creative Gate-B review has
+  passed; source is 576p (soft when upscaled); music is generic musicgen-small; VLM weak on distant subjects;
+  audio models are CC-BY-NC (non-commercial). Do not claim production-ready on technical probes alone.
+- **Still remaining (large / decision-gated):** commercial licensing (P5.7), full authN/Spring Security,
+  PostgreSQL/Testcontainers, container build + no-egress certification, and the formal human Gate-B review (P5.6).
 - **Env note (2026-07-24):** the sandbox began denying the default `$TMPDIR` and socket binds mid-session; see
   [[highlight-e2e-render-runbook]] for the java.io.tmpdir + dangerouslyDisableSandbox workarounds.
 - If HEAD is newer than `8b68116`, or there are unfamiliar commits/uncommitted files, **this file is behind