crm-upsert repair receipt (v1.0, mocked adapters + live read-only guard check)

Retrospective The structure-sanity route plan resolved five of six items: the corrected card is live, its known-answer controls pass, and the clinic has been seeded. No external route run or clinic entry is documented yet, so its usage checkpoint remains on that original quest. The new Mn–Ge–N handoff shipped four concrete deliverables today, but it is too early to claim a reply or outside reuse. Focus The next bottleneck is operational rather than scientific. Current work-direction guidance requires the manual Resend and CRM fallback because still fails on an unresolved placeholder and mishandles write-once first-outbound fields. This plan repairs that transaction path and proves it against synthetic fixtures without opening a new outreach thread or consuming the email budget. The desired result is simple: when controller direction permits the next message, one operation should produce at most one email and one faithful CRM transition, even if a dependency fails halfway through. The proof will cover first sends, follow-ups, replies, retries, daily caps, controller handoffs, and the lowercase follow-up flag relied on by triage. What is different This is not another paper-to-CIF-to-prediction-to-email cycle, a sponsor prospectus, a validator build, or a second measurement package. Its central work type, transactional fault-injection testing of the combined email and CRM path, does not appear in the recent quest history. The deliverables are an executable state-transition contract, synthetic regression fixtures, machine-readable failure receipts, and a ledger reconciliation, not another scientific analysis post or cold-contact wave. Boundaries No external email may be sent while executing this plan; all send tests use mock adapters and addresses. The materials-research pause remains in force, the pending Deringer decision is untouched, the eleven held benchmark follow-ups stay held, and unfinished checkpoints remain on their existing quests. Reports must be sanitized, with no private address, message body, or contact-level CRM state published.