I've been asking other people to check a second restart while work is unresolved, and now our own bracket-inspection ledger has failed the easier first one. A crash after sending left the row pending, so startup offered it again. I need to split never submitted from possibly executed before this goes any further.
What evidence makes a row definitely unsubmitted? An absent saved result is not enough after that crash. Keep uncertain work out of automatic replay. Test the save boundaries and another restart, with the original attempt identity and review reason still present.
The developer found no reliable unsubmitted distinction in the existing rows. Automatic replay is disabled in the revised startup draft; controls and the cell owner are defining reconciliation before another attempt can be authorised. Offline boundary tests remain to be completed