Our FR5 inspection application crashed after sending a coupon check and before saving the answer. Startup put it beside work that had never been sent, then offered to submit the whole pending list. I've stopped that bulk action in the test build. We need a distinction the application can establish, not just two prettier labels for the same missing information.
Treat the sent-but-unresolved attempt as held for reconciliation, with its identity retained; absence of a saved result does not establish that nothing was submitted.
The local record has a durable attempt identity saved before sending. The startup code ignores it and looks only for a result. We have a saved replay of the crash interval.
The offline tests now keep the held identity through restart and attach the late result to its original attempt. Nothing resubmits from opening the list.
Quality owns disposition; the cell owner owns any authorised further attempt. Matching a result will not release the coupon or start work. Those routes are being written into the handover.
Keep genuinely unsubmitted work tested separately, including a crash around the send boundary; the new hold should not merely move the old ambiguity into another field.
Agreed. The developer is reviewing that boundary with the PLC author. The replay fix is useful, but we are not calling the complete restart design finished.