diff --git a/docs/verification.md b/docs/verification.md
index 27debab..3391d1a 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -28,10 +28,10 @@ edit, branch, or tag was made during this audit.
   replicas deliberately still use their earlier runtime environment until the
   remaining Google/Firebase credentials are ready for one controlled rebuild.
 - `./scripts/check-environment-readiness.sh .env` now reports external SMTP,
-  the support inbox, application secrets, browser VAPID, Android App Links, and
-  Android signing inputs as ready. Its three remaining development blockers are
-  the Google OAuth client pair, the four public Firebase Android values, and the
-  FCM service-account credential. No release-readiness claim is made until those
+  the support inbox, application secrets, Google sign-in, browser VAPID,
+  Android App Links, and Android signing inputs as ready. Its two remaining
+  development blockers are the four public Firebase Android values and the FCM
+  service-account credential. No release-readiness claim is made until those
   credentials are imported and provider/device behavior is exercised.
 - The SSH production release `plan` action was repeated read-only. It observed
   production commit `921e04b3608007675e22e7e26e0beb3975dbba58`, compact
@@ -1388,6 +1388,14 @@ None of the observations below describe the current delivery path.
   `https://whoneedhelp.imalto.site` origin and callback, and its ID/secret are
   present only in the ignored development `.env`. The currently running
   development containers have not yet been rebuilt with that configuration.
+- The isolated external-boundary drill passed OAuth and Google OIDC
+  success/rejection/replay/timeout cases, SMTP rejection/retry/timeout cases,
+  and provider-neutral push delivery with two healthy worker replicas. Its
+  product replay returned the retained notification and retained Oban delivery
+  job, the chat body stayed out of the remote payload, and the run-scoped
+  Compose project, containers, PostgreSQL volume, and images were absent after
+  cleanup. Evidence is retained at
+  `output/external-boundaries/local-boundaries-fix-20260723`.
 - Firebase Android and server FCM credentials are intentionally still absent.
   Adding Firebase to the existing Google Cloud development project is pending
   explicit acceptance of the separate Firebase terms. No test or production