Clarify Google Play review readiness

android/play-store/closed-test.md

@@ -20,14 +20,20 @@ before production access can be requested.
 ## Tester cohort
 
 - Recruit at least 12 real people with Google or Google Workspace accounts.
-- Keep at least 14 opted in so that one accidental opt-out does not reset the
-  minimum cohort; this is an operational buffer, not a Google requirement.
+- Keep at least the required 12 testers continuously opted in for the complete
+  14-day interval. If anyone opts out, replace them if needed and use the date
+  shown by Play Console rather than assuming the original interval still
+  qualifies.
 - Do not publish tester email addresses in the repository.
 - Give every tester the Play opt-in link and state clearly that they must remain
   opted in for at least 14 continuous days.
 - Record opt-in date, device/Android version, completed scenarios, and feedback
   in a private operational sheet.
 
+Do not invent a larger required cohort or a shorter testing interval. The
+current official minimum is 12 continuously opted-in testers for 14 days; Play
+Console is the source of truth for whether the account has satisfied it.
+
 ## Required scenarios for each cohort
 
 - Install and open from the Play closed-test listing.

android/play-store/release-checklist.md

@@ -57,7 +57,11 @@
 - [ ] Account deletion questions and external URL completed.
 - [ ] Government/news/financial/health declarations answered from actual app
       behavior; do not describe the app as a medical service.
-- [ ] Foreground-service/location declarations completed if Play Console asks.
+- [ ] Foreground-service/location declarations completed from the exact AAB if
+      Play Console asks. The current source requests coarse/fine foreground
+      location and a location foreground service; it does not declare
+      `ACCESS_BACKGROUND_LOCATION`. Re-check the uploaded artifact rather than
+      inferring the Console form from this note.
 
 ## Testing
 

android/play-store/review-access.md

@@ -35,6 +35,39 @@ access field:
 - Stable synthetic activity URL: create at release time.
 - Support contact: `contact@whoneedhelp.com`.
 
+## Copy for Play Console App access
+
+Use the following English instructions only after replacing both bracketed
+values with the dedicated production reviewer credentials and after testing the
+exact text from a clean Play-delivered installation. Never commit the completed
+version.
+
+```text
+This app has public pages and authenticated product flows.
+
+1. Open the app and tap Log in.
+2. Expand "Use a password instead".
+3. Enter the reusable reviewer credentials below.
+4. After signing in, open Requests to inspect the pre-created synthetic help
+   request and its private chat, location controls, handover and reporting.
+5. Open Activities to inspect the pre-created synthetic cinema activity and
+   participation controls.
+
+Reviewer email: [ENTER IN PLAY CONSOLE ONLY]
+Reviewer password: [ENTER IN PLAY CONSOLE ONLY]
+
+All records whose titles start with "Play review" are synthetic. No purchase,
+payment, medicine, travel or real-world meeting is required. The credentials
+are reusable, do not require a one-time code or developer mailbox, and work
+independently of reviewer location.
+
+Support: contact@whoneedhelp.com
+```
+
+After `scripts/prepare-play-review.sh ... --confirm` succeeds, append the exact
+production request and activity URLs printed by the command. Do not use a dev,
+test, localhost or expiring sign-in URL.
+
 ## Verification before submission
 
 - Test the exact instructions in a clean Android install from the Play track.
@@ -44,6 +77,8 @@ access field:
 - Confirm all data is synthetic and no real user can be messaged or located.
 - Confirm the password works from a clean Play-delivered install without a
   second factor, one-time code, developer browser session, or location gate.
+- Confirm the final Play Console instructions are in English and every route
+  they mention is reachable by the reviewer account.
 
 After both dedicated accounts have registered, confirmed their email, and set
 their fixed passwords through the production UI, first run the read-only