Record final local verification evidence

docs/verification.md

@@ -3,6 +3,69 @@
 Observed through 2026-07-25 in the local workspace. This report separates observed
 results from product limits and unknown production properties.
 
+## Cross-browser and release rehearsal follow-up on 2026-07-25
+
+The observations below apply to local commit
+`9875fd7d052367596d3745d130dc3c6342667419`. No push, hackathon-test
+deployment, production deployment, Devpost edit, branch, or tag was made.
+
+- `./scripts/e2e-run.sh` passed all 45 scenarios in Chromium, Firefox, and
+  WebKit. The run covered registration and account settings, localization,
+  responsive accessibility, requests and activities, viewport discovery and
+  clustering, exact/approximate/hidden locations, private chat, tracking,
+  handover, blind reviews, notifications, moderation, and serving-node
+  restart recovery. Evidence is
+  `output/e2e/20260725205052-3435033`. The run-scoped containers, networks,
+  volumes, and images were absent after cleanup.
+- The isolated 30-second load run used 40 public HTTP, 40 Phoenix WebSocket,
+  and 8 authenticated mutual-aid VUs against 3 web and 2 worker replicas.
+  All 37,854 HTTP requests and 34,578 public checks passed. It completed
+  1,630 authenticated LiveView join/message/tracking-start/tracking-update/
+  tracking-stop cycles and 240/240 WebSocket heartbeats. Overall HTTP p95 was
+  8.27 ms. These are workstation measurements, not production limits.
+- PostgreSQL recorded 138,772 commits with zero rollback, deadlock, conflict,
+  temporary file, or lock waiter. It peaked at 21 client backends and 5 active
+  backends with at least 76 observed connection slots of headroom. The three
+  web replicas recorded 177,453 Ecto queries with 0.299 ms average total
+  duration and 0.027 ms average queue duration. The largest observed
+  `pg_stat_statements` maximum was 9.808 ms. Exact fixture cleanup restored
+  every tracked table count. Evidence is
+  `output/performance/candidate-28940f9-20260725-load`.
+- Under that concurrent synthetic profile, individual observed container
+  maxima were 355.99 MB for a web replica, 228.69 MB for a worker,
+  146.38 MB for PostgreSQL, and 364.17 MB for the proxy. These are load-run
+  samples and are not idle-memory measurements or minimum-server claims.
+- The associated resilience run recorded 1,164 readiness samples with zero
+  failures while replacing web and worker processes. Evidence is
+  `output/resilience/candidate-28940f9-20260725-resilience`. Its exact
+  Compose project, database volume, networks, and image tags were removed.
+- A mode-`0600` custom-format backup and checksum were created at
+  `output/backups/preprod-20260725T210230Z.dump`. A temporary restore read
+  33 public application tables and 1,813 rows, confirmed all 19 migrations
+  and PostGIS 3.6.4, and removed the temporary database.
+- The same backup passed the isolated upgrade rehearsal after the rehearsal
+  was made to wait for the actual Traefik application route rather than only
+  container state. All 19 migration versions and 11 required cursor indexes
+  matched, application table counts were unchanged, two web and two worker
+  replicas formed a four-node cluster, and PubSub plus HTTP checks passed.
+  Evidence is `output/upgrade-rehearsal/20260725210859-3996878`; all
+  run-scoped Docker resources were removed. Failed rehearsal runs now retain
+  proxy and Docker socket-proxy logs before exact cleanup.
+- `./scripts/quality.sh` passed after these changes. It included ShellCheck,
+  release/rollback/migration drills, Compose and Helm validation, source and
+  image scans, formatting, warnings-as-errors compilation, xref, Credo,
+  Sobelow, Dialyzer, Hex/npm audits, and 390 passing ExUnit tests. The
+  configured scans reported zero vulnerability findings and exact
+  quality-run cleanup left no scoped Docker resources.
+- The signed development Android APK was rebuilt from the current source.
+  Unit tests, Android Lint, package/signing checks, and online App Links
+  validation passed. On the connected physical Android API 36 device,
+  `whoneedhelp.imalto.site` was reported as `verified`, `/safety` cold-started
+  `org.whoneedhelp.mobile.development`, and the real WebView DOM smoke passed
+  1/1 for `/` and `/safety`. The device sleep setting was restored after the
+  run. The earlier complete physical chat/FCM/tracking replay remains recorded
+  separately below.
+
 ## Final local candidate verification on 2026-07-25
 
 The web/backend candidate below is exact commit