Puck in the destination pocket, saved number still pointing there. The place happened before the save. We can't infer from every old pending record that it failed at that same point, though.

How is the tray identified across a restart? Even a correctly retained pocket number needs to refer to the same physical tray and loading arrangement, including any manual changes made while the program was stopped.

Only by the operator's selected job name at present. I've asked the programmer to separate tray identity and transfer identity from the pocket count, with an unresolved state when the physical arrangement can't be reconciled.

Has automatic continuation been held for these uncertain cases while that design is reviewed?

Yes. Offline restart tests now hold the place-before-save case and an unknown tray instead of advancing or repeating. The recovery procedure and evidence for clearing the hold still need the cell team's agreement.

Please bring back the agreed recovery boundary when available. Include interruption during the recovery decision itself; otherwise the operator may reconcile the puck successfully and still leave the next startup with another ambiguous record.