DEV Community: Julian Tao

A moderation timeout should release quota without retrying a paid request

Julian Tao — Tue, 20 Oct 2026 09:42:23 +0000

A safety check can fail before a media provider has received a generation request. Your queue needs to represent that state separately from an uncertain generation submission. Otherwise, a visitor can lose a concurrency slot indefinitely even though there is no generation task to poll.

We encountered this while operating Rendastic, a Go and SQLite application that submits video and image jobs to external providers. Several jobs stayed in a pending-confirmation state after an automated content check stopped returning a usable result. Restarting the application preserved the stuck state. Retrying the same paid POST could introduce a second charge.

Here is the state-model change we used, and how to test it without generating media.

Keep customer reservations and provider uncertainty separate

A request can reserve three different things:

A customer's free attempt or credits.
A local concurrency slot.
A conservative budget for an external provider request.

These reservations have different lifecycles. When a required safety check cannot finish, we can fail the customer job and release the first two. The external request may still have incurred a charge, so its journal entry and uncertain cost reservation remain unchanged.

Releasing a customer's allowance does not prove that the provider refunded anything. That distinction matters when reconciling costs later.

Use distinct error states

Our original generic uncertainty path was useful for a media submission that might have reached the provider. It was insufficient for a failed safety check with no pollable task identifier.

We introduced a typed moderation-unavailable error and gave content checks a bounded deadline. The following is illustrative pseudocode for the decision:

if required_check_is_unavailable:
    withhold_unchecked_result()
    fail_customer_job_and_release_customer_reservation()
    preserve_original_provider_journal()
elif main_generation_submission_is_uncertain:
    hold_customer_job_for_reconciliation()
    preserve_original_request_key()

The first branch concerns technical failures: timeout, transport failure, or an unusable safety verdict. An explicit policy refusal is a separate business outcome and should have its own disclosed handling.

No unchecked result becomes downloadable in either branch. An uncertain external request keeps its original identity; it is never retried under a fresh key merely to escape the uncertain state.

Commit the terminal transition and release together

The customer's job status and quota or credit release need to change in one database transaction. A process crash between those operations can otherwise leave a failed job that still consumes quota, or a running job whose credits were already returned.

The operation also needs to be idempotent. Two workers can observe the same failure, and maintenance can run after a restart. A terminal-state guard should ensure that repeating settlement neither returns credits twice nor changes an already-settled result.

SQLite transactions are useful here because job admission, local quota, and the credit ledger live in the same database. Systems using separate services need an equivalent reconciliation mechanism rather than assuming cross-service writes commit together.

Recover old jobs conservatively

We restricted historical recovery to identifiable, stale moderation requests with no task ID and no unresolved main media request. A job with evidence of an accepted or uncertain media submission stayed in reconciliation.

This scope avoided treating every old pending job as safe to release or replay. We compared the provider journal before and after recovery to confirm that repairing the customer state did not create new external requests or erase uncertain provider costs.

Test failure paths without paying for media

A local fake provider can return a timeout, a pending response, a valid refusal, or a completed response. The important assertions are behavioral:

An unavailable safety check releases the customer's reservation and concurrency slot.
No unchecked output is served.
Reprocessing the same request does not issue another paid POST.
Settling the same failure twice does not return credits twice.
An uncertain main generation task remains held for reconciliation.
Recovery after restart preserves the original external request journal.

Successful generation tests alone do not cover these boundaries. A useful acceptance run should explicitly interrupt each stage where customer state and provider state can diverge.

Disclosure: I operate Rendastic, where we implemented this recovery flow. This article describes our application behavior, not a guarantee about another provider's billing or moderation decisions. This draft was generated by an AI agent and checked against our implementation and recorded tests.

Public sharing as a snapshot, not a live editor

Julian Tao — Sat, 10 Oct 2026 15:55:57 +0000

A sharing button changes the trust boundary of a transcription app. The editor belongs to one person; anyone holding a public link can read the published text. Those are separate responsibilities.

I am Julian Tao, the maker of ShortTranscript. This note describes the sharing behavior we implemented, rather than a claim that transcripts are automatically accurate.

Separate the private draft from the public snapshot

Publishing an editable result directly would make every later correction public. Instead, the owner reviews the draft, chooses a public title, confirms permission, and creates a snapshot. Private edits do not silently change it. An explicit update refreshes the snapshot at the same link.

The public representation only needs the chosen title, a platform label, reviewed text and timestamps. It does not need the account email, private job identifier, uploaded filename or original video address. Use a separate random public identifier rather than exposing the private job route.

Revocation is a lifecycle operation

Turning sharing off invalidates the link. Recreating it produces a different identifier. Deleting the original result also removes its snapshot. For expiring guest results, access must stop at expiry even before a scheduled cleanup runs. None of these operations can recall copies another person already saved.

Unlisted is still public

A noindex directive asks search engines not to index a page; it is not access control. The UI should say that anyone with the link can read it. Do not create links by default, and do not place them in a sitemap.

A useful acceptance sequence is: create, open without a login, edit privately, check that the snapshot is unchanged, update deliberately, revoke, recreate, and delete the original. Check the exported public fields at each step.

The Instagram transcription tool I maintain produces drafts that should be checked against the source audio before sharing. This is a maker-authored implementation note, not an independent review.

Disclosure: AI assisted the drafting of this note. Its product claims were checked against the implemented behavior and acceptance evidence.

Classifying failure modes in URL-based transcription

Julian Tao — Fri, 02 Oct 2026 16:05:10 +0000

A single “transcription failed” bucket hides several different problems. For a link-based tool, the source may be unavailable, playback may begin muted, the audio may contain music without speech, or speech may be present but masked by noise. Those cases need different follow-up tests.

A useful test record starts with retrieval: does the public URL load from a clean session, and can the audio be played? Next, note the actual sound after unmuting the player. Then classify the audio as clear speech, mixed speech and noise, music-only, silence, or uncertain. Finally, record whether a transcript was returned, how long it took, and whether the result needs human correction.

Keep the categories separate. A deleted or restricted URL is an access failure, not a recognition error. Music-only audio should not produce invented dialogue. Distant or overlapping speech should remain visibly uncertain rather than being presented as exact wording. Timestamps help a reviewer return to the source, but they do not certify accuracy.

For a small product, a fixed set of clips can be varied by accent, duration, music, background noise, and source platform. Report the sample size and individual causes; do not generalize from a handful of clips.

I am Julian Tao, the independent maker of ShortTranscript, a browser tool for public TikTok and Instagram Reels links. The free workflow and supported formats are described at https://shorttranscript.com/. This article is original, AI-assisted in editing, and reviewed by me.