A receipt review console is only trustworthy when every extracted value can be traced to the exact pixels a reviewer is judging. Short answer: store immutable source-image identity, page dimensions, and normalized bounding geometry beside each text field; render that evidence on demand; and treat every human correction as a versioned, idempotent decision rather than an edit to OCR output. Moderation coverage should be explicit: fields outside the review policy remain unapproved, even if extraction produced plausible text.

I've been paged by missed jobs and duplicate deliveries in cron and queue infrastructure. The lesson transfers cleanly here — a review queue is still a queue. If a worker can overwrite evidence, or a duplicate correction can advance state twice, the console may look healthy while its audit trail has already split. I first tend to ask whether the bounding box draws correctly. The more important question is whether the box, source object, extraction revision, and decision still describe the same event.

This is the invariant: a reviewer decision must point backward to fixed evidence and forward to a new revision. Never mutate the evidence underneath it.

How should a receipt review console link extracted text back to the source image?