Make a never-attempted mirror visible, and stop replay restamping the date

Two real leads on 2026-08-26 landed in the DB with no Sheet row and no mirror
row at all: the empty-env window meant the Sheet call never ran. Because
/mirrors/failed looked for state='failed', a mirror that was never attempted
read exactly like one that was never owed, and the summary reported a clean
failed_mirrors: {} while two families were missing from the sheet.

/join now writes a `pending` mirror row for every target BEFORE attempting any
of them, so the gap between "owed" and "done" is a row rather than an absence.
set_mirror_pending never downgrades an attempted mirror. failed_mirror_records
covers failed and pending, since both need replaying, and summary reports
pending_mirrors alongside failed_mirrors.

sheet_append also stamped the Sheet with datetime.now(), so replaying a lead
filed it under the day of the replay rather than the day the family submitted.
It now takes the submission timestamp off the record and only falls back to now
when there isn't one.

app/app.py

@@ -578,8 +578,12 @@ def sheet_append(rec):
         sheet.append_row(SHEET_HEADERS)
     elif len(vals[0]) == 7:
         sheet.update_cell(1, 8, "Comments")
+    # The submission time, not the time of the write. A replay months later must
+    # not relabel a lead as arriving today.
+    stamp = (rec.get("ts") or "")[:16].replace("T", " ") \
+        or datetime.datetime.now().strftime("%Y-%m-%d %H:%M")
     sheet.append_row([
-        datetime.datetime.now().strftime("%Y-%m-%d %H:%M"),
+        stamp,
         rec["parent_name"], rec["email"], rec["phone"], rec["children"],
         rec["interested_in"], rec["source"], rec["message"],
     ])
@@ -653,6 +657,12 @@ def join_post(parent_name: str = Form(...), email: str = Form(...), phone: str =
             message=rec["message"], payload=rec, submitted_at=rec["ts"])
     except Exception as e:
         print("STORE WRITE FAILED for %s <%s>: %s" % (rec["parent_name"], rec["email"], e), flush=True)
+    # Register every mirror as pending BEFORE attempting it. If the process dies
+    # or a call never runs, the gap is visible and replayable instead of the row
+    # simply having no mirror record at all.
+    if record_id:
+        for _t in store.TARGETS:
+            store.set_mirror_pending(record_id, _t)
     sheet_error = None
     try:
         sheet_append(rec)