fix(reddit): narrow pre-send classification; clarify manual-ad destination

docs/knowledge/code/internal-platform-reddit.md

@@ -9,7 +9,7 @@ tags:
   - reddit-ads
   - oauth2
   - go-package
-timestamp: "2026-07-13T23:55:00Z"
+timestamp: "2026-07-15T00:00:00Z"
 ---
 
 # internal/platform/reddit
@@ -42,4 +42,30 @@ retries once WITHOUT communities (keyword/geo-only) and emits a
 communities-skipped warning step, so an invalid subreddit never orphans the
 PAUSED campaign.
 
+Because create calls are mutating and paid, a FAILED create is classified by
+whether the request may have reached Reddit. `isPreSendDialError` reports a Do
+error as pre-send (request definitely NOT sent → clean not-created failure) ONLY
+for proofs that no bytes left the client: DNS resolution failure, and
+connection-refused/no-route/network-unreachable dial failures. NO TLS error is
+treated as pre-send (matching the merged Meta client): a TLS error is not a
+reliable pre-send proof for an arbitrary caller-supplied transport — a custom
+transport can enable renegotiation, and a wrapping/retrying `RoundTripper` can
+surface a `*tls.CertificateVerificationError` or `tls.RecordHeaderError` while
+reading a response after forwarding the POST — so both flow to the UNCONFIRMED
+path. Redirect following is still force-disabled on every client used, including
+one supplied via `WithHTTPClient` (`CheckRedirect` overridden to
+`http.ErrUseLastResponse` unconditionally on a shallow copy, so the caller's
+client is not mutated), which keeps 3xx handling well-defined. Failures that
+prove NEITHER pre-send NOR rejection are treated as UNCONFIRMED (may have been
+applied): a 3xx on a MUTATING request (it reached a responder and may have
+committed before redirecting — a 3xx on a GET is not a create), a
+mid-flight/`Do`-time context error (the per-attempt timeout wraps the whole round
+trip, so it can fire after the POST reached Reddit), and a read/decode failure on
+a 2xx body are wrapped as `transportError`; a 5xx status is returned as an
+`apiError` and classified by status. `createOutcomeAmbiguous` treats all of these
+as "may exist", so callers require verification before a manual retry. A definite
+4xx is NOT UNCONFIRMED — Reddit
+received and REJECTED the request, so nothing was created and the caller gets a
+clean failure.
+
 See [internal/platform/reddit](../../../internal/platform/reddit).

docs/knowledge/log.md

@@ -1,5 +1,30 @@
 # Log
 
+## 2026-07-15
+
+**Update** — Hardened the Reddit Ads client's ambiguous-outcome classification
+(PR #27): `isPreSendDialError` now proves pre-send ONLY for DNS resolution and
+connect-time dial failures (ECONNREFUSED/EHOSTUNREACH/ENETUNREACH). NO TLS error
+is treated as pre-send, matching the merged Meta client — a TLS error is not a
+reliable pre-send proof for an arbitrary caller-supplied transport (renegotiation,
+or a wrapping RoundTripper surfacing a cert/record error while reading a response
+after forwarding the POST), so both `*tls.CertificateVerificationError` and
+`tls.RecordHeaderError` flow to the UNCONFIRMED path — the safe classification.
+Redirect following is still force-disabled on every client used, including one
+supplied via `WithHTTPClient` (`CheckRedirect` overridden to
+`http.ErrUseLastResponse` UNCONDITIONALLY on a shallow copy, so the caller's
+client is not mutated), which keeps 3xx handling well-defined. A 3xx on a MUTATING
+request is classified UNCONFIRMED (it reached a responder and may have committed
+before redirecting); a 3xx on a GET is not a create. A context error surfaced
+from an IN-FLIGHT `Do` stays UNCONFIRMED (the per-attempt ctx wraps the whole
+round trip, so it can fire after the POST reached Reddit) — but a cancellation
+returned while waiting for token refresh is a proven pre-POST failure
+(`refreshToken` returns `ctx.Err()` directly) and remains non-ambiguous.
+5xx/mid-flight transport failures also stay UNCONFIRMED. Reworded the
+manual-fallback UTM step to SET/REPLACE the utm_* params (matching
+`buildRedditUTMURL`'s `url.Values.Set`), keeping all other query params and
+dropping a trailing path slash.
+
 ## 2026-07-13
 
 **Creation** — Added OKF concept doc for internal/platform/meta (Meta Ads Graph