fix(cron): wire confirmed-dead delivery targets into the live-adapter send path

[pierrenode]

Summary

gateway/delivery.py::DeliveryRouter.deliver() is the only place that consults gateway/dead_targets.py's DeadTargetRegistry: it skips a target already confirmed dead (deleted group, blocked/kicked bot, deactivated user), and marks/clears the flag around a send's failure/success.

cron/scheduler.py's live-adapter delivery path does not call deliver(). It deliberately calls the private DeliveryRouter._deliver_to_platform() directly instead, because deliver()'s private-chat topic detection demands a reply anchor (thread_id/message_thread_id in metadata) that cron sends — which have no inbound message to reply to — can't supply; routing through _deliver_to_platform() with thread_id passed via the target/metadata bypasses that check (see the existing comment at the call site, #22773/#52060).

Checked every call site in the codebase: deliver()'s only caller anywhere is the test suite. gateway/run.py constructs self.delivery_router and keeps .adapters synced but never calls .deliver() either. The practical effect: a cron job's target that has been definitively dead for weeks is retried — full send attempt, full failure, full log line — on every single tick, on every platform, forever. This is exactly the waste dead_targets.py's own docstring says it exists to prevent ("re-sending to it on every cron tick... wastes a send attempt against the platform's flood-control envelope and spams the logs").

Fix

cron/scheduler.py::_deliver_result() now shares one DeadTargetRegistry instance across a delivery pass:

1. Before attempting any send for a target (top of the per-target loop), skip it if already marked dead.
2. Pass the same registry into DeliveryRouter(config, adapters, dead_targets=...) so the live-adapter path's failure handling and my checks stay consistent within one run.
3. When _deliver_to_platform() raises a real send error, classify it via the existing gateway/delivery.py::_classify_dead_from_error_text() (the same classifier deliver() itself uses) and mark the target dead if it's a whole-chat death.
4. Right before falling through to the standalone HTTP send path, check again: if the live-adapter failure above just got classified dead this same tick, skip the guaranteed-to-fail standalone attempt too, instead of waiting for the next tick's pre-loop check.
5. On a successful (or assumed-delivered, in-flight-timeout) live send, clear any stale dead flag — self-healing, mirroring deliver()'s own post-success behavior.

The standalone (non-live-adapter) send path itself (tools/send_message_tool.py::_send_to_platform) is intentionally left untouched — extending dead-target awareness there is a separate, independent surface I haven't audited to the same depth, and is out of scope for this PR. The pre-loop check (item 1) already protects standalone-only ticks (gateway not live) from repeat waste once a target is marked dead via any live-adapter tick.

Test plan

• test_already_dead_target_is_skipped_without_calling_adapter: pre-marks a target dead, asserts adapter.send is never called and the standalone fallback is never called either.
• test_forbidden_send_error_marks_target_dead: adapter returns a "Forbidden: bot was blocked by the user" failure; asserts a fresh DeadTargetRegistry() instance sees it marked dead afterward (proves persistence, not just an in-memory object the test happens to hold), and that the standalone fallback is skipped on the same tick.
• test_transient_send_error_does_not_mark_target_dead: a generic "Connection reset by peer" failure must NOT be classified as dead, and the standalone fallback must still run — guards against over-broad classification.
• test_successful_send_clears_dead_flag: a successful send calls DeadTargetRegistry.clear() with the right platform/chat_id (spied via patch.object(..., autospec=True)).
• Mutation-verify: stashed cron/scheduler.py and confirmed 3 of the 4 new tests fail against pre-fix code (the 4th — the transient-error precision guard — correctly passes either way, since "not marking dead" is also true with zero dead-target logic at all; it only has teeth combined with the other three).
• Full tests/cron/test_scheduler.py (220 tests), tests/gateway/test_dead_targets.py, tests/gateway/test_delivery.py, tests/gateway/test_delivery_silence_filter.py, and tests/cron/test_jobs.py — 443 tests total — all pass.
• ruff check clean.
• Fresh competing-PR search: fix(gateway): retry stale dead delivery targets #63372 ("retry stale dead delivery targets") only touches gateway/dead_targets.py's retry-window logic itself, never cron/scheduler.py or gateway/delivery.py — doesn't address this wiring gap. feat(cron): redirect stale-target deliveries to parent/home channel #54598 ("redirect stale-target deliveries to parent/home channel") does touch cron/scheduler.py's standalone-fallback region, but implements a completely independent mechanism (its own is_definitive_delivery_failure() classifier redirecting to a fallback channel) with no reference to DeadTargetRegistry — diffed line-by-line, no functional overlap with this change.

[teknium1]

Thanks for tracing the live-adapter bypass. The premise is confirmed on current main: cron calls DeliveryRouter._deliver_to_platform() directly at cron/scheduler.py:1707, while the dead-target lifecycle is implemented in DeliveryRouter.deliver() at gateway/delivery.py:269-313.

Problems

• Live media has the same bypass class but is not covered. _send_media_via_adapter() catches adapter errors at cron/scheduler.py:1324; a media-only forbidden send therefore never reaches the proposed text-send classifier and will still retry on future ticks.
• The linked fix(gateway): retry stale dead delivery targets #63372 stale-entry issue remains relevant: pre-marked targets are skipped before a send can clear them. Its retry behavior should be exercised through _deliver_result() once these changes are combined.

Suggested changes

• Feed live media failures through the same whole-chat classification, with a media-only forbidden regression test.
• Add an _deliver_result() test for an expired dead entry that retries and clears on success when coordinated with fix(gateway): retry stale dead delivery targets #63372.

The changed production file is byte-identical between this PR's base and current origin/main, so salvage should otherwise be mechanical. Automated hermes-sweeper review.