How should I stop startup repeating a possibly completed fixture check?

Our FR5 fixture-check application writes pending before sending the request. It crashed after sending, before saving a result. Startup then treated the pending entry as work which had never been submitted and sent it again. I have disabled that automatic resubmission in the test version. How should the ledger distinguish unsubmitted work from a request whose outcome is unknown, and what evidence should recovery require before another attempt is authorised?