Function run_delivery_canary 

pub fn run_delivery_canary<L: CanaryLauncher>(
    launcher: &L,
    capture_dir: &Path,
) -> CanaryOutcome

Run one delivery canary and report what it established.

Declares a fresh token, plants it in a throwaway prompt, runs launcher against a capture inside capture_dir, and hands the resulting capture text to agent_result::token_reported_in_capture — the one function in this codebase that decides whether a token came back from somewhere trustworthy. See this module’s header for why that decision is not made here. Every failure mode below is Unverified, never Absent. Absent is a claim about the CLI’s behaviour and may only be made after the CLI actually ran and produced a capture that could be read.