docs(campaign): define broker redelivery evidence

docs/CAMPAIGN_DELIVERY_RUNBOOK.md

@@ -118,9 +118,21 @@ The runner also terminates a dedicated OS process executing the registered
 Campaign send task after complete DATA, then invokes the task in a fresh
 process. The unfinished durable attempt must become `outcome_unknown` and the
 endpoint must observe no second connection or DATA transaction. This covers
-the worker task/process boundary. It does not cover Redis/Celery delivery,
-acknowledgement, broker redelivery, or daemon supervision; repeat the drill in
-that infrastructure before approving a production worker deployment.
+the worker task/process boundary but not a broker or daemon.
+
+Run `dev/mail-testbed/run_celery_redelivery_acceptance.py` for the maintained
+Redis/Celery delivery and broker redelivery boundary. It starts an isolated
+Redis Compose service and real Celery workers, kills the first solo worker after complete DATA while the
+late-ack task is unacknowledged, and requires the same task identity to reach a
+replacement worker after Redis visibility recovery. Passing evidence also
+requires durable `outcome_unknown`, an empty broker queue/unacked set, and
+exactly one SMTP connection and DATA transaction. Raw worker logs and task,
+database, endpoint, and credential identifiers are never retained.
+
+That second runner proves local runner-supervised process replacement, not the
+production process manager. Repeat the worker-loss drill under the selected
+systemd, container, Kubernetes, or other production supervisor and the target
+Redis/SMTP infrastructure before deployment approval.
 
 ## Reporting Checks
 

docs/EXAMPLE_CAMPAIGNS_AND_RELEASE_CHECKLIST.md

@@ -65,6 +65,13 @@ Before tagging a campaign release:
 - Treat the task-process restart proof separately from the still-open
   Redis/Celery broker redelivery and daemon-supervision check; the coverage
   projection must keep `celery_broker_redelivery` false.
+- Run `dev/mail-testbed/run_celery_redelivery_acceptance.py` as a separate
+  destructive worker-loss check. Retain its bounded evidence only when the same
+  broker task is observed at both workers, the durable state is
+  `outcome_unknown`, broker queue/unacked counts are zero, and the controlled
+  SMTP endpoint observed one connection and one DATA transaction. This closes
+  local Redis/Celery redelivery coverage, while production supervisor and
+  target-provider coverage remain false until separately tested.
 - Confirm reusable mail profile selection is revalidated after campaign owner
   transfer.
 - Confirm every inline SMTP/IMAP field is rejected on import/write, omitted