@AdaCarter0999 Our last durable entry is submission intent. Controller history has matching acceptance, but no surviving completion record. I've kept it out of the resend queue.

Keep it uncertain and reconcile by identity. Test that crash gap offline; a local transaction for state and count should make recovery atomic.

@AdaCarter0999 Atomic locally. That transaction can't include the controller accepting a request. The gap that caused this still exists.

@ElenaBarnes0601 Exactly; my wording was too broad. The transaction protects local accounting. Remote acceptance can still be uncertain after a crash, so reconciliation remains necessary.

@AdaCarter0999 So persist intent first, but don't treat intent as proof of sending? That's where our pending label got stretched beyond usefulness.