docs(notifications): record EWS live-gate PASS (rig -> on-prem Exchange, Delivered first attempt)

docs/plans/2026-08-10-ews-email-transport-design.md

@@ -1,6 +1,6 @@
 # EWS Email Transport for the Notification Outbox — Design
 
-**Date:** 2026-08-10 · **Status:** Implemented on `feature/ews-email-transport`; manual live gate pending · **Owner decisions captured below.**
+**Date:** 2026-08-10 · **Status:** Implemented, merged to main; **live gate PASS 2026-08-10** · **Owner decisions captured below.**
 
 ## 1. Context — the pending task this supersedes
 
@@ -161,6 +161,19 @@ call (~200 lines including classification).
 - `docs/test_infra/test_infra_smtp.md`: note that the OAuth2 gap is superseded by EWS for
   on-prem deployments.
 
+### Live gate result (2026-08-10) — PASS
+Run on the docker rig, rebuilt from main with the EWS image. The EWS configuration was created
+through the new Central UI transport selector (its own first live exercise), pointing at the
+real on-prem endpoint with the dev service mailbox. One SoakNotify tick was enabled for ~9 s;
+the resulting notification delivered on the **first attempt** (`Status=Delivered`,
+`RetryCount=0`, resolved target = the tester's real mailbox) through
+`https://webmail.zimmer.com/ews/exchange.asmx`, and the message was received. Pre-existing
+parked rows (from the no-config era) were untouched. The rig was then restored to baseline:
+SMTP config row removed, notification list recipient restored, soak instance disabled.
+Note: the rig's LDAP login was found broken by the SEC-36 GLAuth service-account rotation
+(stale `serviceaccount123` in docker-compose); the gate ran under the Development-only
+`DisableLogin` switch, left active pending the rotated credential.
+
 ## 5. Explicitly out of scope
 - Removing the SMTP/OAuth2 path (stays config-selectable; Approach "additional transport" was
   the owner's choice).