Reliability: at-least-once delivery can send a duplicate reply (#6)

[brocla]

Backlog: Reliability & durability

Problem

Outbound reply delivery is at-least-once. In deliverPending (internal/mailgun/outbound.go), a submission is marked delivered (MarkEmailDelivered) only after send returns success. If the process crashes — or MarkEmailDelivered fails — in the window between a successful Mailgun send and the mark, the next poll re-sends → the user gets a duplicate reply.

The window is narrow, but the send timeout added in v0.1.1 slightly widened it: a send that times out on our side but actually succeeded on Mailgun's will be retried next tick.

Proposed solution

Options, cheapest first:

1. Document + accept the narrow window (at-least-once is a reasonable default). Add a code comment so it's visible.
2. "delivering" state — mark the submission delivering before send, delivered after; on restart, treat a stuck delivering conservatively.
3. Idempotency key — pass a deterministic key to Mailgun so a retried send is de-duplicated provider-side (if/where Mailgun supports it).

Notes

• Interacts with the send timeout (v0.1.1) and with self-restart / catch-up: a crash-restart cycle is exactly when this can fire.