Record current production release plan

docs/verification.md

@@ -515,6 +515,37 @@ production support/legal queue routing.
   response. The frozen hackathon-test checkout and containers were not changed,
   and the public remote repository was not updated.
 
+## Read-only release and email-state recheck on 2026-08-13
+
+- The guarded production release plan compared local candidate
+  `39ba37194f06e0cbc654630a1165eecfb5fed46c` with the still-running production
+  revision `dafcdb36cbe221af0c880fd05da3321e181ddd2c`. It reported 23 pending
+  commits, no shared Caddy-file change, and one reviewed `application_safe`
+  migration, `20260812120611_allow_inbox_only_nearby_subscriptions.exs`.
+- The remote scope check observed the detached production checkout, compact
+  `who_need_help_production` Compose project, external PostgreSQL 18.4 database,
+  healthy application container, passing public readiness, and 100 GiB free on
+  the checked root filesystem. Environment validation reported all twelve
+  release capabilities ready. The plan did not build, transfer, migrate,
+  restart, or deploy anything.
+- The current production process exposed 85 cumulative SMTP adapter successes
+  and four cumulative SMTP exceptions since that process started. It does not
+  expose the newer fixed-purpose counters because production still runs the
+  older revision. These are process-lifetime counters, not proof of 89 distinct
+  user messages. No active `mail`-queue job was present at inspection time.
+- Source inspection of the local candidate confirmed that immediate per-request
+  nearby email is retired; nearby matching uses inbox and optional push. Support
+  emails are bounded to contact verification, the first staff response, and
+  later public status changes instead of every conversation message.
+  Content-removal confirmation, receipt, and decision messages remain separate.
+  Non-authentication support/removal delivery uses the dedicated Oban `mail`
+  queue, while authentication remains synchronous so its database token is not
+  committed after a failed delivery.
+- Public DNS still had no MX record proving inbound delivery for
+  `contact@whoneedhelp.com`. The Play reviewer template was therefore changed
+  locally to require a tested, monitored inbound address instead of presenting
+  the outbound-only Brevo sender as a verified support mailbox.
+
 ## Local support/legal and complete browser E2E on 2026-08-09
 
 - The focused isolated Chromium run exercised an authenticated support case,