# Google Play internal release candidate v2 — 2026-08-09

This record binds the second Google Play Internal testing build to the exact
source and verification evidence observed on 2026-08-09. It is evidence for an
internal pilot only; it is not evidence of Closed testing completion or a
Production-track rollout.

## Source and artifacts

- Source commit: `510ad2898c2131b493659963a069a0c8b868c2fb`
- Source fingerprint: `008ccf3dbb480dcbdb2962cf0d218ab4508fca6284c2dd2879c327931551b749`
- Package: `org.whoneedhelp.mobile`
- Version: `0.1.1 (2)`
- Internal release name: `0.1.1 App Links routing fix`
- AAB SHA-256: `e5a731ce2360f0ba907b4d23e9416cf0a1db8627642e1a11205de780d05dabf8`
- Release APK SHA-256: `1e4b783a801829a21e59709a06464d3d1de8c96f260d204b92ddb745d34ce598`
- Universal APK SHA-256: `1bd128b9c0ad3bd4ca890e7390f9f31b281c303a04926f20fb12f09885bb2e6b`
- Universal APKS SHA-256: `246270e0d8fe14f9c619613d422f08de9f76c4df945625ae501aeb3ca923a888`
- Local artifact directory: `android/dist-release-20260809-072143-v2/`

The Android unit tests, lint, release build, bundle validation and repository
quality gate passed before this record was written. Google Play accepted v2 on
the Internal testing track. No Closed or Production release was created by
this verification.

## Play-delivered installation

The connected physical device reported:

- version `0.1.1 (2)`;
- installer `com.android.vending`;
- a signing identity contained in the recorded Play App Signing set;
- verified domain state for `whoneedhelp.com`;
- `/safety` resolved to `MainActivity`;
- the browser OAuth callback was not claimed by `MainActivity`.

The exact verifier output is retained at
`output/android/play-v2-installed-verifier.txt`.

## Physical workflow evidence

The Play-delivered v2 build completed all of the following against production:

1. Google sign-in returned from the native account chooser to an authenticated
   application session.
2. A scoped FCM notification was delivered with the privacy-safe title
   `Help completed`; tapping it opened the in-app Notifications inbox.
3. A verified App Link opened the exact scoped request.
4. Location permission started denied. The application showed its prominent
   disclosure before Android's foreground-location permission dialog.
5. After consent, Android reported the foreground `TrackingService` and the
   ongoing `Sharing live location` notification with a `Stop sharing` action.
6. Sampling continued after the application was minimized. Production retained
   one current position while sharing was active.
7. Stopping through the system notification removed the foreground service and
   notification. Production then retained zero raw positions.
8. A cold start without connectivity showed the native offline screen stating
   that private pages are not saved on the device. Connectivity was restored
   to its original state.
9. A later force-stop and verified App Link restart returned to the authenticated
   request without restarting sharing.

Screenshots and UI dumps are retained under `output/android/` with the
`play-v2-` prefix. These artifacts are local and intentionally excluded from
Git.

## Scoped production cleanup

The notification replay deleted exactly its one notification and two related
Oban jobs. The location replay deleted exactly its one synthetic requester,
request, assignment and tracking session. Follow-up checks found no remaining
fixture user, request, tracking service or tracking notification. Production
readiness still returned `{"status":"ready"}`.

The frozen hackathon test deployment remained on commit
`cf7bacd61` and was not changed. The public Git remote was not pushed.

## Remaining release gates

Before advancing beyond Internal testing, complete and recheck in Play Console:

- store listing, category, tags and required graphics;
- App access instructions and support contact;
- Privacy Policy, account-deletion URL and Data safety answers;
- ads, target audience and content-rating declarations;
- foreground-service/location declaration and its required demonstration;
- Closed testing with the currently applicable Google Play eligibility rules;
- a fresh source-bound AAB for any code change after this candidate.

No Production-track rollout should be inferred from this document.