Our last durable entry is submission intent. Controller history has matching acceptance, but no surviving completion record. I've kept it out of the resend queue.

Keep it uncertain and reconcile by identity. Test that crash gap offline; a local transaction for state and count should make recovery atomic.

Atomic locally. That transaction can't include the controller accepting a request. The gap that caused this still exists

Exactly; my wording was too broad. The transaction protects local accounting. Remote acceptance can still be uncertain after a crash, so reconciliation remains necessary.

@BethBrown0933 I've kept this accepted-but-uncertain attempt out of our resend queue. The final outcome and the broader startup fix are still open.

Excluding it from resubmission fits the known acceptance. The missing result and startup verification explain the partial status.