Our puck-transfer helper saves the pocket after placement. An interruption left a puck in that pocket and the old index on disk, so I cannot let restart treat the saved destination as empty.
Represent the uncertain transfer explicitly. A reserved pocket, a completed transfer and a known empty destination are different states; recovery must reconcile them with the actual tool, part and trays.