diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9c25fff..ebba0a30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,14 @@
 # CHANGELOG
 
-## 2026-10-21 — Browser resilience and navigation (prepared)
+## 2026-10-21 — Browser resilience and navigation (published)
+
+- PR #137 merged at `0ec918a897ee356d643afbd86c8957d84369c809`.
+  Production run `39649211670` succeeded; Vercel deployment
+  `dpl_5NcpUBPmGWf1KsBs4gGqwP13cV4b` was READY with matching public manifest.
+  The served EN/ES desktop/mobile app passed native readback and isolated
+  storage, favorites, keyboard and metadata fixtures. Fresh local build,
+  118 unit tests and full npm test passed; production checked 402 navigations
+  with the current snapshot. Eight moderate audit entries remain.
 
 - Keep the app usable when browser storage is blocked or contains malformed
   preferences. Validate saved favorites and language/theme values; show an
diff --git a/ROADMAP.md b/ROADMAP.md
index c4039092..5b219407 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -25,12 +25,12 @@ cross-border experience; it is a product hypothesis, not a claim of demand.
   Production commit `f55167b6`, Actions run `39561576557`, manifest and served
   EN/ES desktop/mobile app were verified October 21. Eight moderate audit
   package entries remain; no usage or conversion increase is established.
-- [~] Prepare bounded browser-storage, keyboard-navigation and route-metadata
-  corrections from the October 21 audit. Local build, 118 unit tests and full
-  npm test passed. The isolated local commit and patch are ready for review;
-  publishing this follow-up needs separate owner approval.
+- [x] Publish bounded browser-storage, keyboard-navigation and route-metadata
+  corrections (PR #137, merge `0ec918a8`). Production run `39649211670`,
+  deployment manifest and served EN/ES desktop/mobile behavior were verified
+  October 21. Fresh build, 118 unit tests and 402 route navigations passed.
   Broader schema lifecycle, assistive-technology and cross-browser audits
-  remain separate work.
+  remain separate work, alongside the eight moderate audit entries.
 
 - [~] QC the October 13 locality-first flow, shareable area URLs and familiar
   crossing names, with a visible inline camera entry on the homepage. Deliver
diff --git a/docs/REFRESH-OPERATIONS.md b/docs/REFRESH-OPERATIONS.md
index 9e958479..83d41a68 100644
--- a/docs/REFRESH-OPERATIONS.md
+++ b/docs/REFRESH-OPERATIONS.md
@@ -1,5 +1,38 @@
 # Public data refresh
 
+## Browser resilience release — 2026-10-21 UTC
+
+- After the owner approved the precise follow-up batch, its single authorized
+  push retry succeeded. [PR #137](https://github.com/sbc1-code/borderpulse/pull/137)
+  merged approved head `2c9c8bde2ac75f03926da7c16b63a92745597fe8` at
+  `0ec918a897ee356d643afbd86c8957d84369c809`. Both CI checks passed.
+- Existing production [run 39649211670](https://github.com/sbc1-code/borderpulse/actions/runs/39649211670)
+  succeeded without another dispatch. Vercel deployment
+  `dpl_5NcpUBPmGWf1KsBs4gGqwP13cV4b`,
+  `borderpulse-rep22mxmn-sbc1-codes-projects.vercel.app`, was READY with the
+  same source and existing apex/www aliases. Public publication.json matched,
+  prepared `2026-10-21T18:03:30.542Z`, with 42 crossings and 2,422 historical
+  observations. The separate live API returned HTTP 200 with 42 crossings.
+- Native EN/ES desktop/mobile readback confirmed the coordinate disclosure,
+  comparison route and viewport fit. Isolated synthetic browser fixtures
+  against the served bundle passed blocked reads/quota, malformed favorites,
+  successful/failed persistence, retained language, keyboard skip/Escape and
+  route metadata cleanup. Fixtures did not modify the public feed or use the
+  owner's browser profile, location or other task tabs. The shared browser
+  remains available; the task-owned headless process closed after checks.
+- Fresh local build and 118 unit tests passed. Full local and production npm
+  test each passed 402 navigations with the current snapshot's 171 canonical
+  routes and 29 aliases. Route capability rules did not change. The eight
+  moderate audit entries remain, with zero high/critical and no gate bypass.
+- CI also annotated actions/upload-artifact@v4's Node.js 20 runtime deprecation
+  and the ubuntu-latest image migration. No workflow, credential, permission,
+  security setting, ad or paid-service change was made. Preserve the existing
+  dependency follow-ups; limited checks do not certify complete security or
+  accessibility or establish SEO/conversion improvement.
+- The original operator checkout's 18 changed paths, generated files and newer
+  duplicate local files were preserved. Release evidence is this runbook,
+  PR #137 and the existing Drive Current Focus checkpoint, not a new tracker.
+
 ## Compare and Vite release — 2026-10-21 UTC
 
 - [PR #136](https://github.com/sbc1-code/borderpulse/pull/136) merged at