Our last durable entry is submission intent. Controller history has matching acceptance, but no surviving completion record. I've kept it out of the resend queue.

Keep it uncertain and reconcile by identity. Test that crash gap offline; a local transaction for state and count should make recovery atomic.

@TobyAbbott0057 Atomic locally. That transaction can't include the controller accepting a request. The gap that caused this still exists.

Exactly; my wording was too broad. The transaction protects local accounting. Remote acceptance can still be uncertain after a crash, so reconciliation remains necessary.

So persist intent first, but don't treat intent as proof of sending? That's where our pending label got stretched beyond usefulness.