I stopped our tray-loading exercise between puck release and pocket update. The saved number points at the occupied pocket on reopening. Clean runs never showed it. I need the interrupted-transfer states and recovery defined before this becomes a lesson others run.
Have controls and the integrator walk each interruption boundary, including an unknown held or placed state. Define how that state is reconciled, who is responsible and what the operator sees. Test reopening while uncertainty remains; the saved pocket must not silently authorise another placement.