[AliZakaee]

Summary

• introduce an atomic transient sending claim for approval deliveries
• finalize sent or sent_edited only after Telegram accepts the reply
• return failed delivery claims to pending only when the rollback succeeds
• quarantine partial, interrupted, or rollback-failed deliveries for manual review
• keep concurrent callbacks from removing retry buttons while delivery is in progress

Why this is meaningful

Approval mode previously marked a reply as sent before calling Telegram. If both the TeleBot path and raw HTTP fallback failed, the customer received nothing while the database permanently reported success and rejected future retry attempts. This change keeps double-tap protection while aligning persisted state, outbound history, memory, owner feedback, and retry availability with the actual delivery result. It also avoids promising a retry when the database could not release a failed delivery claim.

Validation

• Reconciliation baseline: .venv/bin/python -m pytest --cov=. --cov-report=term-missing --cov-report=xml:<temp>/post-coverage.xml --junitxml=<temp>/post-junit.xml — 274 passed
• Targeted: .venv/bin/python -m pytest tests/unit/handlers/test_approvals.py tests/unit/test_database_dal.py tests/unit/test_telegram_api.py -q — 52 passed
• Post-change: .venv/bin/python -m pytest --cov=. --cov-report=term-missing --cov-report=xml:<temp>/final-coverage.xml --junitxml=<temp>/final-junit.xml — 276 passed, 60% total coverage
• .venv/bin/python -m compileall -q handlers database.py tests/unit — passed
• git diff --check — passed
• Diff secret/forbidden-file scan — passed; only handlers/approvals.py and tests/unit/handlers/test_approvals.py changed in the reconciliation commit

Risk and rollback

Risk is limited to the internal approval state machine and owner feedback for failed sends. There are no schema, dependency, configuration, public API, authentication, deployment, or workflow changes. A process crash during the brief sending state remains an ambiguous delivery case and is quarantined for manual review. Roll back by reverting the focused approval-delivery commits.

Prepared with automated assistance by EQ for ITheEqualizer.