The Gateway records RESERVED before dispatch, DISPATCH_STARTED before the write, and an acknowledgment only after the target response. A crash after target success therefore remains DISPATCH_UNKNOWN.
Recovery does not retry the write. It asks the customer-operated Probe to read target state and compare it with the committed outcome predicate. A verified target state yields RECONCILED_SUCCESS; a mismatch yields failure; unavailable evidence remains unknown.
The acceptance test injects a crash after target success and asserts:
- the final state is reconciled;
- exactly one target dispatch occurred;
- the recovery chain is included in the packet digest;
- both offline verifiers accept the recovered packet.
This proves the reference process behavior under the injected boundary. It does not prove transactional semantics for every vendor API. A production adapter must define its own idempotency and read-after-write guarantees.