v3.4.1

Changed

• Upgrade the Web dashboard to Basalt 3.2.1, including its focus and container-boundary refinements.
• Move Web deployment to the pinned shared Docker CD workflow: successful main CI builds GHCR images and deploys an immutable digest to jp2.
• Complete the pew.md cutover with Full (strict), shared authenticated origin pulls and validated Caddy hot reloads; retain the stopped Railway service and its recovery records.
• Document private and public acceptance, native Cloudflare-edge IPv6 checks, and phase-aware routing and stopped-Railway recovery procedures.
• Keep CLI, core and Workers at their independent 3.3.3 versions; this Web-only release does not publish npm or redeploy Workers.

Fixed

• Build the standalone Web image without application credentials and inject the unchanged application variables only at runtime.
• Verify image digest, source revision, runtime version and database health during deployment, with credential-free native/startup container smoke checks.
• Reject isolated unsafe Docker smoke-test arguments and NODE_OPTIONS assignments with independent mutation controls.

Verified Deployment

• Source: 6a5879c46283f1b1d90fd2245cc908375587f350.
• Exact-revision CI and automatic Docker CD passed.
• jp2 image: ghcr.io/nocoo/pew@sha256:e3a491220bacb0aaba3d6977de68a26c6689f1d61424ae0b39dfca83b6b17370; the CI artifact, host manifest, running container and OCI source labels agree.
• Public health returns HTTP 200, X-Pew-Origin: jp2, Web 3.4.1 and database.connected=true. Public pages/assets, authorization denials and both real IPv4 and Cloudflare-edge IPv6 addresses passed read-only checks.
• Shared Caddy configuration/start time and runtime-file metadata are unchanged. Railway remains stopped with no active deployment and its recorded rollback digest preserved; restoration was not exercised.
• This release does not reset or upload from the production CLI, publish npm, redeploy Workers, or change DNS/TLS/AOP. Fresh Google login remains owner-waived, not tested.