refactor(message): canonical Outcome sum type on OutboxInnerMessage

[lesnik512]

What

The deferred deepening from candidate #2. OutboxInnerMessage recorded delivery intent across three loosely-coupled fields (terminal_failure_reason, pending_delay_seconds, state_set), where "success" was the implicit "all None" state and "reason and delay both set" was representable-but-never-used. Replace them with one canonical Outcome sum type.

@dataclass(frozen=True, slots=True)
class Ack: ...
@dataclass(frozen=True, slots=True)
class Retry:    delay_seconds: float
@dataclass(frozen=True, slots=True)
class Terminal: reason: DLQFailureReason
Outcome = Ack | Retry | Terminal

Approach — Option A (canonical outcome + derived views)

• outcome is the single canonical field; _ack/_nack/_reject/allow_delivery set it. Success is now an explicit Ack(); the impossible "reason and delay both set" is unrepresentable.
• terminal_failure_reason / pending_delay_seconds / state_set become read-only @property views of outcome — zero-drift derivations, not the parallel-state smell refactor(message): remove dead to_delete intent flag #140 removed. So the five other subscriber readers (_flush_terminal, _flush_retry, _terminal_has_dlq, the shutdown-race guard, metric tags) and every read-assertion in the tests are unchanged.
• dispatch_one matches on the disjoint variant, which dissolves the terminal-before-retry / before-last_exception ordering invariant (mutually exclusive variants have no ordering dependence). Only the 12 test sites that wrote the old fields change, to set outcome.

DLQFailureReason (the public wire contract operators query) is unchanged — it is now Terminal.reason's type. dlq_table=None stays bit-for-bit identical.

Promotion

architecture/dlq.md routing section + the CLAUDE.md DLQ invariant line updated to the Outcome model. Lightweight change file added.

Verification

• just test — 603 passed, Postgres 17, coverage 100.00% (message.py + usecase.py fully covered)
• just lint — ruff + ty clean
• just check-planning — OK

Reviewed the diff adversarially: _ack sets Ack() (else success never records state), every setter path assigns outcome, dispatch_one behavior is branch-for-branch identical, and no field writes remain.

🤖 Generated with Claude Code