docs(dn): record consistency fix evidence

.superpowers/sdd/2026-09-18-hybrid-delivery-note-ingestion/task-3-report.md

@@ -39,8 +39,8 @@ Diff hygiene: `git diff --check` passed.
 
 ## Self-review and concerns
 
-- Only the three scoped Task 3 files were committed; Clock/photo-app files were
-  untouched.
+- Only the three scoped Task 3 implementation/test files were changed; report
+  evidence is stored alongside the SDD and Clock/photo-app files were untouched.
 - Invalid files are represented in a 201 multi-file response so valid sources
   are not lost; a single invalid file retains the legacy 400 validation payload
   (including `max_bytes`, `got`, and `allowed` where applicable).
@@ -54,6 +54,10 @@ Diff hygiene: `git diff --check` passed.
 
 `6e298990e407e3f71085ece4f432259f87c6403d fix(dn): harden bulk upload idempotency`
 
+Fix round 2 implementation:
+
+`00e82e51a51a17eb4545d2b74bfbf44bc80570b0 fix(dn): close bulk upload consistency gaps`
+
 ## Fix round 1 evidence
 
 - Preflighted source hashes before batch creation. Single-duplicate and
@@ -76,3 +80,22 @@ file, 11 tests.
 `npm run typecheck` — passed (`tsc --noEmit`).
 
 `git diff --check` — passed.
+
+## Fix round 2 evidence
+
+- Oversized single-file validation now returns the exact legacy payload with
+  `error`, `filename`, `max_bytes`, and `got`.
+- Equal hashes within one request are deduplicated in memory; only one source
+  is written and later duplicate outcomes point at the new batch.
+- A `dn_batches.source_count` update failure deletes the newly-created batch
+  and returns HTTP 500 with a visible error. If deletion also fails, the
+  response and log include both the update and cleanup failures.
+
+Exact fix-round 2 verification:
+
+`npx vitest run src/app/api/delivery-notes/upload/route.test.ts` — passed, 1
+file, 14 tests.
+
+`npm run typecheck` — passed (`tsc --noEmit`).
+
+`git diff --check` — passed.