fix(sre): close bounded runtime contract gaps

apps/api/src/models/agent99_completion.py

@@ -124,6 +124,27 @@ class Agent99TelegramVisual(BaseModel):
         return base64.b64decode(self.content_base64, validate=True)
 
 
+class Agent99TelegramLifecycleReconcileReceipt(BaseModel):
+    """Bound one retry to the exact provider delivery returned by a prior 202."""
+
+    model_config = ConfigDict(extra="forbid", str_strip_whitespace=True)
+
+    schema_version: Literal["agent99_telegram_lifecycle_reconcile_v1"]
+    delivery_id: str = Field(
+        min_length=12,
+        max_length=180,
+        pattern=r"^[A-Za-z0-9_.:-]+$",
+    )
+    incident_id: str = Field(
+        min_length=3,
+        max_length=180,
+        pattern=r"^[A-Za-z0-9_.:-]+$",
+    )
+    state_key: str = Field(min_length=3, max_length=96)
+    provider_message_id: str = Field(pattern=r"^[1-9][0-9]{0,31}$")
+    destination_binding: str = Field(pattern=r"^[0-9a-f]{64}$")
+
+
 class Agent99TelegramLifecycleRequest(BaseModel):
     """Bounded Agent99 event card handed to the canonical Telegram gateway."""
 
@@ -169,4 +190,18 @@ class Agent99TelegramLifecycleRequest(BaseModel):
     next_update: str = Field(min_length=1, max_length=300)
     reply_to_message_id: int | None = Field(default=None, ge=1)
     visual: Agent99TelegramVisual | None = None
+    reconcile_receipt: Agent99TelegramLifecycleReconcileReceipt | None = None
     occurred_at: datetime
+
+    @model_validator(mode="after")
+    def validate_reconcile_identity(self) -> Agent99TelegramLifecycleRequest:
+        receipt = self.reconcile_receipt
+        if receipt is None:
+            return self
+        if (
+            receipt.delivery_id != self.delivery_id
+            or receipt.incident_id != self.incident_id
+            or receipt.state_key != self.state_key
+        ):
+            raise ValueError("agent99_lifecycle_reconcile_identity_mismatch")
+        return self