# Internal testing release v4

This operator record identifies the Android build currently available through
Google Play Internal testing. It records observed artifact, Console, and
physical-device evidence without authorizing a Closed or Production rollout.

## Release identity

- Track: Internal testing only
- Release label: `0.1.3 Reliable notifications`
- Package: `org.whoneedhelp.mobile`
- Version code: `4`
- Version name: `0.1.3`
- Source fingerprint:
  `42b485964a8c3fdaeff94ca80dcd8f33533e1723c6c2d625a9483458c0ff0068`
- AAB: `android/dist-release-20260821-v4-precommit/who-need-help-release.aab`
- AAB SHA-256:
  `5147404e91aee6ef87014e19db93403fdb18a15e91b749737c494c372ea87371`
- Companion APK SHA-256:
  `58136ea5ddead7ee683f28f3ae12aa65334207c40ebfe2fdb34064b8d2710c3d`
- Upload-certificate SHA-256:
  `a5742bae70c6d034e37544b62e37a375c0e005647450f40f29b2a984f9fdb8fb`

The artifact directory name is accurate: the build was produced before its
matching Android source state was committed. Historical checkout comparison
found `f15f5578e010df80a430f2dbfa4aca54face65f3` to be the first committed
revision whose Android build-input fingerprint exactly matches the retained
artifact. This is reproducibility evidence; it is not a claim that the
artifact was originally built by checking out that commit.

Do not upload a different artifact under this release record. Any Android
source or build-input change requires a new version code, a fresh source-bound
build, and a new operator record.

## Publication evidence

A read-only authenticated Play Console inspection on 2026-08-25, repeated on
2026-08-26, showed:

1. **Internal testing** is active;
2. the latest release is `0.1.3 Reliable notifications` with one version code;
3. the release is available to internal testers;
4. the Console displayed a release time of 2026-08-25 3:46 PM;
5. the app remains unreviewed, so Internal testers see the temporary package
   name;
6. the existing **Closed testing - Alpha** track is inactive, has zero of four
   setup tasks complete, has no countries or testers selected, and contains no
   release;
7. no Production rollout was observed or started during the inspection.

## Play-delivered physical-device evidence

The authorised physical phone passed the strict delivery-boundary verifier:

```bash
./scripts/verify-play-installed-android.sh \
  output/runtime/production-provider-setup/play-identities.json \
  72551e60 \
  4 \
  0.1.3
```

The verifier observed package `org.whoneedhelp.mobile`, version `0.1.3 (4)`,
Google Play as installer, a signing identity in the protected Play App Signing
set, and a verified `whoneedhelp.com` App Link resolving to `MainActivity`. The
browser-only Google OAuth callback was not claimed by the Android application.
The verification was read-only and did not install, update, clear, or
reconfigure the app.