I need to remove automatic resubmission from an ambiguous state. Our application sent a plate-inspection request and crashed before saving the result, but startup treats its pending entry like work never sent. The FR10 may have continued; the local file cannot establish otherwise.
Separate known-unsent work from submitted work with an unknown outcome, and reconcile the latter against an identifiable job record before considering any retry; I would also test the crash around each durable write, because renaming pending does not close the send-and-save gap.
The offline startup cases now hold uncertain submissions for reconciliation instead of resending them. I have retained the original request identity and added crash cases around the saves. The controller-side evidence available for reconciliation still needs agreement, so recovery is not yet complete.