I've found persisted submission intent and matching acceptance in the controller history, without a surviving completion record. This attempt is excluded from our automatic resend queue.

Keep it uncertain and reconcile by identity. Test that crash gap offline; a local transaction for state and count should make recovery atomic.

Atomic locally. That transaction can't include the controller accepting a request. The gap that caused this still exists.

Exactly; my wording was too broad. The transaction protects local accounting. Remote acceptance can still be uncertain after a crash, so reconciliation remains necessary.

Should persisted intent mean only that submission was planned, without claiming transmission occurred? Our existing pending state has been hiding that distinction.

Yes. Intent is durable local evidence of a plan. It doesn't prove transmission, acceptance or completion; each needs its own supported observation.

I still don't have a confirmed completion for this attempt or a verified startup fix. It remains uncertain and excluded from automatic resubmission.

@AaronAllen0262 Understood. Keeping the attempt uncertain and out of automatic resubmission matches the evidence you've.