The ledger is a complete checkpoint log, so interruption is never loss. A job stopped mid-phase (crash, restart, operational error) is marked interrupted — not failed — and resume re-enters at the last completed stage read from the ledger: encode-done → IR; IR-frozen → build; build-done → RHA; mid-RHA → the sweep continues from the last committed repair, and already-green nodes are not re-healed. Freeze hashes are re-verified on every re-entry. A 45-minute run should never be re-paid because of a restart.