Save the applied work before the optional review

The decision

Editing a long video had to survive a restart at any segment and leave a receipt that can be audited. The fix records each segment’s edits, and saves the job’s place, immediately after those edits are applied.

The failure was consequential: one segment was retried four times after its proxy review timed out, repeating a trim while its receipt would describe one application. Catching that timeout alone would leave other calls between mutation and checkpoint able to cause the same problem.

The corrected order:

1. Apply the segment’s edits to the current document.
2. Upsert its receipt entry, then record the last applied segment.
3. Run stills and optional review.
4. Enrich the same receipt entry with review results.

Recovery can now begin with incomplete review details. That preserves a distinction the product needs: an edit can be applied before its quality has been reviewed.

From the source

Implementation. The ordering and its explicit persistence contract:

    upsertSegment(entry);
    lastApplied = current.index;
    // Best-effort BY CONTRACT (see `edit-pass-checkpoint.port.ts`): the adapter
    // catches, warns and resolves, so this never throws and cannot itself
    // become the gap it exists to close.
    await writeCheckpoint(current.index);

Local API-restart log, 5 September 2026. Test locations are redacted; values and ordering are unchanged:

  console.log
      resumedFrom=2 expected=2 (checkpoint lastApplied=1)

      at Object.log ([REDACTED: test source location])

  console.log
      sweep:resumed x1 at 2026-09-05T22:05:00.095Z → recovery 499s after the restart

      at Object.log ([REDACTED: test source location])

  console.log
      ladder: split@v2 global_planned@v3 segment_applied[0]@v4 segment_applied[1]@v5 segment_applied[2]@v6 segment_applied[3]@v7 segment_applied[4]@v8

      at Object.log ([REDACTED: test source location])

  console.log
      parts applied in order: [0,1,2,3,4] duplicates=[]

Same log. The quote is a cap; the matching receipt, job-row and ledger amounts are the actual charge:

  console.log
      MONEY restart quoted=390 receipt=360 row=360 ledger=360

What this shows

The job resumed at segment 2 from a checkpoint naming segment 1, applied five segments with no duplicates, and three accounting records agreed on 360 credits within the 390-credit cap. The recovery sweep picked it up 499 seconds after restart.

The checkpoint write is best-effort, and mutation and checkpoint are not one atomic transaction. The fix closes the observed review-timeout replay window rather than guaranteeing exactly-once execution across every crash.