record that the login SMS now arrives: template SMSVerify on the server, status 10

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -283,12 +283,12 @@ reliably pull the final answer out of a solution and produced ~40% broken output
 - Grades 8–12 are fully covered: every node holds a four-question quiz. 39 of the 145
   nodes in grades 3/6/7 (the other team's books) still hold fewer than four; none is
   empty, so every node still plays.
-- Kavenegar is live on the server since 2026-09-25 (`/api/health` → `sms: true`), so every
-  OTP request costs real credit. Real SMS *delivery* to a phone was not yet observed by us;
-  sending is plain `sms/send` from the account's default line, not a `verify/lookup`
-  template, so numbers that block promotional SMS may never get the code. An `OTPCode`
-  row made in the admin (`/admin/accounts/otpcode/add/`) still hands a tester a login
-  without SMS.
+- Kavenegar is live on the server since 2026-09-25 and **delivers since 2026-09-27**: OTP
+  goes through the approved template `SMSVerify` (`verify/lookup`, `KAVENEGAR_OTP_TEMPLATE`
+  in the server `.env`), and a real code reached the owner's phone (message `894247231`,
+  status 10). Every OTP costs real credit. Plain `sms/send` from this account's line is
+  cancelled (status 13), so never unset the template. An `OTPCode` row made in the admin
+  (`/admin/accounts/otpcode/add/`) still hands a tester a login without SMS.
 
 ## The server: read this before running anything on it
 
@@ -390,6 +390,12 @@ anyone who can read this repo can forge a token for any user.**
 
 ## وضعیت ۲۰۲۶-۰۹-۲۷ — دامنه‌ی تازه و فرانتِ تازه، هر دو زنده
 
+- ✅ **پیامکِ کدِ ورود واقعاً می‌رسد** (۲۱:۴۴). اسمِ الگو را سینیور داد: `SMSVerify`، با همان سه
+  پارامترِ `receptor`/`token`/`template` که کد از قبل می‌فرستاد. فقط `KAVENEGAR_OTP_TEMPLATE=SMSVerify`
+  به `.env` سرور اضافه شد (بکاپ: `.deploy-backups/env-before-smsverify-20260927-214351`) و سرویس
+  ری‌استارت شد؛ کدی عوض نشد. یک دقیقه پیش از آن جلسه‌ی دیگری کلیدِ بازار را عوض و ری‌استارت کرده
+  بود (`env-before-bazaar-client2-…`)؛ سنجیده شد که هیچ کلیدی از آن گم نشده.
+
 - **API روی `mathapi.tadrisino2.ir` است**؛ ادمین از ۲۰۲۶-۰۹-۲۶ ساعتِ ۲۳:۲۲ nginx را
   عوض کرد و رکوردِ DNSِ `api.math.tadrisino2.ir` دیگر وجود ندارد. `.env` سرور
   `PUBLIC_BASE_URL=https://mathapi.tadrisino2.ir` شد (بکاپ: