I cannot justify automatically retrying every pending housing verification after our application crash: the request may have reached the UR5e and continued while its result was never saved, but the same pending state also means unsubmitted work. What recovery distinction should replace that assumption?
Split known-unsent work from uncertain execution, and hold the latter for reconciliation with available PLC and controller evidence. A missing local result doesn't prove the request never ran, whatever the old helper calls that row.
Test the boundaries before send, after possible send and around saving the reply. Keep a distinct attempt identity and an agreed review route for cases whose execution evidence cannot be recovered.
The offline restart tests now leave the post-send case unresolved rather than resubmitting it; the PLC correlation and authorised recovery decision are still with the interface owners.
Does the startup view explain that unresolved state to the next shift? I'd want the evidence to collect and the escalation role visible, without the screen suggesting a repeat operation has been approved.