Record healthy SMTP deployment and passing validation (#57)

docs/signup-facts.md

@@ -114,33 +114,29 @@ Message-ID is correlation only, not a provider idempotency guarantee. Existing
 failed Resend notifications are not replayed or rewritten. The unverified
 `sxchnge.com` Resend domain is no longer the selected local delivery path.
 
-Live verified-TLS SMTP authentication and NOOP succeeded with reply 250, without
-submitting email. SMTP adapter race tests and backend lint pass. Local tooling
-fixtures pass, including password-only Vault validation. Broader validation is
-currently blocked by Docker: the service integration test timed out starting its
-Testcontainers reaper; both `GOFLAGS=-p=2 make test` and its `-p=1` retry fail in
-the existing credential-rotation setup while copying files into a disposable
-MongoDB container (90-second context timeout). No checks were disabled. Fresh
-stable image pins resolved on retry; two image builds hit a Go proxy TLS
-handshake timeout during protobuf generator installation. The generator stage
-now shares the existing BuildKit Go module/build caches, preserving its pinned
-tool versions and generation command. Cache seeding also stalled during file
-extraction; it was canceled after copying the pinned module archives. A normal
-build retry remained blocked before starting a compiler process. A fallback
-using the same freshly pulled, digest-pinned Go image, canonical Make generation
-command and existing module cache stalled during ordinary container startup,
-before package installation or compilation produced output.
+Live verified-TLS SMTP authentication and NOOP succeeded with reply 250 using
+the password from SXCHNGE Vault, without submitting email. SMTP adapter race
+tests, `make lint-backend`, `make test-dev-tooling` and `make test-dev-infra`
+pass, including canonical Vault layout, service permission isolation, database
+credential issuance/renewal/revocation and transactions. The final
+`GOFLAGS=-p=2 make test` passes all backend race tests and frontend suites.
 
-Deployment is not complete: the running notifications container still uses the
-previous image. The SMTP Vault password and source configuration are prepared,
-but its Agent policy/template have not been activated against that old image.
-Vault responds over HTTP, while Vault/Mongo Docker health checks time out and
-the local Sendico session is unavailable. Restarting Docker Desktop was requested
-for recovery because it also interrupts the separate Sendico stack; it has not
-been authorized or performed. Rebuild, activate the matching Agent configuration,
-restart notifications and verify the live `email_driver: smtp` startup log after
-Docker is responsive. Do not treat the successful SMTP login as a deployed
-notification delivery check.
+Earlier attempts hit Docker archive-copy/reaper timeouts, Go proxy TLS failures
+and stalled cache extraction/container startup. The user authorized restarting
+Docker Desktop. After recovery, the normal Compose `build --pull notifications`
+succeeded with the resolved stable digest pins; no checks were disabled. The
+generator stage shares the existing BuildKit Go module/build caches and retains
+the pinned tools and canonical Make generation command. A discarded fallback
+compiler attempt also failed to access its checksum-state directory; it was not
+used for the deployed artifact.
+
+The matching Vault Agent policy/template were applied, and notifications was
+recreated healthy. Its running image matches the rebuilt image
+`sha256:d4cbc0cb9005e9cef9381abdf2a13f672104d160536ee6d77ac73a909c0a8638`,
+and its startup log confirms `email_driver: smtp`. No customer email was sent or
+failed Resend job replayed; SMTP authentication is not a recipient-delivery
+check. Sendico's Vault sealed during the Docker restart and was unsealed with
+its existing local key, without reinitialization or exposing credentials.
 
 
 With `api.sendico` configured, the product BFF creates the local pending customer