diff --git a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md
index cd6f342..7d6cfad 100644
--- a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md
+++ b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md
@@ -60,8 +60,10 @@ change is made there.
    Traefik edge live; Forgejo workload deployed and serving HTTPS. Gitea remains
    canonical until migration drills pass. Record:
    `the-custodian/docs/forgejo-production-decisions.md`.
-2. Mail delivery path for password reset and account recovery
-   (SMTP relay, sender domain, SPF/DKIM/DMARC expectations).
+2. ~~Mail delivery path~~ **DECIDED 2026-07-07:** IONOS SMTP for `@coulomb.social`
+   mailboxes (operator-provisioned domain/subdomains). Sender mailbox TBD
+   (`forgejo@coulomb.social` recommended); SPF/DKIM via IONOS zone. T06 still
+   requires password-reset test after creds are deployed.
 3. Package registry scope: container images only at first, or also generic,
    npm, PyPI, Go, Maven, and Helm packages.
 4. ~~Actions runner model~~ **DECIDED 2026-07-03:** in-cluster long-lived runner
@@ -179,10 +181,11 @@ state_hub_task_id: "f88115bf-4f99-49ef-a415-0b23750141b3"
 
 Decide the production choices listed in "Key Decisions to Confirm".
 
-**Partial (2026-07-04):** hostname, exposure, deployment pattern, live deploy,
-and in-cluster runner model decided (`ADR-004`). Cutover mode **leaning** staged
-per-repo (glas-harness pilot). Remaining operator decisions: SMTP, package scope
-beyond OCI, backup target, final cutover confirmation. See
+**Partial (2026-07-07):** hostname, exposure, deployment pattern, live deploy,
+in-cluster runner model (`ADR-004`), and **SMTP provider (IONOS)** decided.
+Cutover mode **leaning** staged per-repo (glas-harness pilot). Remaining
+operator decisions: sender mailbox name + T06 test, package scope beyond OCI,
+backup target, final cutover confirmation. See
 `the-custodian/docs/forgejo-production-decisions.md`.
 
 Expected output:
@@ -292,9 +295,13 @@ state_hub_task_id: "417faa4d-eab8-4247-9485-4f80e5d5b7ff"
 
 Configure and test mail delivery for account recovery.
 
+**Provider decided (2026-07-07):** IONOS SMTP for `@coulomb.social` mailboxes.
+See `the-custodian/docs/forgejo-production-decisions.md` and
+`railiance-apps/docs/forgejo-on-railiance01.md` (SMTP section).
+
 Minimum scope:
 
-- SMTP credentials stored through the approved secret path.
+- SMTP credentials stored through the approved secret path (`forgejo-secrets.sops.yaml`).
 - Sender address and domain alignment documented.
 - Password reset email works for a controlled non-admin account.
 - Account recovery runbook covers lost password, lost MFA, disabled account,