# Internal release v1

This is the operator copy for the first Google Play internal-testing release.
It identifies the already uploaded, source-bound candidate and does not grant
permission to publish it.

## Release identity

- Track: Internal testing
- Release label: `0.1.0 internal verification`
- Package: `org.whoneedhelp.mobile`
- Version code: `1`
- Version name: `0.1.0`
- AAB: `android/dist-release-20260803-162910/who-need-help-release.aab`
- AAB SHA-256:
  `03d39a9a08e9ca7569caccf1c7bd75e9349f7655935e7bbf23d1998cd37b3837`
- Source fingerprint:
  `f2f281210d11465d8f7fda20a78d1ed2527660d2e8a10a29ed31bf031a29ce43`

Do not rebuild, replace, or re-upload the candidate while preparing this
release. Keep the accepted version-code `1` artifact and remove only the
failed duplicate-upload row if it is still present in the draft.

## Release notes

### English (United States)

First internal build for production verification. Test secure sign-in,
privacy-aware nearby requests and activities, private chat, notifications,
verified links, and consent-based live location sharing.

### Ukrainian

Перша внутрішня збірка для перевірки перед запуском. Перевірте безпечний вхід,
заявки й події поруч із захистом приватності, приватний чат, сповіщення,
перевірені посилання та добровільне передавання геолокації.

### Russian

Первая внутренняя сборка для проверки перед запуском. Проверьте безопасный
вход, заявки и события поблизости с защитой приватности, приватный чат,
уведомления, проверенные ссылки и добровольную передачу геолокации.

## Before publishing

Verify in Play Console that:

1. the draft is under the Who Need Help application with Play application ID
   `4972430103169452589`;
2. the track is Internal testing;
3. exactly one accepted artifact with version code `1` remains in the release;
4. the package is `org.whoneedhelp.mobile`;
5. the release notes above contain no test URL, credential, email address,
   private location, or prescription information;
6. no production or closed-track rollout is selected.

Saving or publishing the release is an external state change. Do not press the
final save, publish, or rollout control without the user's explicit permission
for this exact candidate and track.

## Immediately after publication

1. Record every Play App Signing SHA-1 and SHA-256 displayed by Play.
2. Import the applicable identities into the production Firebase Android
   configuration and production App Links association using the protected
   import workflow.
3. Install from the internal-testing opt-in link on the authorised physical
   phone.
4. Run `scripts/verify-play-installed-android.sh` before testing product flows.
5. Exercise production sign-in, notifications, verified links, foreground and
   background location sharing, and the Stop action from the Play-delivered
   build.