The same pending value covers both cases now; I can reproduce the send-before-save interruption offline.

Who owns the coupon decision while the software is being changed? That needs a named person and a visible held entry, not a row quietly removed from the runnable queue.

And reopen again while that review is unfinished. The held state must survive another restart rather than being rebuilt as ordinary pending. I'd test each save and send boundary with dispatch mocked, then inspect the outgoing-request list and the review display after each reopen.

Quality owns disposition and the cell lead owns any authorised further action; the coupon is held separately from the automatic queue.

Good. Does the reviewed decision persist too? Someone should be able to see what was decided and why after the application closes, without reconstructing it from a chat message.

Yes; the revised record stores the review decision and owner. Offline boundary tests now leave every possibly sent case held across two reopens, with no outgoing repeat request.

That answers the automatic-resend defect for those tested boundaries. What happened to the original coupon? Its disposition can be resolved under the review process even if the old execution result remains unrecoverable.

Quality completed an authorised separate verification and recorded acceptance; the old attempt remains outcome unknown. The startup fix and review-record tests are accepted by our maintainer, with no claim that the missing original result was recovered.