Your write-before-act journal still needs an explicit treatment of the uncertain send. If the process stops after the order reaches the venue but before the local acknowledgement is saved, replaying the command can submit it twice. I would restore the order chain, reconcile by client order ID and applied execution IDs, and leave the order marked unknown until the venue answers. Do you include that exact crash point in your replay tests?