docs(campaign): distinguish worker process evidence

docs/CAMPAIGN_DELIVERY_RUNBOOK.md

@@ -107,15 +107,20 @@ bed where possible:
 For the maintained loopback baseline, run
 `dev/mail-testbed/run_campaign_acceptance.py`. It proves the public Campaign
 path for SMTP acceptance, IMAP append, repeat-send blocking, an SMTP connection
-failure before transmission, an explicit SMTP authentication rejection, and an
-IMAP authentication rejection after SMTP acceptance. Its evidence is an
-allowlisted classification/count projection; raw provider diagnostics and
-transport/account identifiers are deliberately excluded.
+failure before transmission, an explicit SMTP authentication rejection, an
+explicit temporary `451` response after DATA, partial RCPT refusal, a
+connection loss after complete DATA, and an IMAP authentication rejection
+after SMTP acceptance. Its evidence is an allowlisted classification/count
+projection; raw provider diagnostics and transport/account identifiers are
+deliberately excluded.
 
-The runner does not simulate a connection loss after SMTP DATA and does not
-restart a real worker. Keep those two checklist items open until a controlled
-fault proxy/target provider and supervised worker environment can produce the
-corresponding `outcome_unknown`, restart, retry, and reconciliation evidence.
+The runner also terminates a dedicated OS process executing the registered
+Campaign send task after complete DATA, then invokes the task in a fresh
+process. The unfinished durable attempt must become `outcome_unknown` and the
+endpoint must observe no second connection or DATA transaction. This covers
+the worker task/process boundary. It does not cover Redis/Celery delivery,
+acknowledgement, broker redelivery, or daemon supervision; repeat the drill in
+that infrastructure before approving a production worker deployment.
 
 ## Reporting Checks
 

docs/EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md

@@ -59,9 +59,12 @@ Before tagging a campaign release:
   projection. It must show one SMTP acceptance, one IMAP append, no duplicate
   effect from a repeated ordinary send, matching Campaign report/audit state,
   and no resolved transport material in Campaign JSON or its execution
-  snapshot.
-- Do not interpret the local failure drills as post-DATA ambiguity or worker
-  restart proof; the evidence coverage flags must keep those gaps explicit.
+  snapshot. Its controlled endpoint evidence must also show explicit SMTP 451,
+  partial RCPT refusal, post-DATA ambiguity, and task-process interruption
+  classifications without retaining addresses or provider diagnostics.
+- Treat the task-process restart proof separately from the still-open
+  Redis/Celery broker redelivery and daemon-supervision check; the coverage
+  projection must keep `celery_broker_redelivery` false.
 - Confirm reusable mail profile selection is revalidated after campaign owner
   transfer.
 - Confirm every inline SMTP/IMAP field is rejected on import/write, omitted