docs: record final local dev verification

docs/verification.md

@@ -1,8 +1,63 @@
 # Who Need Help — implementation verification
 
-Observed through 2026-07-22 in the local workspace. This report separates observed
+Observed through 2026-07-23 in the local workspace. This report separates observed
 results from product limits and unknown production properties.
 
+## Local dev hardening audit on 2026-07-23
+
+These observations apply only to the local checkout, its Compose project, and
+`https://whoneedhelp.imalto.site`. No push, test/production deployment, Devpost
+edit, branch, or tag was made during this audit.
+
+- The final `./scripts/quality.sh` run passed ShellCheck, Hadolint at the
+  configured threshold, actionlint, every Compose render, Prometheus and
+  Alertmanager validation, Helm lint, Trivy source and image scans, formatting,
+  compilation, xref, strict Credo, Sobelow, Dialyzer, Hex audit, both npm audits,
+  and all 341 ExUnit tests. The configured image scans reported zero
+  vulnerabilities, and the run left no project-scoped quality containers,
+  networks, volumes, or one-run image tags.
+- Two web and two worker replicas, PostGIS, Mailpit, Traefik, and the scoped
+  Docker socket proxy were running after the audit. Both web replicas and both
+  workers were healthy; public liveness and readiness returned `ok` and
+  `ready`. Read-only database checks observed 7 users, 12 help requests, 8 help
+  assignments, 15 messages, 2 activities, 4 activity participants, 9 tracking
+  sessions, 0 current positions, 6 reviews, 4 support requests, and 18 applied
+  migrations.
+- A same-helper withdraw/rejoin defect was reproduced against existing dev data:
+  messages belonged to the earlier assignment and disappeared from the rejoined
+  assignment. Pair chat now follows `(request, helper)` across that helper's
+  assignments, while a replacement helper receives a separate empty thread.
+  Domain tests cover both continuity and replacement isolation. The supporting
+  `help_assignments(request_id, helper_id)` index was created through the Ecto
+  migration workflow, applied to dev, and observed in PostgreSQL.
+- Headed Chrome verified email magic-link login for an existing Activity
+  participant, completed-Activity exact-location access, participant lists, and
+  read-only group-chat history with no console errors or warnings. It also
+  verified the request pair-chat replay, mobile and desktop navigation, Escape
+  dismissal with focus restoration, request creation layout, viewport discovery,
+  and the mobile landing-page map after its lazy-load boundary. Audit screenshots
+  are retained under `output/playwright/`.
+- The isolated lifecycle load wrapper completed a scoped smoke run with 5,634 of
+  5,634 successful checks and 6,136 requests with zero failed requests, then
+  removed its exact containers, networks, named volume, temporary environment,
+  and image tags. The full retained measurement at
+  `output/performance/goal-dev-20260723-005415` recorded 35,004 successful checks,
+  38,270 requests with zero failures, 1,625 authenticated iterations, 240 WebSocket
+  sessions, a 7.63 ms HTTP p95, and a peak of 21 database connections. These are
+  workstation observations, not minimum server requirements.
+- The retained resilience drill at
+  `output/resilience/goal-dev-drain-retry-20260723` observed explicit readiness
+  drain before sequential web replacement, replaced all 3 web and 2 worker
+  replicas, verified cluster/PubSub recovery and an Oban retry, and recorded zero
+  failed readiness samples. The ordinary deployment keeps Traefik's insecure API
+  disabled; the drill enables it only inside its isolated Compose networks to
+  inspect backend health state.
+- A custom-format backup at
+  `output/backups/dev-goal-20260723-005318.dump` was restored into a fresh
+  database and verified with 31 tables, 1,722 rows, 17 then-current migrations,
+  and PostGIS 3.6.4. The later chat index migration explains the current dev
+  count of 18 migrations; the earlier backup was not rewritten.
+
 ## Local completion audit on 2026-07-22
 
 The following results describe the uncommitted local workspace only. No test or