# Save the applied work before the optional review

*When a paid job is interrupted · Implementation + restart log. From the portfolio of Guilherme Rohden. Excerpts are quoted verbatim; internal paths and identifiers are redacted.*

The ordering fix and the restart log: resumed at segment 2, segments 0 to 4 applied once each, 360 credits on the receipt, the job record and the ledger.

## The decision

Editing a long video had to survive a restart at any segment and leave a receipt that can be audited. The fix records each segment’s edits, and saves the job’s place, immediately after those edits are applied.

The failure was consequential: one segment was retried four times after its proxy review timed out, repeating a trim while its receipt would describe one application. Catching that timeout alone would leave other calls between mutation and checkpoint able to cause the same problem.

**The corrected order:**

1. Apply the segment’s edits to the current document.
2. Upsert its receipt entry, then record the last applied segment.
3. Run stills and optional review.
4. Enrich the same receipt entry with review results.

Recovery can now begin with incomplete review details. That preserves a distinction the product needs: an edit can be applied before its quality has been reviewed.

## From the source

**Implementation.** The ordering and its explicit persistence contract:

```typescript
    upsertSegment(entry);
    lastApplied = current.index;
    // Best-effort BY CONTRACT (see `edit-pass-checkpoint.port.ts`): the adapter
    // catches, warns and resolves, so this never throws and cannot itself
    // become the gap it exists to close.
    await writeCheckpoint(current.index);
```

**Local API-restart log, 5 September 2026.** Test locations are redacted; values and ordering are unchanged:

```text
  console.log
      resumedFrom=2 expected=2 (checkpoint lastApplied=1)

      at Object.log ([REDACTED: test source location])

  console.log
      sweep:resumed x1 at 2026-09-05T22:05:00.095Z → recovery 499s after the restart

      at Object.log ([REDACTED: test source location])

  console.log
      ladder: split@v2 global_planned@v3 segment_applied[0]@v4 segment_applied[1]@v5 segment_applied[2]@v6 segment_applied[3]@v7 segment_applied[4]@v8

      at Object.log ([REDACTED: test source location])

  console.log
      parts applied in order: [0,1,2,3,4] duplicates=[]
```

**Same log.** The quote is a cap; the matching receipt, job-row and ledger amounts are the actual charge:

```text
  console.log
      MONEY restart quoted=390 receipt=360 row=360 ledger=360
```

## What this shows

The job resumed at segment 2 from a checkpoint naming segment 1, applied five segments with no duplicates, and three accounting records agreed on 360 credits within the 390-credit cap. The recovery sweep picked it up **499 seconds after restart**.

The checkpoint write is **best-effort**, and mutation and checkpoint are not one atomic transaction. The fix closes the observed review-timeout replay window rather than guaranteeing exactly-once execution across every crash.