Verify campaign attribution in three independent windows

Treat a time-bounded messaging campaign as three independently verifiable behaviors: eligibility or ledger attribution, outbound delivery, and inbound reply attribution. A deployed flag proves none of them.

Check code-owned half-open boundaries, then query aggregate persisted evidence for each lane. Keep ledger totals separate from delivery totals because attribution may be retained when delivery is not queueable. A reply tail may extend beyond the outbound window and should have its own boundary.

Persisted provider acceptance is not end-device receipt. Without provider and runtime evidence, transport health and delivery remain unverified.