test(web): the 499 test cancels the client mid-Accept, as a real hang-up does

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -127,6 +127,9 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
   implement `uploads.Planner` to declare its own phases. The page tells running / quiet / lost from
   two timestamps (`alive_at` heartbeat vs `progress_at`) and never shows a percentage that does not
   come from real counts. **Nothing logged may carry transcript text, words from it, or the spool path.**
+  Errors reach a log, a row or a page as `errkind.Of(err)` (a kind such as `timeout` or `http_502`),
+  never `err.Error()`: error text can hold a provider's response body, the spool path or transcript
+  words (ADR-035 decision 8). Local-only for anything that carries transcript text: `config.IsLocalModel`.
   `TAPIR_SHOT_DIR=… go test -run TestRenderUploadProgressStatesForReview ./internal/web` renders every
   state for a screenshot review.
   **Lint caveat:** `task check` does not fail on lint (#41: the Taskfile `|| echo` swallows

DECISIONS.md

@@ -1461,8 +1461,9 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
    - **The opening model.** The offered list leads with the summarizer default `koala/phi4-mini`,
      whose 8,192-token context returns HTTP 400 on an hour of speech (~13,000 tokens). Chat over
      an upload opens on `TAPIR_UPLOAD_CHAT_MODEL` (default `iguana/gemma4-26b`); the switcher
-     still lists every model, and picking `phi4-mini` on a long recording fails loudly and
-     inline. A per-model budget is not built.
+     lists **local models only** (amended by ADR-035 after the adversarial review found it listed
+     the cloud model too: the whole private transcript goes to the one chosen), and picking
+     `phi4-mini` on a long recording fails loudly and inline. A per-model budget is not built.
    Past ~90,000 chars (≈100 minutes) no offered model can answer by stuffing; see triggers.
 
 9. **Not decided here.** Rich `AVSNITT`/`ALTERNATIV` analysis (gated on #30 — `analyze_srt.py`
@@ -1513,13 +1514,20 @@ deferred. The scope cut — chat first, no rich analysis, no video — is what k
   ADR-016 window, it was the interesting thing, not the useful one — remove it.
 
 **Open items this ADR creates.**
-- **DECISION NEEDED — ffmpeg in the runtime image.** *Options:* (A) static ffmpeg/ffprobe copied
+- **DECIDED (Mathias, 2026-10-02): option A.** Static ffmpeg and ffprobe 7.0.2 are copied into the
+  distroless image, pinned by version and sha256 (Dockerfile in this PR; #34). Measured at that time:
+  **about 160 MB** added, not the 70 MB first estimated (80 MB per binary); the build is **GPLv3**;
+  the checksum proves the bytes reviewed, not the publisher; upstream's `releases/` URL moves on, so
+  vendoring the verified tarball is the durable fix (not done). Uploads stay off until the deployment
+  sets `TAPIR_UPLOADS_ENABLED`. *The question as it was put:* *Options:* (A) static ffmpeg/ffprobe copied
   into distroless **(recommended — the only option that satisfies "accept m4a/mp3/opus/mp4,
   validate duration, reject video"; pure-Go decoders cover wav/mp3 only)**; (B) accept WAV
   only, convert client-side (fails "I just want to upload it"); (C) a transcode sidecar
   (second deployable, ADR-018's reasoning against). *Blocks:* the Dockerfile slice, not the
   tests, which use the port.
-- **DECISION NEEDED — berget fallback for private audio.** *Options:* (A) enabled by default as
+- **DECIDED (Mathias, 2026-10-02): option A, enabled by default (#35).** Scope: the audio
+  transcription fallback only. Reconciliation text and chat over a recording never go to a cloud
+  model (ADR-034, ADR-035). *The question as it was put:* *Options:* (A) enabled by default as
   #33 specifies, with the serving endpoint shown **(recommended, matches the issue)**; (B)
   disabled by default, a failed iguana job fails honestly and the user retries. *Blocks:*
   the production default only; the adapter ships either way.
@@ -1642,6 +1650,12 @@ recording.
   ~30 disputes where the reconciled text differs from pianissimo alone. Keep the feature only if the
   reconciled reading is right at least 85% of the time **and** no worse than the better single engine.
   If not, switch it off (config) and keep the single-engine path.
+  **Decision (Mathias, 2026-10-02), on the first result below: keep it as an opt-in feature**, reading
+  the bar as 95% of decided items, with the second condition to be answered on the next real run.
+  For deployment the reconciler is `iguana/gemma4-31b` (97% against the speaker's answers, about 22
+  minutes for the 63.6-minute recording with Low Power Mode off). A cloud reconciler was raised and is
+  **not adopted**: it would send private transcript text to a cloud API on every upload; recorded as
+  an evaluation question in #45.
   **First result, 2026-10-02, before merge** (`docs/research/reconcile-blind-check-2026-10-02.md`): 30
   random replacement spots on the real 63.6-minute recording, judged blind by Opus from text (not by the
   speaker, who delegated it): 21 right, 1 worse than pianissimo, 3 neither reading right, 5 undecidable.
@@ -1711,6 +1725,51 @@ wording while only `content` is merged.
    a segment edge), they stay the base's and the result says so in the log. This replaces ADR-034
    decision 6's "segments stay untouched".
 
+8. **Hardening from the adversarial review** (`skills:pr-gatekeeper`, head `7029dd1`: BLOCK; recorded on
+   PR #39). Each finding was reproduced by a failing test first.
+   - **Chat over a recording offers and accepts local models only** (it listed `berget/mistral-small`);
+     `TAPIR_UPLOAD_CHAT_MODEL` must be local at start-up; with no local model, nothing is sent.
+   - **A model alias counts as local only if it is one plain name after `koala/` or `iguana/`**
+     (`koala/../berget/x`, `koala//x`, `koala/x?host=…` were accepted by a bare prefix check).
+   - **An error reaches a log line, the row or the page as a kind** (`timeout`, `canceled`, `http_502`,
+     `network`, `error`), never its text, which can hold a provider's response body, the spool path or
+     a word from the transcript (`internal/errkind`). The stored reconcile reason and an engine's
+     failure reason are kinds; the page no longer shows provider text.
+   - **Every local engine call has its own deadline** (`TAPIR_TRANSCRIBE_ENGINE_TIMEOUT`, default 20
+     minutes: two wedged engines in sequence then leave 20 of the job's 60 minutes for a fallback),
+     so a wedged engine fails while the job lives and the fallback can run; the job's own
+     deadline or a cancel still never reaches the cloud.
+   - **The duration limit is checked against what is converted**, not the file's header: ffmpeg is
+     capped at the limit plus a minute, a longer result fails the job (`audio_too_long`), and a result
+     under 80% of the claimed length and more than two minutes short is **transcribed and noted** on
+     the audio step ("the audio is 20 min long; the file claimed 1 h 19 min"), not refused. The second
+     adversarial review showed a complete variable-bitrate MP3 whose header over-estimated its length
+     by 4x was wrongly refused by the first version of this check; a note keeps a truncated file
+     visible without turning away real recordings.
+   - **The queue is bounded**, 20 waiting in total and 3 per user, and its room is checked before the
+     upload is spooled (not after 200 MB and an ffprobe run); a full queue is a 429 with a typed reason,
+     never a stuck row or a server error.
+   - **The configured upload chat model is callable.** It is added to the shared chat service's model
+     list when uploads are on and it is local, because the service re-maps a model it does not offer
+     (a valid `iguana/gemma4-31b` was being silently swapped for `koala/phi4-mini`). The video chat's own switcher
+     lists that local model too while uploads are on.
+   - **A client that hangs up mid-upload is not an error**: the handler logs INFO and writes nothing
+     (rendering the error page ran a database read on a cancelled context and logged a false ERROR). The
+     400 "cut off" answer is keyed on a marker for errors from *reading the client's body*
+     (`uploads.ErrClientRead`), not on `io.ErrUnexpectedEOF`, which is also what a database drop looks like.
+   - **A note is not hidden**: a finished upload's record opens by default when any step carries a note.
+   - **Bad input is a 4xx**: a non-UUID id is a 404, a malformed or cut-off multipart body is a 400
+     whose text is not logged, and a title with control bytes, bidirectional controls or invalid UTF-8 is
+     cleaned (emoji joiners, Swedish letters and variation selectors are kept), not a 500.
+   - **The image was built and inspected** (buildah on koala, 2026-10-02): the first build FAILED
+     (`tar: xz: Cannot exec`, the golang image has no xz); fixed, rebuilt at 180 MB, ffmpeg and ffprobe
+     run as `nonroot` in distroless. CI does not build the image on a pull request
+     (`if: github.event_name != 'pull_request'`), so the first CI build of it is the merge to main.
+   Not done, filed as follow-ups: a vendored ffmpeg tarball, CSRF cookie review, ffprobe CPU and
+   stream-count limits, mov external references, `alive_at` clock skew, a hung database blocking the
+   tracker, an unbounded gateway response body, a user-facing notice for a recording that is partial but
+   inside the tolerance.
+
 **Alternatives rejected.** Server-sent events or a websocket: a long-lived connection through the
 ingress, with buffering to get wrong, for a page that changes every few seconds at best; polling is what
 the page already does. A percentage from the engine calls: there is no data behind it. A separate

Dockerfile

@@ -16,12 +16,52 @@ COPY . .
 # no libc. Trim symbols/DWARF to shrink the layer.
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/tapir ./cmd/tapir
 
+# ── ffmpeg ──────────────────────────────────────────────────────────────────
+# Audio upload probes files with ffprobe and converts them with ffmpeg (ADR-033,
+# #34 option A). Static builds, so they run in the distroless image below.
+#
+# Pinned by version AND sha256: a changed upstream file fails the build instead of
+# shipping. The checksum proves these are the bytes that were reviewed (2026-10-02;
+# the publisher's md5 matched too). It does NOT prove authenticity: the publisher
+# signs nothing we can check. amd64 only (the cluster is one amd64 node).
+#
+# These builds are GPLv3 (--enable-gpl --enable-version3). The service is private and
+# the image is not distributed; the licence text is copied into the image anyway.
+#
+# The release URL moves on when upstream releases a newer version, so the pinned
+# version is tried in releases/ and then old-releases/. If neither has it the build
+# fails; vendoring the verified tarball is the durable fix.
+FROM golang:1.26 AS ffmpeg
+
+ARG FFMPEG_VERSION=7.0.2
+ARG FFMPEG_SHA256=abda8d77ce8309141f83ab8edf0596834087c52467f6badf376a6a2a4c87cf67
+
+# xz is not in the golang image (found by building it: `tar: xz: Cannot exec`).
+RUN set -eu; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends xz-utils; \
+    rm -rf /var/lib/apt/lists/*; \
+    mkdir -p /out; \
+    for dir in releases old-releases; do \
+      curl -fsSL -o /out/ffmpeg.tar.xz "https://johnvansickle.com/ffmpeg/${dir}/ffmpeg-${FFMPEG_VERSION}-amd64-static.tar.xz" && break; \
+    done; \
+    echo "${FFMPEG_SHA256}  /out/ffmpeg.tar.xz" | sha256sum -c -; \
+    tar -xJf /out/ffmpeg.tar.xz -C /out --strip-components=1 --wildcards '*/ffmpeg' '*/ffprobe' '*/GPLv3.txt'; \
+    rm /out/ffmpeg.tar.xz
+
 # ── runtime ─────────────────────────────────────────────────────────────────
 # distroless static + nonroot: no shell, no package manager, runs as uid 65532.
 # ca-certificates are bundled, which the OIDC/HTTPS clients need.
 FROM gcr.io/distroless/static-debian12:nonroot
 
 COPY --from=build /out/tapir /tapir
+COPY --from=ffmpeg /out/ffmpeg /out/ffprobe /usr/local/bin/
+COPY --from=ffmpeg /out/GPLv3.txt /usr/share/doc/ffmpeg/GPLv3.txt
+
+# Where the service finds them. Uploads stay OFF until TAPIR_UPLOADS_ENABLED is set
+# (a deployment decision, not an image one).
+ENV TAPIR_FFMPEG_BIN=/usr/local/bin/ffmpeg \
+    TAPIR_FFPROBE_BIN=/usr/local/bin/ffprobe
 
 EXPOSE 8080
 USER nonroot:nonroot

cmd/tapir/processor.go

@@ -134,9 +134,30 @@ func chatModels(cfg config.Config) []string {
 	add(cfg.SummarizerModel)
 	add(cfg.FallbackModel)
 	add(cfg.CloudFallbackModel)
+	// The model chat over an uploaded recording opens on must be one the shared service can
+	// call: it re-maps a model it does not offer, which silently swapped a configured 31B for
+	// phi4-mini, whose context cannot hold an hour of speech. Local only, and only when
+	// uploads are on, so the video chat is unchanged otherwise (second adversarial review).
+	if cfg.UploadsEnabled && config.IsLocalModel(cfg.UploadChatModel) {
+		add(cfg.UploadChatModel)
+	}
 	return models
 }
 
+// uploadChatModels is the chat switcher for a PRIVATE uploaded recording: the same
+// ordered set as chatModels, local models only. The whole transcript (up to 90,000
+// characters) is sent to the one chosen, so a cloud model the video chat offers must not
+// be offered here; with none local, none is offered (ADR-035 review).
+func uploadChatModels(cfg config.Config) []string {
+	var local []string
+	for _, m := range chatModels(cfg) {
+		if config.IsLocalModel(m) {
+			local = append(local, m)
+		}
+	}
+	return local
+}
+
 // buildChat wires the per-video chat service (ADR-027): a Completer factory over
 // the SAME LiteLLM gateway the summarizer uses (a different alias per model, not a
 // second client config) and the same transcript-truncation budget. It returns nil

cmd/tapir/uploads.go

@@ -55,8 +55,8 @@ func buildUploads(ctx context.Context, cfg config.Config, st uploadsStore, log *
 		log.Warn("uploads: marked interrupted by a restart (audio is not retained; they must be re-uploaded)", "count", n)
 	}
 
-	worker := uploads.NewWorker(st, &audio.FFmpeg{Bin: cfg.FFmpegBin}, buildTranscriber(cfg),
-		cfg.UploadTmpDir, cfg.TranscribeTimeout)
+	worker := uploads.NewWorker(st, newConverter(cfg), buildTranscriber(cfg),
+		cfg.UploadTmpDir, cfg.TranscribeTimeout, uploads.WithMaxDuration(cfg.UploadMaxDuration))
 	intake := uploads.NewIntake(st, &audio.FFprobe{Bin: cfg.FFprobeBin}, worker,
 		uploadLimits(cfg), cfg.UploadTmpDir)
 	return intake, worker, nil
@@ -91,6 +91,13 @@ func wireUploads(app *web.App, cfg config.Config, in *uploads.Intake) {
 	app.UploadLimits = uploadLimits(cfg)
 	app.UploadChatMaxChars = cfg.MaxUploadedTranscriptChars
 	app.UploadChatModel = cfg.UploadChatModel
+	app.UploadChatModels = uploadChatModels(cfg)
+}
+
+// newConverter is the ffmpeg adapter capped at the configured maximum duration, so a file
+// whose header lies about its length cannot become hours of WAV (ADR-035 review).
+func newConverter(cfg config.Config) *audio.FFmpeg {
+	return &audio.FFmpeg{Bin: cfg.FFmpegBin, MaxSeconds: int(cfg.UploadMaxDuration.Seconds())}
 }
 
 // adjudicatorTimeout bounds one adjudication call. A call takes ~2 s on gemma4-26b and ~10 s
@@ -107,7 +114,12 @@ func buildTranscriber(cfg config.Config) uploads.Transcriber {
 	// No overall client timeout: a 90 minute recording takes minutes. The deadline is
 	// the worker's per-job context.
 	client := &http.Client{}
-	primary := transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, cfg.TranscribeModel, client)
+	// Each LOCAL engine call gets its own deadline: a wedged engine does not answer, and
+	// without one it used the whole job before the fallback could run.
+	local := func(model string) transcribe.Backend {
+		return transcribe.WithTimeout(transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, model, client), cfg.TranscribeEngineTimeout)
+	}
+	primary := local(cfg.TranscribeModel)
 	var fallback transcribe.Backend
 	if cfg.TranscribeFallbackModel != "" && cfg.TranscribeFallbackModel != cfg.TranscribeModel {
 		fallback = transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, cfg.TranscribeFallbackModel, client)
@@ -116,7 +128,7 @@ func buildTranscriber(cfg config.Config) uploads.Transcriber {
 		return transcribe.NewChain(primary, fallback)
 	}
 
-	base := transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, cfg.ReconcileBaseModel, client)
+	base := local(cfg.ReconcileBaseModel)
 	// Temperature 0 and a short reply: the adjudicator's accuracy was measured that way.
 	chat := llm.New(cfg.GatewayURL, cfg.GatewayKey, cfg.ReconcileModel, adjudicatorTimeout,
 		llm.WithTemperature(0), llm.WithMaxTokens(200))

cmd/tapir/uploads_chat_models_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"git.d-ma.be/mathias/tapir/internal/config"
+)
+
+// The chat over an uploaded recording sends the whole private transcript to the model
+// the user picks, so the switcher for it may offer local models only (ADR-035 review).
+
+func TestUploadChatModels_NeverOffersACloudModelButKeepsTheLocalOrder(t *testing.T) {
+	var cfg config.Config
+	cfg.SummarizerModel = "koala/phi4-mini"
+	cfg.FallbackModel = "iguana/gemma4-26b"
+	cfg.CloudFallbackModel = "berget/mistral-small"
+
+	got := uploadChatModels(cfg)
+
+	want := []string{"koala/phi4-mini", "iguana/gemma4-26b"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("uploadChatModels = %v, want %v: the cloud model that the video chat offers must not be offered for a private recording", got, want)
+	}
+}
+
+func TestUploadChatModels_ACloudPrimaryIsDroppedToo(t *testing.T) {
+	var cfg config.Config
+	cfg.SummarizerModel = "berget/mistral-small"
+	cfg.FallbackModel = "iguana/gemma4-26b"
+
+	got := uploadChatModels(cfg)
+
+	if !reflect.DeepEqual(got, []string{"iguana/gemma4-26b"}) {
+		t.Errorf("uploadChatModels = %v", got)
+	}
+}
+
+func TestUploadChatModels_NoLocalModelMeansNoneOfferedNotACloudDefault(t *testing.T) {
+	var cfg config.Config
+	cfg.SummarizerModel = "berget/mistral-small"
+
+	if got := uploadChatModels(cfg); len(got) != 0 {
+		t.Errorf("uploadChatModels = %v, want none", got)
+	}
+}
+
+// A valid local TAPIR_UPLOAD_CHAT_MODEL that is not in the video chat's chain used to be
+// accepted by config and then silently ignored: the shared chat service re-maps a model it
+// does not offer, so the user got koala/phi4-mini, whose 8,192-token context cannot hold an
+// hour of speech (second adversarial review).
+
+func TestChatModels_AnUploadChatModelOutsideTheChainIsOfferedWhenUploadsAreOn(t *testing.T) {
+	var cfg config.Config
+	cfg.SummarizerModel = "koala/phi4-mini"
+	cfg.FallbackModel = "iguana/gemma4-26b"
+	cfg.UploadsEnabled = true
+	cfg.UploadChatModel = "iguana/gemma4-31b"
+
+	service := chatModels(cfg)
+	upload := uploadChatModels(cfg)
+
+	if !reflect.DeepEqual(service, []string{"koala/phi4-mini", "iguana/gemma4-26b", "iguana/gemma4-31b"}) {
+		t.Errorf("chatModels = %v: the shared service must be able to call the configured upload model", service)
+	}
+	if !reflect.DeepEqual(upload, service) {
+		t.Errorf("uploadChatModels = %v, want %v", upload, service)
+	}
+}
+
+func TestChatModels_NothingIsAddedWhenUploadsAreOffOrTheModelIsNotLocal(t *testing.T) {
+	var cfg config.Config
+	cfg.SummarizerModel = "koala/phi4-mini"
+	cfg.UploadChatModel = "iguana/gemma4-31b"
+
+	if got := chatModels(cfg); !reflect.DeepEqual(got, []string{"koala/phi4-mini"}) {
+		t.Errorf("uploads off: chatModels = %v, want the video chain unchanged", got)
+	}
+
+	cfg.UploadsEnabled = true
+	cfg.UploadChatModel = "berget/mistral-small"
+	if got := chatModels(cfg); !reflect.DeepEqual(got, []string{"koala/phi4-mini"}) {
+		t.Errorf("a cloud upload chat model was added to the service: %v", got)
+	}
+}

cmd/tapir/uploads_converter_test.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"git.d-ma.be/mathias/tapir/internal/config"
+)
+
+// The converter is told the configured maximum, so a file whose header lies about its
+// length cannot become hours of WAV (adversarial review F2).
+
+func TestNewConverter_IsCappedAtTheConfiguredMaximumDuration(t *testing.T) {
+	var cfg config.Config
+	cfg.FFmpegBin = "/usr/local/bin/ffmpeg"
+	cfg.UploadMaxDuration = 90 * time.Minute
+
+	c := newConverter(cfg)
+
+	if c.Bin != "/usr/local/bin/ffmpeg" {
+		t.Errorf("Bin = %q", c.Bin)
+	}
+	if c.MaxSeconds != 5400 {
+		t.Errorf("MaxSeconds = %v, want 5400", c.MaxSeconds)
+	}
+}

cmd/tapir/uploads_test.go

@@ -20,15 +20,17 @@ import (
 // fakeUploadsStore satisfies the store surface buildUploads needs, and counts the
 // start-up sweep.
 type fakeUploadsStore struct {
-	sweeps   int
-	sweepErr error
+	sweeps      int
+	sweepErr    error
+	failedKinds []domain.UploadErrorKind
 }
 
 func (f *fakeUploadsStore) CreateUpload(context.Context, string, string, bool) (string, error) {
 	return "id", nil
 }
 
-func (f *fakeUploadsStore) FailUpload(context.Context, string, string, domain.UploadErrorKind) error {
+func (f *fakeUploadsStore) FailUpload(_ context.Context, _, _ string, k domain.UploadErrorKind) error {
+	f.failedKinds = append(f.failedKinds, k)
 	return nil
 }
 

cmd/tapir/uploads_timeout_test.go

@@ -0,0 +1,78 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The wiring of the per-engine deadline: a gateway whose primary model never answers
+// must still reach the fallback model inside the job's own deadline (adversarial review
+// F4). The fake gateway answers per model from the multipart `model` field.
+
+func TestBuildTranscriber_AWedgedPrimaryReachesTheFallbackBeforeTheJobDeadline(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = r.ParseMultipartForm(1 << 20)
+		if r.FormValue("model") == "iguana/kb-whisper" {
+			<-r.Context().Done() // wedged: never answers
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"text":"hej","duration":1,"segments":[{"start":0,"end":1,"text":"hej"}]}`))
+	}))
+	defer srv.Close()
+	cfg := uploadCfg(t, true)
+	cfg.GatewayURL = srv.URL
+	cfg.TranscribeModel = "iguana/kb-whisper"
+	cfg.TranscribeFallbackModel = "berget/kb-whisper"
+	cfg.TranscribeEngineTimeout = 150 * time.Millisecond
+	wav := filepath.Join(t.TempDir(), "a.wav")
+	require.NoError(t, os.WriteFile(wav, []byte("RIFF....WAVEfmt "), 0o600))
+	job, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+
+	got, err := buildTranscriber(cfg).Transcribe(job, wav)
+
+	require.NoError(t, err, "the wedged primary used the whole job and the fallback never ran")
+	assert.Equal(t, "berget/kb-whisper", got.Endpoint)
+}
+
+func TestBuildTranscriber_AWedgedBaseEngineIsASoftFailureInTheEnsemble(t *testing.T) {
+	// The same deadline must guard the ensemble's BASE engine, not only the chain's primary
+	// (second adversarial review: the wiring was tested for the chain alone).
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = r.ParseMultipartForm(1 << 20)
+		if r.FormValue("model") == "iguana/pianissimo" {
+			<-r.Context().Done()
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"text":"hej","duration":1,"segments":[{"start":0,"end":1,"text":"hej"}]}`))
+	}))
+	defer srv.Close()
+	cfg := uploadCfg(t, true)
+	cfg.GatewayURL = srv.URL
+	cfg.TranscribeModel = "iguana/kb-whisper"
+	cfg.ReconcileBaseModel = "iguana/pianissimo"
+	cfg.ReconcileModel = "iguana/gemma4-31b"
+	cfg.TranscribeEngineTimeout = 150 * time.Millisecond
+	wav := filepath.Join(t.TempDir(), "a.wav")
+	require.NoError(t, os.WriteFile(wav, []byte("RIFF....WAVEfmt "), 0o600))
+	job, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+
+	got, err := buildTranscriber(cfg).Transcribe(job, wav)
+
+	require.NoError(t, err, "a wedged base engine must not use up the job")
+	assert.Equal(t, "hej", got.Text)
+	require.NotNil(t, got.Reconciliation)
+	assert.Equal(t, "single_engine", string(got.Reconciliation.Status))
+	assert.Contains(t, got.Reconciliation.Reason, "timeout")
+}

cmd/tapir/uploads_worker_limit_test.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+// The worker buildUploads returns enforces the configured maximum on what was really
+// converted (adversarial review F2). A stub ffmpeg writes a sparse 100-minute WAV however
+// short the file claimed to be; the gateway is never reached because the job fails first.
+
+func TestBuildUploads_TheWorkerRefusesAudioLongerThanTheConfiguredMaximum(t *testing.T) {
+	dir := t.TempDir()
+	stub := filepath.Join(dir, "ffmpeg")
+	require.NoError(t, os.WriteFile(stub, []byte("#!/bin/sh\nfor a; do last=\"$a\"; done\ntruncate -s 192000044 \"$last\"\n"), 0o700))
+	cfg := uploadCfg(t, true)
+	cfg.FFmpegBin = stub
+	cfg.UploadMaxDuration = 90 * time.Minute
+	cfg.TranscribeTimeout = time.Minute
+	st := &fakeUploadsStore{}
+	_, w, err := buildUploads(context.Background(), cfg, st, quietLog())
+	require.NoError(t, err)
+	src := filepath.Join(cfg.UploadTmpDir, "upload-x")
+	require.NoError(t, os.WriteFile(src, []byte("audio"), 0o600))
+
+	w.Process(context.Background(), uploads.Job{UserID: "u", UploadID: "id", Path: src, Duration: 10 * time.Second})
+
+	assert.Equal(t, []domain.UploadErrorKind{domain.UploadErrTooLong}, st.failedKinds,
+		"a file that claimed 10 s but converted to 100 minutes must fail, not be sent to an engine")
+}

docs/homelab-integration.md

@@ -23,15 +23,13 @@ it** — endpoints and aliases drift, and this file is a snapshot (2026-06-06),
   `{"error":"failed to process audio"}` string — it has had at least five causes. Tapir's knobs:
   `TAPIR_UPLOADS_ENABLED` (off by default), `TAPIR_UPLOAD_MAX_MB` (200), `TAPIR_UPLOAD_MAX_MINUTES`
   (90), `TAPIR_TRANSCRIBE_MODEL`, `TAPIR_TRANSCRIBE_FALLBACK_MODEL` (empty disables the cloud
-  fallback), `TAPIR_TRANSCRIBE_TIMEOUT` (30m), `TAPIR_UPLOAD_TMP_DIR`, `TAPIR_FFMPEG_BIN`,
+  fallback), `TAPIR_TRANSCRIBE_TIMEOUT` (60m, the whole job), `TAPIR_TRANSCRIBE_ENGINE_TIMEOUT` (20m, one engine call: a wedged engine then fails while the job lives and the fallback can run), `TAPIR_UPLOAD_TMP_DIR`, `TAPIR_FFMPEG_BIN`,
   `TAPIR_FFPROBE_BIN`, `TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS` (90000 — the measured ceiling of
   `iguana/gemma4-26b`, which silently drops the head above it), `TAPIR_UPLOAD_CHAT_MODEL`
-  (`iguana/gemma4-26b`; `koala/phi4-mini`'s 8,192-token context 400s on an hour of speech). Needs `ffmpeg` + `ffprobe`
-  in the runtime image; Tapir's own ingress body limit for a 200 MB upload is unverified (infra).
+  (`iguana/gemma4-26b`; must be a local `koala/` or `iguana/` alias, since the whole private transcript is sent to it; `koala/phi4-mini`'s 8,192-token context 400s on an hour of speech). `ffmpeg` + `ffprobe` are in the runtime image (static, pinned by sha256; #34 decided A on 2026-10-02); Tapir's own ingress body limit for a 200 MB upload is unverified (infra).
   **Two-engine mode (ADR-034), off unless `TAPIR_RECONCILE_BASE_MODEL` is set:** it runs
   `iguana/pianissimo` (the base text) and `TAPIR_TRANSCRIBE_MODEL` (kb-whisper) on the same audio, then a
-  LOCAL chat model (`TAPIR_RECONCILE_MODEL`, e.g. `iguana/gemma4-26b`: 92% against a speaker's blind answers
-  at ~2 s a call; `iguana/gemma4-31b` 97% but ~5x slower) chooses between their disagreements.
+  LOCAL chat model (`TAPIR_RECONCILE_MODEL`) chooses between their disagreements. **Deployment choice (2026-10-02): `iguana/gemma4-31b`** (97% against a speaker's blind answers; 92% for `iguana/gemma4-26b`). With iguana's macOS **Low Power Mode off** the 31B decodes at 22 tok/s and reconciled a 63.6-minute recording in 21 min 49 s end to end; with it on it ran at 8 tok/s. Check `pmset -g | grep lowpowermode` before blaming a model or an engine for slowness.
   `TAPIR_RECONCILE_CHECK_ORDER=true` asks twice per dispute with the order swapped (doubles the time).
   Every model must start `koala/` or `iguana/`: a cloud alias is a start-up error. The default job timeout is
   60 minutes. `iguana/pianissimo` is KlangAI's Swedish ASR (a Parakeet/FastConformer on MLX, served by a small

docs/research/audio-length-ceiling-2026-10-01.md

@@ -29,7 +29,7 @@ ingress configuration, which lives in `infra`. "About 10 MB" is an inference.
 ## Method
 
 - **Audio.** No known-good Swedish recording is available that is safe to use: the only real
-  one (`IMG_1233.wav`) is the private `/bygge` recording (#31 custody still open) and was
+  one is a private recording (#31 custody still open) and was
   deliberately not touched. Instead: macOS `say -v Alva` (Swedish) on iguana, a 1,171-char
   five-paragraph meeting script → 82.5 s of 16 kHz mono PCM WAV (`ffmpeg -ar 16000 -ac 1`).
   Concatenated ×4, ×8, ×16, ×32, ×44, ×66 with Python `wave` (the issue's own recipe).

docs/use-cases/audio_upload.feature

@@ -214,3 +214,45 @@ Feature: Upload an audio recording, get a private Swedish transcript, discuss it
     When the model changes a word
     Then the segment containing it carries the reconciled word
     And the segment's timing is unchanged
+
+  # ADR-035 decision 8: hardening from the adversarial review
+
+  Scenario: Chat about a recording is offered with local models only
+    When I open the chat for my recording
+    Then the model list holds only models that run on the homelab
+    And a cloud model the shared chat service knows is not in it
+
+  Scenario: A forged cloud model is never sent the transcript
+    When a chat request names a cloud model
+    Then a local model answers instead, and nothing was sent to the cloud one
+
+  Scenario: A wedged engine does not use up the whole job
+    When the primary engine never answers
+    Then it fails at its own deadline while the job is still alive
+    And the fallback runs, unless the job itself was cancelled or timed out
+
+  Scenario: A file that lies about its length is refused
+    When a file claims to be short but converts to more than the limit
+    Then the job fails with a plain explanation and no engine receives the audio
+
+  Scenario: A recording much shorter than its file claimed is transcribed and noted
+    When a file converts to under 80 percent of the length it claimed and more than two minutes short
+    Then it is transcribed anyway and its audio step says how long the audio really is
+    And a complete recording whose header over-estimated its length is not refused
+
+  Scenario: A full queue is a retry, not an error
+    When too many recordings are already waiting
+    Then the upload is answered as busy, its row is failed honestly and its audio is deleted
+
+  Scenario: One user cannot fill the queue for everyone
+    When one user has several recordings waiting
+    Then further uploads from that user are refused and other users are not affected
+
+  Scenario: Errors are shown as kinds, never their text
+    When a model or an engine fails
+    Then the log, the stored reason and the page carry a kind such as timeout or http_502
+    And never the provider's response, a file path or a word from the transcript
+
+  Scenario: Input that cannot be right is a client error
+    When the id is not an id, or a header or title holds control bytes
+    Then the answer is a 4xx or the title is cleaned, never a server error

internal/adapters/audio/ffmpeg.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 )
 
@@ -17,8 +18,17 @@ import (
 type FFmpeg struct {
 	// Bin is the ffmpeg executable ("ffmpeg" resolves via PATH).
 	Bin string
+	// MaxSeconds caps the converted length when positive. The duration limit is a claim
+	// in the file's header and can be lied about (a 2 h file claiming 10 s converted to a
+	// 120-minute WAV); this bounds what a lie can cost. A minute of slack is added so a
+	// file at the limit is never cut, and the worker measures the result.
+	MaxSeconds int
 }
 
+// lengthSlackSeconds is added to MaxSeconds so ffmpeg's rounding never clips a file that
+// is really at the limit.
+const lengthSlackSeconds = 60
+
 // ToWAV writes src, converted, to dst. Video streams are dropped (-vn): by now the
 // file has already been probed as audio-only, but a cover-art stream must not end
 // up in the WAV.
@@ -29,7 +39,12 @@ func (f *FFmpeg) ToWAV(ctx context.Context, src, dst string) error {
 	}
 	// Input restrictions go BEFORE -i: placed after it they would apply to the output.
 	args := append([]string{"-y", "-v", "error"}, inputRestrictions...)
-	args = append(args, "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", "-f", "wav", dst)
+	args = append(args, "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le")
+	if f.MaxSeconds > 0 {
+		// After -i: an OUTPUT cap. Before it, it would limit what is read, not written.
+		args = append(args, "-t", strconv.Itoa(f.MaxSeconds+lengthSlackSeconds))
+	}
+	args = append(args, "-f", "wav", dst)
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
 	if out, err := cmd.CombinedOutput(); err != nil {

internal/adapters/audio/ffmpeg_test.go

@@ -77,3 +77,35 @@ printf data > "$last"`)
 	assert.Less(t, pw, in, "input options must come BEFORE -i or ffmpeg applies them to the output")
 	assert.Less(t, fw, in)
 }
+
+func TestFFmpegToWAV_PassesAnOutputLengthCapAfterTheInputWhenAMaximumIsSet(t *testing.T) {
+	// The duration limit is a CLAIM in the file's header; a file that lies about it can
+	// convert to hours of audio (adversarial review F2: a 2 h file claiming 10 s became a
+	// 120-minute WAV). The cap is an OUTPUT option, after -i, with a minute of slack.
+	rec := filepath.Join(t.TempDir(), "argv")
+	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
+for a; do last="$a"; done
+printf data > "$last"`)
+
+	err := (&audio.FFmpeg{Bin: bin, MaxSeconds: 5400}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "out.wav"))
+
+	require.NoError(t, err)
+	raw, err := os.ReadFile(rec)
+	require.NoError(t, err)
+	joined := " " + strings.Join(strings.Split(strings.TrimSpace(string(raw)), "\n"), " ") + " "
+	assert.Contains(t, joined, " -t 5460 ", "limit plus a minute of slack")
+	assert.Less(t, strings.Index(joined, " -i /spool/in "), strings.Index(joined, " -t 5460 "), "-t after -i is an output cap; before it, an input one")
+}
+
+func TestFFmpegToWAV_PassesNoLengthCapWhenNoMaximumIsSet(t *testing.T) {
+	rec := filepath.Join(t.TempDir(), "argv")
+	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
+for a; do last="$a"; done
+printf data > "$last"`)
+
+	require.NoError(t, (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "out.wav")))
+
+	raw, err := os.ReadFile(rec)
+	require.NoError(t, err)
+	assert.NotContains(t, " "+strings.ReplaceAll(string(raw), "\n", " ")+" ", " -t ")
+}

internal/adapters/llm/client.go

@@ -55,6 +55,29 @@ func WithMaxTokens(n int) Option {
 	}
 }
 
+// maxErrorBody bounds how much of a failing response ends up in an error message.
+const maxErrorBody = 512
+
+// HTTPError is a non-200 answer from the gateway. Its text keeps the form callers that
+// log it already rely on, with the body bounded; its Code is what code may branch on and
+// what errkind turns into a kind. The body is provider text and can echo the prompt, so
+// nothing private may persist or display Error() (ADR-035 review F3).
+type HTTPError struct {
+	Code int
+	Body string
+}
+
+func (e *HTTPError) Error() string {
+	body := e.Body
+	if len(body) > maxErrorBody {
+		body = body[:maxErrorBody] + "…"
+	}
+	return fmt.Sprintf("LLM returned %d: %s", e.Code, body)
+}
+
+// HTTPStatus implements errkind.HTTPStatuser.
+func (e *HTTPError) HTTPStatus() int { return e.Code }
+
 // WithTemperature overrides the sampling temperature. Zero IS a valid value and is sent
 // as zero: the reconciler's accuracy was measured at temperature 0 and must run there.
 func WithTemperature(t float64) Option {
@@ -166,7 +189,7 @@ func (c *Client) Complete(ctx context.Context, system, user string) (string, err
 		return "", fmt.Errorf("read response: %w", err)
 	}
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("LLM returned %d: %s", resp.StatusCode, out)
+		return "", &HTTPError{Code: resp.StatusCode, Body: string(out)}
 	}
 
 	var cr chatResponse

internal/adapters/llm/status_error_test.go

@@ -0,0 +1,63 @@
+package llm
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.d-ma.be/mathias/tapir/internal/errkind"
+)
+
+// A non-200 from the gateway is an HTTP status error: its kind can be logged and stored
+// without its body, which can echo the prompt (adversarial review F3).
+
+func failingGateway(t *testing.T, status int, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(status)
+		_, _ = w.Write([]byte(body))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestClient_ANon200IsAnHTTPStatusErrorWhoseKindCarriesNoBody(t *testing.T) {
+	srv := failingGateway(t, http.StatusBadRequest, `{"error":"prompt was: Anders ansvarar för virket"}`)
+
+	_, err := New(srv.URL, "", "m", 5*time.Second).Complete(context.Background(), "s", "u")
+
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+	if got := errkind.Of(err); got != "http_400" {
+		t.Errorf("errkind.Of = %q, want http_400", got)
+	}
+	var he *HTTPError
+	if !errors.As(err, &he) || he.Code != http.StatusBadRequest {
+		t.Errorf("error is not an *HTTPError with the status code: %v", err)
+	}
+}
+
+func TestClient_TheErrorTextIsUnchangedForCallersThatLogIt(t *testing.T) {
+	srv := failingGateway(t, http.StatusBadGateway, "upstream down")
+
+	_, err := New(srv.URL, "", "m", 5*time.Second).Complete(context.Background(), "s", "u")
+
+	if err == nil || err.Error() != "LLM returned 502: upstream down" {
+		t.Errorf("error text = %v: callers that log it already rely on this form", err)
+	}
+}
+
+func TestClient_AnEnormousErrorBodyIsBoundedInTheErrorText(t *testing.T) {
+	srv := failingGateway(t, http.StatusInternalServerError, strings.Repeat("x", 100_000))
+
+	_, err := New(srv.URL, "", "m", 5*time.Second).Complete(context.Background(), "s", "u")
+
+	if err == nil || len(err.Error()) > 1024 {
+		t.Errorf("error text is %d bytes: a gateway's whole body must not become an error message", len(err.Error()))
+	}
+}

internal/adapters/store/uploaded_transcripts_test.go

@@ -242,8 +242,8 @@ func TestUploadLifecycle_ReconciliationRoundTripsWithItsContestedSpots(t *testin
 		Status: domain.ReconcileDone, Base: "iguana/pianissimo", Alt: "iguana/kb-whisper", Reconciler: "iguana/gemma4-26b",
 		Disputes: 380, AutoResolved: 90, Adjudicated: 285, Changed: 120, Unsure: 5, Errors: 0,
 		Contested: []domain.ContestedSpot{
-			{Seconds: 2210.5, Base: "SEB", Alt: "SCB", Used: "alt"},
-			{Seconds: 3400, Base: "T+1", Alt: "en T", Used: "base", Unsure: true},
+			{Seconds: 2210.5, Base: "Axel", Alt: "Alex", Used: "alt"},
+			{Seconds: 3400, Base: "A+2", Alt: "en A", Used: "base", Unsure: true},
 		},
 	}
 

internal/adapters/transcribe/ensemble.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 	"git.d-ma.be/mathias/tapir/internal/progress"
 	"git.d-ma.be/mathias/tapir/internal/reconcile"
 )
@@ -72,9 +73,9 @@ func (e *Ensemble) Transcribe(ctx context.Context, wavPath string) (domain.Trans
 		}
 		return out, nil
 	case berr == nil:
-		return e.single(b, e.base.Name(), fmt.Sprintf("%s failed: %v", e.alt.Name(), aerr)), nil
+		return e.single(b, e.base.Name(), fmt.Sprintf("%s failed (%s)", e.alt.Name(), errkind.Of(aerr))), nil
 	case aerr == nil:
-		return e.single(a, e.alt.Name(), fmt.Sprintf("%s failed: %v", e.base.Name(), berr)), nil
+		return e.single(a, e.alt.Name(), fmt.Sprintf("%s failed (%s)", e.base.Name(), errkind.Of(berr))), nil
 	}
 
 	both := errors.Join(fmt.Errorf("%s: %w", e.base.Name(), berr), fmt.Errorf("%s: %w", e.alt.Name(), aerr))

internal/adapters/transcribe/ensemble_reason_test.go

@@ -0,0 +1,36 @@
+package transcribe_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
+	"git.d-ma.be/mathias/tapir/internal/reconcile"
+)
+
+// When one engine is down the page says so and why; the "why" is a kind, not the
+// engine's error text, which can carry provider output (adversarial review F3).
+
+func TestEnsemble_AFailedEnginesReasonIsAKindNotItsErrorText(t *testing.T) {
+	r := newEnsemble("text", "text", nil, errors.New("kb-whisper said: zebrakaka secret words"), false, &verdictAdj{v: reconcile.VerdictAlt})
+
+	got, err := r.e.Transcribe(context.Background(), "/a.wav")
+
+	require.NoError(t, err)
+	assert.NotContains(t, got.Reconciliation.Reason, "zebrakaka")
+	assert.Contains(t, got.Reconciliation.Reason, "iguana/kb-whisper failed", "which engine failed is still said")
+}
+
+func TestEnsemble_AnHTTPFailureShowsItsStatusCodeAsTheKind(t *testing.T) {
+	r := newEnsemble("text", "text", &transcribe.StatusError{Code: 502, Snippet: "zebrakaka"}, nil, false, &verdictAdj{})
+
+	got, err := r.e.Transcribe(context.Background(), "/a.wav")
+
+	require.NoError(t, err)
+	assert.Contains(t, got.Reconciliation.Reason, "http_502")
+	assert.NotContains(t, got.Reconciliation.Reason, "zebrakaka")
+}

internal/adapters/transcribe/gateway.go

@@ -31,6 +31,9 @@ type StatusError struct {
 	Snippet string
 }
 
+// HTTPStatus implements errkind.HTTPStatuser: the code, never the snippet.
+func (e *StatusError) HTTPStatus() int { return e.Code }
+
 func (e *StatusError) Error() string {
 	return fmt.Sprintf("transcribe: gateway returned HTTP %d: %s", e.Code, e.Snippet)
 }

internal/adapters/transcribe/gateway_test.go

@@ -3,11 +3,13 @@ package transcribe_test
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -15,6 +17,7 @@ import (
 
 	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 )
 
 // The httptest server stands in for the LiteLLM gateway: it is the process
@@ -230,3 +233,25 @@ func TestGateway_WithNoSegmentsTheTextFieldIsUsedWithWhitespaceCollapsed(t *test
 	require.NoError(t, err)
 	assert.Equal(t, "Hej allihopa. Vi börjar.", got.Text)
 }
+
+func TestStatusError_ExposesItsCodeAsAKindAndNotItsSnippet(t *testing.T) {
+	err := fmt.Errorf("transcribe: %w", &transcribe.StatusError{Code: 502, Snippet: "echoed: Anders ansvarar"})
+
+	assert.Equal(t, "http_502", errkind.Of(err))
+}
+
+func TestGateway_AnErrorBodyIsBoundedToTwoHundredBytesInTheStatusError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = w.Write([]byte(strings.Repeat("x", 100_000)))
+	}))
+	defer srv.Close()
+	wav := filepath.Join(t.TempDir(), "a.wav")
+	require.NoError(t, os.WriteFile(wav, []byte("RIFF....WAVEfmt "), 0o600))
+
+	_, err := transcribe.NewGateway(srv.URL, "", "iguana/kb-whisper", srv.Client()).Transcribe(context.Background(), wav)
+
+	var se *transcribe.StatusError
+	require.ErrorAs(t, err, &se)
+	assert.LessOrEqual(t, len(se.Snippet), 200, "a gateway's whole body must not become part of an error")
+}

internal/adapters/transcribe/timeout.go

@@ -0,0 +1,33 @@
+package transcribe
+
+import (
+	"context"
+	"time"
+
+	"git.d-ma.be/mathias/tapir/internal/domain"
+)
+
+// WithTimeout gives every call to b its own deadline. A wedged engine does not answer at
+// all (iguana after a Metal OOM, infra#273), and with only the job's deadline it used up
+// the whole job before a fallback could run -- and Chain then refuses the fallback because
+// the job context has expired. With its own deadline the call fails while the job is still
+// alive, which is exactly when the fallback, or the other engine, can take over.
+//
+// A zero or negative d returns b unchanged. The wrapper is invisible: Name is b's.
+func WithTimeout(b Backend, d time.Duration) Backend {
+	if d <= 0 {
+		return b
+	}
+	return timeoutBackend{Backend: b, d: d}
+}
+
+type timeoutBackend struct {
+	Backend
+	d time.Duration
+}
+
+func (t timeoutBackend) Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error) {
+	ctx, cancel := context.WithTimeout(ctx, t.d)
+	defer cancel()
+	return t.Backend.Transcribe(ctx, wavPath)
+}

internal/adapters/transcribe/timeout_test.go

@@ -0,0 +1,104 @@
+package transcribe_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
+	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
+	"git.d-ma.be/mathias/tapir/internal/reconcile"
+)
+
+// A wedged engine (iguana after a Metal OOM, infra#273) does not answer at all. With only
+// the job's deadline, the primary used up the whole job before any fallback could run, and
+// the chain then refused the fallback because the job context had expired. Each engine call
+// gets its own deadline (adversarial review F4).
+
+type hangingBackend struct{ name string }
+
+func (h hangingBackend) Name() string { return h.name }
+func (hangingBackend) Transcribe(ctx context.Context, _ string) (domain.Transcription, error) {
+	<-ctx.Done()
+	return domain.Transcription{}, ctx.Err()
+}
+
+func TestWithTimeout_AHungBackendFailsAtItsOwnDeadlineWhileTheJobIsStillAlive(t *testing.T) {
+	job, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	b := transcribe.WithTimeout(hangingBackend{name: "iguana/kb-whisper"}, 40*time.Millisecond)
+
+	start := time.Now()
+	_, err := b.Transcribe(job, "/a.wav")
+
+	require.Error(t, err)
+	assert.Equal(t, "timeout", errkind.Of(err))
+	assert.Less(t, time.Since(start), 2*time.Second, "it must give up at its own deadline, not wait for the job's")
+	assert.NoError(t, job.Err(), "the job context is untouched, which is what lets a fallback run")
+	assert.Equal(t, "iguana/kb-whisper", b.Name(), "the wrapper is invisible in the recorded endpoint")
+}
+
+func TestWithTimeout_ASuccessPassesStraightThrough(t *testing.T) {
+	calls := &[]string{}
+	inner := &orderedBackend{name: "iguana/kb-whisper", text: "hej", calls: calls}
+
+	got, err := transcribe.WithTimeout(inner, time.Minute).Transcribe(context.Background(), "/a.wav")
+
+	require.NoError(t, err)
+	assert.Equal(t, "hej", got.Text)
+}
+
+func TestWithTimeout_ZeroMeansNoDeadlineOfItsOwn(t *testing.T) {
+	inner := &orderedBackend{name: "x", text: "hej", calls: &[]string{}}
+
+	assert.Same(t, inner, transcribe.WithTimeout(inner, 0), "a zero timeout must not wrap or change anything")
+}
+
+func TestChain_AHungPrimaryReachesTheFallbackWhenItHasItsOwnDeadline(t *testing.T) {
+	calls := &[]string{}
+	fb := &orderedBackend{name: "berget/kb-whisper", text: "fallback text", calls: calls}
+	c := transcribe.NewChain(transcribe.WithTimeout(hangingBackend{name: "iguana/kb-whisper"}, 40*time.Millisecond), fb)
+	job, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	got, err := c.Transcribe(job, "/a.wav")
+
+	require.NoError(t, err, "a wedged primary is exactly what the fallback exists for")
+	assert.Equal(t, "berget/kb-whisper", got.Endpoint)
+}
+
+func TestChain_AJobThatEndedWhileThePrimaryHungStillNeverReachesTheFallback(t *testing.T) {
+	calls := &[]string{}
+	fb := &orderedBackend{name: "berget/kb-whisper", text: "fallback text", calls: calls}
+	c := transcribe.NewChain(transcribe.WithTimeout(hangingBackend{name: "iguana/kb-whisper"}, time.Minute), fb)
+	job, cancel := context.WithTimeout(context.Background(), 40*time.Millisecond)
+	defer cancel()
+
+	_, err := c.Transcribe(job, "/a.wav")
+
+	require.Error(t, err)
+	assert.Empty(t, *calls, "the job's own deadline or a cancel must still stop the audio from reaching a cloud endpoint")
+}
+
+func TestEnsemble_AHungEngineIsASoftFailureAndTheOtherEnginesTextIsUsed(t *testing.T) {
+	calls := &[]string{}
+	alt := &orderedBackend{name: "iguana/kb-whisper", text: "text from the other engine", calls: calls}
+	e := transcribe.NewEnsemble(
+		transcribe.WithTimeout(hangingBackend{name: "iguana/pianissimo"}, 40*time.Millisecond), alt, nil,
+		&verdictAdj{v: reconcile.VerdictAlt}, ensembleOpts)
+	job, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	got, err := e.Transcribe(job, "/a.wav")
+
+	require.NoError(t, err)
+	assert.Equal(t, "text from the other engine", got.Text)
+	assert.Equal(t, domain.ReconcileSingle, got.Reconciliation.Status)
+	assert.Contains(t, got.Reconciliation.Reason, "timeout")
+	assert.False(t, errors.Is(err, context.DeadlineExceeded))
+}

internal/config/uploads.go

@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -27,6 +28,10 @@ type UploadConfig struct {
 	// TranscribeTimeout bounds one job (conversion + transcription); a 90 minute
 	// recording took ~7.5 minutes on iguana.
 	TranscribeTimeout time.Duration
+	// TranscribeEngineTimeout bounds ONE engine call, so a wedged engine fails while the
+	// job is still alive and the fallback (or the other engine) can take over. The job
+	// timeout alone cannot do that (ADR-035 review).
+	TranscribeEngineTimeout time.Duration
 	// UploadTmpDir is where uploads are spooled and converted. Audio is deleted
 	// after transcription, so this holds at most the in-flight files.
 	UploadTmpDir string
@@ -61,6 +66,7 @@ const (
 	defaultTranscribeModel         = "iguana/kb-whisper"
 	defaultTranscribeFallbackModel = "berget/kb-whisper"
 	defaultTranscribeTimeout       = 60 * time.Minute
+	defaultTranscribeEngineTimeout = 20 * time.Minute
 	defaultMaxUploadedChars        = 90000
 	defaultUploadChatModel         = "iguana/gemma4-26b"
 )
@@ -106,6 +112,15 @@ func loadUploadConfig() (UploadConfig, error) {
 	}
 	u.TranscribeTimeout = timeout
 
+	engineTimeout, err := durationOr("TAPIR_TRANSCRIBE_ENGINE_TIMEOUT", defaultTranscribeEngineTimeout)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	if engineTimeout <= 0 {
+		return UploadConfig{}, fmt.Errorf("config: TAPIR_TRANSCRIBE_ENGINE_TIMEOUT must be positive, got %v", engineTimeout)
+	}
+	u.TranscribeEngineTimeout = engineTimeout
+
 	if v := os.Getenv("TAPIR_RECONCILE_CHECK_ORDER"); v != "" {
 		on, err := strconv.ParseBool(v)
 		if err != nil {
@@ -116,6 +131,9 @@ func loadUploadConfig() (UploadConfig, error) {
 	if err := u.validateReconcile(); err != nil {
 		return UploadConfig{}, err
 	}
+	if !IsLocalModel(u.UploadChatModel) {
+		return UploadConfig{}, fmt.Errorf("config: TAPIR_UPLOAD_CHAT_MODEL=%q is not a local model (koala/ or iguana/): the whole private transcript is sent to it", u.UploadChatModel)
+	}
 
 	chars, err := intOr("TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", defaultMaxUploadedChars)
 	if err != nil {
@@ -141,18 +159,18 @@ func positiveInt(key string, fallback int) (int, error) {
 	return n, nil
 }
 
-// localPrefixes are the host prefixes of the models that run on the homelab. Private
-// meeting content may be sent to these and to nothing else for reconciliation
-// (ADR-034): a cloud alias is refused at start-up rather than discovered later.
-var localPrefixes = []string{"koala/", "iguana/"}
+// localAlias is the shape of a model alias that runs on the homelab: a local host
+// prefix, then one plain name. A bare prefix check let through aliases that are shaped
+// like an escape (koala/../berget/x, koala//x, koala/x?host=berget): whether the
+// gateway would route them elsewhere is unknown, so they are refused (ADR-035 review).
+var localAlias = regexp.MustCompile(`^(koala|iguana)/[A-Za-z0-9][A-Za-z0-9._:-]*$`)
 
-func isLocalModel(alias string) bool {
-	for _, p := range localPrefixes {
-		if strings.HasPrefix(alias, p) {
-			return true
-		}
-	}
-	return false
+// IsLocalModel reports whether alias is a local model. Private meeting content may be
+// sent to these and to nothing else: reconciliation (ADR-034) and chat over an uploaded
+// recording (ADR-035) are both held to it, and a cloud alias is refused at start-up
+// rather than discovered later.
+func IsLocalModel(alias string) bool {
+	return localAlias.MatchString(alias) && !strings.Contains(alias, "..")
 }
 
 // validateReconcile checks the two-engine settings. They are inert while no base
@@ -168,7 +186,7 @@ func (u UploadConfig) validateReconcile() error {
 		{"TAPIR_RECONCILE_BASE_MODEL", u.ReconcileBaseModel},
 		{"TAPIR_RECONCILE_MODEL", u.ReconcileModel},
 	} {
-		if !isLocalModel(m.alias) {
+		if !IsLocalModel(m.alias) {
 			return fmt.Errorf("config: %s=%q is not a local model (koala/ or iguana/): private meeting content must not leave the homelab for reconciliation", m.name, m.alias)
 		}
 	}

internal/config/uploads_local_test.go

@@ -0,0 +1,101 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+// What counts as a LOCAL model alias, and where that is demanded (ADR-034, ADR-035 review).
+// A private transcript may be sent to a local model and to nothing else; the check is a
+// guard against a misconfiguration or a crafted alias, so it must be strict about shape,
+// not just about a prefix.
+
+func TestIsLocalModel_AcceptsRealLocalAliasesAndNothingShapedLikeAnEscape(t *testing.T) {
+	tests := []struct {
+		alias string
+		want  bool
+	}{
+		{"koala/phi4-mini", true},
+		{"iguana/gemma4-26b", true},
+		{"iguana/gemma4-31b-think", true},
+		{"koala/qwen36-35b-a3b", true},
+		{"iguana/kb-whisper", true},
+		{"iguana/hf.co-model_v1:q4", true},
+		{"", false},
+		{"koala/", false},
+		{"iguana/", false},
+		{"gemma4-26b", false},
+		{"berget/mistral-small", false},
+		{"berget/koala/x", false},
+		{"xkoala/x", false},
+		{"Koala/x", false},
+		{" koala/x", false},
+		{"koala/x ", false},
+		{"koala/x y", false},
+		{"koala/x\n", false},
+		{"koala/../berget/kb", false},
+		{"koala//berget/mistral-small", false},
+		{"koala/x/y", false},
+		{"koala/x?host=berget", false},
+		{"koala/x#frag", false},
+		{"koala/x@evil", false},
+		{"koalа/x", false}, // Cyrillic а
+	}
+	for _, tt := range tests {
+		t.Run(tt.alias, func(t *testing.T) {
+			if got := IsLocalModel(tt.alias); got != tt.want {
+				t.Errorf("IsLocalModel(%q) = %v, want %v", tt.alias, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLoad_UploadChatModelMustBeLocalBecauseTheWholeTranscriptIsSentToIt(t *testing.T) {
+	for _, alias := range []string{"berget/mistral-small", "gemini/gemini-2.5-pro", "gemma4-26b", "koala/../berget/kb"} {
+		t.Run(alias, func(t *testing.T) {
+			clearUploadEnv(t)
+			setEnv(t, map[string]string{"TAPIR_UPLOAD_CHAT_MODEL": alias})
+
+			if _, err := Load(); err == nil {
+				t.Errorf("Load accepted TAPIR_UPLOAD_CHAT_MODEL=%q: a private transcript of up to 90,000 characters would be sent to it", alias)
+			}
+		})
+	}
+}
+
+func TestLoad_ALocalUploadChatModelIsAccepted(t *testing.T) {
+	clearUploadEnv(t)
+	setEnv(t, map[string]string{"TAPIR_UPLOAD_CHAT_MODEL": "iguana/gemma4-31b"})
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.UploadChatModel != "iguana/gemma4-31b" {
+		t.Errorf("UploadChatModel = %q", cfg.UploadChatModel)
+	}
+}
+
+func TestLoad_TheEngineTimeoutDefaultsToTwentyMinutesAndMustBePositive(t *testing.T) {
+	clearUploadEnv(t)
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.TranscribeEngineTimeout != 20*time.Minute {
+		t.Errorf("TranscribeEngineTimeout = %v, want 20m: a 90-minute recording takes about 8 minutes on kb-whisper, and two wedged engines in sequence must leave the job time to reach a fallback", cfg.TranscribeEngineTimeout)
+	}
+
+	setEnv(t, map[string]string{"TAPIR_TRANSCRIBE_ENGINE_TIMEOUT": "7m"})
+	cfg, err = Load()
+	if err != nil || cfg.TranscribeEngineTimeout != 7*time.Minute {
+		t.Errorf("override: %v, %v", cfg.TranscribeEngineTimeout, err)
+	}
+
+	for _, bad := range []string{"0", "-1m", "soon"} {
+		setEnv(t, map[string]string{"TAPIR_TRANSCRIBE_ENGINE_TIMEOUT": bad})
+		if _, err := Load(); err == nil {
+			t.Errorf("Load accepted TAPIR_TRANSCRIBE_ENGINE_TIMEOUT=%q", bad)
+		}
+	}
+}

internal/config/uploads_test.go

@@ -12,7 +12,7 @@ func clearUploadEnv(t *testing.T) {
 	t.Helper()
 	for _, k := range []string{
 		"TAPIR_UPLOADS_ENABLED", "TAPIR_UPLOAD_MAX_MB", "TAPIR_UPLOAD_MAX_MINUTES",
-		"TAPIR_TRANSCRIBE_MODEL", "TAPIR_TRANSCRIBE_FALLBACK_MODEL", "TAPIR_TRANSCRIBE_TIMEOUT",
+		"TAPIR_TRANSCRIBE_MODEL", "TAPIR_TRANSCRIBE_FALLBACK_MODEL", "TAPIR_TRANSCRIBE_TIMEOUT", "TAPIR_TRANSCRIBE_ENGINE_TIMEOUT",
 		"TAPIR_UPLOAD_TMP_DIR", "TAPIR_FFMPEG_BIN", "TAPIR_FFPROBE_BIN",
 		"TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", "TAPIR_UPLOAD_CHAT_MODEL",
 		"TAPIR_RECONCILE_BASE_MODEL", "TAPIR_RECONCILE_MODEL", "TAPIR_RECONCILE_CHECK_ORDER",

internal/domain/domain.go

@@ -203,6 +203,10 @@ type ProgressStep struct {
 	FinishedAt time.Time `json:"finished_at,omitzero"`
 	Done       int       `json:"done,omitempty"`
 	Total      int       `json:"total,omitempty"`
+	// Note is a short plain remark about the phase that the reader should see even though
+	// it did not fail, for example that the audio is much shorter than the file claimed.
+	// Durations and counts only: never transcript text, a name or a path.
+	Note string `json:"note,omitempty"`
 }
 
 // UploadStatus is the state of an uploaded-audio transcription job.
@@ -226,6 +230,13 @@ const (
 	UploadErrInterrupted UploadErrorKind = "interrupted"
 	// UploadErrTranscriptionFailed: every configured transcription endpoint failed.
 	UploadErrTranscriptionFailed UploadErrorKind = "transcription_failed"
+	// UploadErrTooLong: the audio, once converted, is longer than the limit. The limit is
+	// first checked against the file's header, which a hostile or damaged file can lie
+	// about (ADR-035 review).
+	UploadErrTooLong UploadErrorKind = "audio_too_long"
+	// UploadErrBusy: too many recordings were already waiting, so this one was not
+	// queued. The user's to retry later (ADR-035 review).
+	UploadErrBusy UploadErrorKind = "queue_full"
 )
 
 // UploadedTranscript is a user's PRIVATE transcript of audio they uploaded. It is

internal/errkind/errkind.go

@@ -0,0 +1,51 @@
+// Package errkind reduces an error to a short kind that is safe to log, store and show.
+//
+// An error's own text can hold a provider's response body (a gateway that echoes the
+// prompt), a file path (ffmpeg names the spool file), or a word from a private
+// transcript. None of that may reach a log line, a database column or a page about a
+// private recording (ADR-033: "typed, never a provider's string"; ADR-035). Of returns
+// only a fixed vocabulary, so it can never carry any.
+package errkind
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+)
+
+// HTTPStatuser is implemented by errors that are a non-2xx answer from a service.
+type HTTPStatuser interface{ HTTPStatus() int }
+
+// SQLStater is implemented by database errors that carry a SQLSTATE (pgx's PgError does).
+// The five-character code is a fixed vocabulary; the error's message is not: Postgres quotes
+// the offending value, which for a transcript row is transcript text.
+type SQLStater interface{ SQLState() string }
+
+// Of is the kind of err: "timeout", "canceled", "http_<code>", "sql_<state>", "network",
+// or "error".
+// It is empty for nil.
+func Of(err error) string {
+	if err == nil {
+		return ""
+	}
+	var hs HTTPStatuser
+	var ss SQLStater
+	var ne net.Error
+	switch {
+	case errors.Is(err, context.DeadlineExceeded):
+		return "timeout"
+	case errors.Is(err, context.Canceled):
+		return "canceled"
+	case errors.As(err, &hs):
+		return fmt.Sprintf("http_%d", hs.HTTPStatus())
+	case errors.As(err, &ss) && ss.SQLState() != "":
+		return "sql_" + ss.SQLState()
+	case errors.As(err, &ne):
+		if ne.Timeout() {
+			return "timeout"
+		}
+		return "network"
+	}
+	return "error"
+}

internal/errkind/errkind_test.go

@@ -0,0 +1,82 @@
+package errkind_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"git.d-ma.be/mathias/tapir/internal/errkind"
+)
+
+// Of reduces an error to a short kind that is safe to log, store and show: it never
+// carries the error's own text, because that text can hold a provider's response body, a
+// file path or a word from a private transcript (ADR-035 review F3, F5).
+
+type statusErr struct{ code int }
+
+func (e statusErr) Error() string {
+	return fmt.Sprintf("gateway said: %d and echoed the transcript", e.code)
+}
+func (e statusErr) HTTPStatus() int { return e.code }
+
+type timeoutNet struct{}
+
+func (timeoutNet) Error() string   { return "i/o timeout to 10.0.0.1" }
+func (timeoutNet) Timeout() bool   { return true }
+func (timeoutNet) Temporary() bool { return true }
+
+func TestOf_ReducesAnErrorToAKindAndNeverItsText(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{"nothing", nil, ""},
+		{"a deadline", context.DeadlineExceeded, "timeout"},
+		{"a wrapped deadline", fmt.Errorf("transcribe: %w", context.DeadlineExceeded), "timeout"},
+		{"a cancellation", fmt.Errorf("job: %w", context.Canceled), "canceled"},
+		{"an HTTP status", statusErr{code: 502}, "http_502"},
+		{"a wrapped HTTP status", fmt.Errorf("model: %w", statusErr{code: 400}), "http_400"},
+		{"a network timeout", timeoutNet{}, "timeout"},
+		{"a network failure", &net.OpError{Op: "dial", Err: errors.New("connection refused")}, "network"},
+		{"a url error wrapping a refusal", &url.Error{Op: "Post", URL: "http://gateway/secret-path", Err: errors.New("refused")}, "network"},
+		{"anything else", errors.New("moov atom not found in /spool/upload-555"), "error"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, errkind.Of(tt.err))
+		})
+	}
+}
+
+type sqlErr struct{}
+
+func (sqlErr) Error() string {
+	return `ERROR: invalid input syntax for type json: "Anders ansvarar för virket"`
+}
+func (sqlErr) SQLState() string { return "22P02" }
+
+func TestOf_ADatabaseErrorIsReducedToItsSQLStateNeverItsMessage(t *testing.T) {
+	// A Postgres error can quote the offending value, which for a transcript row is
+	// transcript text. The five-character SQLSTATE is a fixed vocabulary (fourth review).
+	err := fmt.Errorf("store: complete upload: %w", sqlErr{})
+
+	got := errkind.Of(err)
+
+	assert.Equal(t, "sql_22P02", got)
+	assert.NotContains(t, got, "Anders")
+}
+
+func TestOf_AKindCarriesNoWordFromTheError(t *testing.T) {
+	err := fmt.Errorf("convert /spool/upload-555: %w", errors.New("Anders ansvarar för virket"))
+
+	got := errkind.Of(err)
+
+	assert.NotContains(t, got, "Anders")
+	assert.NotContains(t, got, "spool")
+}

internal/progress/tracker.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 )
 
 // Planned is one phase of a job, declared up front so the page can show what is coming.
@@ -146,7 +147,7 @@ func (t *Tracker) Fail(key string, err error) {
 		return
 	}
 	t.close(s, domain.StepFailed)
-	t.log.Warn("step failed", "step", key, "elapsed", s.FinishedAt.Sub(s.StartedAt), "err", err)
+	t.log.Warn("step failed", "step", key, "elapsed", s.FinishedAt.Sub(s.StartedAt), "kind", errkind.Of(err))
 	t.save()
 }
 
@@ -185,6 +186,20 @@ func (t *Tracker) Finish() {
 	t.save()
 }
 
+// Annotate attaches a short plain note to a phase and saves it at once. It is for a
+// remark the reader should see although nothing failed. Durations and counts only: a note
+// is shown on a page about a private recording.
+func (t *Tracker) Annotate(key, note string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	s := t.find(key)
+	if s == nil {
+		return
+	}
+	s.Note = note
+	t.save()
+}
+
 // Heartbeat stamps the job's row every beatEvery and logs which phase is still running
 // every stillEvery, until ctx ends. It runs on its own, independent of any engine call:
 // a heartbeat that stopped means the process is gone, not that a request is slow.

internal/progress/tracker_test.go

@@ -197,7 +197,7 @@ func TestTracker_FailRunningMarksTheRunningStepFailedAndLeavesTheRestPending(t *
 	require.Equal(t, domain.StepPending, stateOf(steps, "save"), "what never started stays pending: it shows where the job stopped")
 }
 
-func TestTracker_AKeyedFailMarksOneStepFailedLogsWhyAndTheJobGoesOn(t *testing.T) {
+func TestTracker_AKeyedFailMarksOneStepFailedLogsItsKindAndTheJobGoesOn(t *testing.T) {
 	tr, sink, _, buf := newTracker(t)
 	tr.Start()
 	tr.Begin("audio", 0)
@@ -209,7 +209,8 @@ func TestTracker_AKeyedFailMarksOneStepFailedLogsWhyAndTheJobGoesOn(t *testing.T
 	require.Equal(t, domain.StepFailed, stateOf(steps, "audio"))
 	require.Equal(t, domain.StepRunning, stateOf(steps, "decide"), "a soft failure must not stop the next step from running")
 	require.Contains(t, buf.String(), "level=WARN")
-	require.Contains(t, buf.String(), "gateway said no")
+	require.NotContains(t, buf.String(), "gateway said no", "an error's text can carry provider output or a path: the log gets its kind")
+	require.Contains(t, buf.String(), "kind=error")
 	require.Contains(t, buf.String(), "step=audio")
 }
 
@@ -259,12 +260,56 @@ func TestTracker_EveryTransitionIsLoggedByTheSameCall(t *testing.T) {
 	tr.Begin("audio", 0)
 	clk.tick(3 * time.Second)
 	tr.Done("audio")
+	tr.Begin("decide", 5)
+	clk.tick(2 * time.Second)
+	tr.FailRunning()
+	tr.Finish()
 
 	out := buf.String()
-	require.Contains(t, out, "step=audio")
-	require.Contains(t, out, "started")
-	require.Contains(t, out, "finished")
-	require.Contains(t, out, "elapsed=3s")
+	for _, want := range []string{
+		`msg="job started"`,
+		`msg="step started" step=audio`,
+		`msg="step finished" step=audio elapsed=3s`,
+		`msg="step started" step=decide total=5`,
+		`msg="step failed" step=decide elapsed=2s`,
+		`msg="job finished"`,
+	} {
+		require.Contains(t, out, want, "a transition with no log line is invisible to the operator")
+	}
+}
+
+func TestTracker_AKeyedFailIsSavedAtOnceNotOnTheNextTransition(t *testing.T) {
+	tr, sink, _, _ := newTracker(t)
+	tr.Start()
+	tr.Begin("audio", 0)
+	before := sink.saveCount()
+
+	tr.Fail("audio", errors.New("down"))
+
+	require.Equal(t, before+1, sink.saveCount(), "a soft-failed phase must show as failed on the page now")
+	require.Equal(t, domain.StepFailed, stateOf(sink.last(t), "audio"))
+}
+
+// retainingSink keeps the very slice it is handed, like a sink that queues it for later.
+type retainingSink struct{ got [][]domain.ProgressStep }
+
+func (r *retainingSink) SaveProgress(_ context.Context, steps []domain.ProgressStep, _ time.Time) error {
+	r.got = append(r.got, steps)
+	return nil
+}
+func (r *retainingSink) Beat(context.Context) error { return nil }
+
+func TestTracker_ASnapshotHandedToTheSinkIsNotChangedByLaterTransitions(t *testing.T) {
+	sink := &retainingSink{}
+	tr := progress.NewTracker(context.Background(), sink, slog.New(slog.NewTextHandler(&syncBuf{}, nil)), plan(),
+		progress.WithClock(newClock().now))
+	tr.Start()
+	first := sink.got[0]
+
+	tr.Begin("audio", 0)
+	tr.Done("audio")
+
+	require.Equal(t, domain.StepPending, first[0].State, "a sink that keeps a snapshot must not see it change under it")
 }
 
 func TestTracker_AdvanceIsLoggedAtMostOncePerMinute(t *testing.T) {
@@ -342,3 +387,16 @@ func TestWithAndFrom_ACarriedReporterIsTheOneReturned(t *testing.T) {
 
 	require.Equal(t, domain.StepRunning, stateOf(sink.last(t), "audio"))
 }
+
+func TestTracker_AnnotateAttachesANoteToAStepAndSavesItAtOnce(t *testing.T) {
+	tr, sink, _, _ := newTracker(t)
+	tr.Start()
+	tr.Begin("audio", 0)
+	before := sink.saveCount()
+
+	tr.Annotate("audio", "20 min of the 79 the file claimed")
+
+	require.Equal(t, before+1, sink.saveCount())
+	require.Equal(t, "20 min of the 79 the file claimed", sink.last(t)[0].Note)
+	require.NotPanics(t, func() { tr.Annotate("no-such-step", "x") })
+}

internal/reconcile/adjudicate_test.go

@@ -32,7 +32,7 @@ func (f *fakeCompleter) Complete(_ context.Context, system, user string) (string
 	return f.replies[i], nil
 }
 
-var req = reconcile.Request{Before: "kunderna ska då", After: "De ska kunna betala", Base: "onboardade", Alt: "omvårdade"}
+var req = reconcile.Request{Before: "grannarna ska då", After: "De ska kunna måla", Base: "målade", Alt: "mölade"}
 
 func TestLLMAdjudicator_SendsTheMeasuredPromptWithTheReadingsInTheRequestedOrder(t *testing.T) {
 	fc := &fakeCompleter{replies: []string{"ANSWER: 1"}}
@@ -45,10 +45,10 @@ func TestLLMAdjudicator_SendsTheMeasuredPromptWithTheReadingsInTheRequestedOrder
 	assert.Contains(t, fc.systems[0], "two automatic transcriptions of the same Swedish speech")
 	assert.Contains(t, fc.systems[0], "ANSWER: 1")
 	u := fc.users[0]
-	assert.Contains(t, u, "Text before the spot:\nkunderna ska då")
+	assert.Contains(t, u, "Text before the spot:\ngrannarna ska då")
 	assert.Contains(t, u, "[[ THE SPOT ]]")
-	assert.Contains(t, u, "Text after the spot:\nDe ska kunna betala")
-	assert.Contains(t, u, "Reading 1: onboardade\nReading 2: omvårdade", "base first when AltFirst is false")
+	assert.Contains(t, u, "Text after the spot:\nDe ska kunna måla")
+	assert.Contains(t, u, "Reading 1: målade\nReading 2: mölade", "base first when AltFirst is false")
 }
 
 func TestLLMAdjudicator_AltFirstSwapsWhichReadingIsNumberOne(t *testing.T) {
@@ -59,7 +59,7 @@ func TestLLMAdjudicator_AltFirstSwapsWhichReadingIsNumberOne(t *testing.T) {
 	_, err := reconcile.NewLLMAdjudicator(fc).Adjudicate(context.Background(), r)
 
 	require.NoError(t, err)
-	assert.Contains(t, fc.users[0], "Reading 1: omvårdade\nReading 2: onboardade")
+	assert.Contains(t, fc.users[0], "Reading 1: mölade\nReading 2: målade")
 }
 
 func TestLLMAdjudicator_MapsTheAnswerBackToBaseOrAltWhicheverOrderWasShown(t *testing.T) {
@@ -134,8 +134,8 @@ func TestOrderChecked_AsksTwiceWithTheOrderSwappedAndKeepsOnlyAgreement(t *testi
 			require.NoError(t, err)
 			assert.Equal(t, tt.want, got)
 			require.Len(t, fc.users, 2)
-			assert.True(t, strings.Contains(fc.users[0], "Reading 1: onboardade"), "first call shows the base first")
-			assert.True(t, strings.Contains(fc.users[1], "Reading 1: omvårdade"), "second call shows the alternative first")
+			assert.True(t, strings.Contains(fc.users[0], "Reading 1: målade"), "first call shows the base first")
+			assert.True(t, strings.Contains(fc.users[1], "Reading 1: mölade"), "second call shows the alternative first")
 		})
 	}
 }

internal/reconcile/disputes_test.go

@@ -19,12 +19,12 @@ func TestFindDisputes_NoneWhenTheTextsAgreeWordForWord(t *testing.T) {
 }
 
 func TestFindDisputes_OneReplacedWordIsOneDisputeCarryingBothReadings(t *testing.T) {
-	got := disputes("Vi ska onboardade kunderna.", "Vi ska omvårdade kunderna.")
+	got := disputes("Vi ska målade grannarna.", "Vi ska mölade grannarna.")
 
 	require.Len(t, got, 1)
 	d := got[0]
-	assert.Equal(t, "onboardade", d.Base)
-	assert.Equal(t, "omvårdade", d.Alt)
+	assert.Equal(t, "målade", d.Base)
+	assert.Equal(t, "mölade", d.Alt)
 	assert.Equal(t, 2, d.BaseStart)
 	assert.Equal(t, 3, d.BaseEnd)
 	assert.Equal(t, 2, d.AltStart)
@@ -32,11 +32,11 @@ func TestFindDisputes_OneReplacedWordIsOneDisputeCarryingBothReadings(t *testing
 }
 
 func TestFindDisputes_ReadingsKeepTheirOwnSpellingAndPunctuation(t *testing.T) {
-	got := disputes("Det blir T+1, alltså.", "Det blir T 1, alltså.")
+	got := disputes("Det blir A+2, alltså.", "Det blir A 2, alltså.")
 
 	require.Len(t, got, 1)
-	assert.Equal(t, "T+1,", got[0].Base)
-	assert.Equal(t, "T 1,", got[0].Alt, "the alternative's words replace the span as the engine wrote them")
+	assert.Equal(t, "A+2,", got[0].Base)
+	assert.Equal(t, "A 2,", got[0].Alt, "the alternative's words replace the span as the engine wrote them")
 }
 
 func TestFindDisputes_AWordOnlyOneEngineHeardHasAnEmptyOtherSide(t *testing.T) {
@@ -90,12 +90,12 @@ func TestAutoResolve(t *testing.T) {
 		base, alt string
 		resolved  bool
 	}{
-		{"a compound written as two words or one", "i crossborder delen", "i crossborderdelen", true},
-		{"a compound with a hyphen", "crossborder-delen", "crossborder delen", true},
+		{"a compound written as two words or one", "i takrenns delen", "i takrennsdelen", true},
+		{"a compound with a hyphen", "takrenns-delen", "takrenns delen", true},
 		{"a filler only the alternative heard", "vi ska ju betala", "vi ska betala", true},
 		{"a filler only the base heard", "vi ska betala", "vi ska ju betala", true},
 		{"two fillers in a row", "vi ska ja ju betala", "vi ska betala", true},
-		{"a different word is for the model", "vi ska onboardade", "vi ska omvårdade", false},
+		{"a different word is for the model", "vi ska målade", "vi ska mölade", false},
 		{"a different number is for the model", "totalt 1050 kronor", "totalt 2050 kronor", false},
 		{"a content word only one side heard is for the model", "ett förslag", "ett coolt förslag", false},
 		{"three filler words are too many to wave through", "vi ska ju då liksom betala", "vi ska betala", false},

internal/reconcile/reconcile.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 	"git.d-ma.be/mathias/tapir/internal/progress"
 )
 
@@ -101,9 +102,8 @@ func Reconcile(ctx context.Context, base, alt domain.Transcription, adj Adjudica
 			rec.Errors++
 			consecutive++
 			if consecutive >= breakAfter {
-				failure := fmt.Errorf("the model failed %d times in a row: %w", consecutive, err)
-				rep.Fail("decide", failure)
-				return skipped(base, rec, failure.Error()), nil
+				rep.Fail("decide", err)
+				return skipped(base, rec, fmt.Sprintf("the model failed %d times in a row (%s)", consecutive, errkind.Of(err))), nil
 			}
 			v = VerdictUnsure
 		} else {

internal/reconcile/reconcile_progress_test.go

@@ -48,8 +48,8 @@ func reconcileWith(t *testing.T, ctx context.Context, base, alt string, adj reco
 
 // two compound/filler disputes the model is never asked about, then two it is.
 const (
-	progBase = "i crossborder delen ska vi ju betala totalt 1015 kronor till SEB idag"
-	progAlt  = "i crossborderdelen ska vi betala totalt 1050 kronor till SCB idag"
+	progBase = "i takrenns delen ska vi ju betala totalt 1015 kronor till Axel idag"
+	progAlt  = "i takrennsdelen ska vi betala totalt 1050 kronor till Alex idag"
 )
 
 func TestReconcileProgress_TheDecidingPhaseTotalIsTheModelDecisionsNotTheDisputes(t *testing.T) {

internal/reconcile/reconcile_reason_test.go

@@ -0,0 +1,33 @@
+package reconcile_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/reconcile"
+)
+
+// The reason a reconciliation was skipped is stored and shown on a page about a private
+// recording, so it carries a kind, never the model's error text, which can echo the
+// prompt (adversarial review F3).
+
+func TestReconcile_TheBreakerReasonCarriesAKindNotTheModelsText(t *testing.T) {
+	adj := &scripted{fn: func(int, reconcile.Request) (reconcile.Verdict, error) {
+		return reconcile.VerdictBase, errors.New("gateway echoed the prompt: zebrakaka secret words")
+	}}
+	small := opts
+	small.BreakAfter = 2
+
+	out, err := reconcile.Reconcile(context.Background(), tr(progBase), tr(progAlt), adj, small)
+
+	require.NoError(t, err)
+	require.Equal(t, domain.ReconcileSkipped, out.Reconciliation.Status)
+	assert.NotContains(t, out.Reconciliation.Reason, "zebrakaka", "provider text must not be stored or shown")
+	assert.Contains(t, out.Reconciliation.Reason, "2 times in a row", "the reason still says what happened")
+	assert.Contains(t, out.Reconciliation.Reason, "error", "and carries a kind")
+}

internal/reconcile/reconcile_spots_test.go

@@ -31,16 +31,16 @@ func TestReconcileSpots_AKeptSpotAndAChangedSpotAreBothStoredWithTheirVerdict(t
 }
 
 func TestReconcileSpots_AutoResolvedDisputesAreNotStored(t *testing.T) {
-	out := merge(t, tr("i crossborder delen ska vi ju betala"), tr("i crossborderdelen ska vi betala"), always(reconcile.VerdictAlt))
+	out := merge(t, tr("i takrenns delen ska vi ju betala"), tr("i takrennsdelen ska vi betala"), always(reconcile.VerdictAlt))
 
 	assert.Empty(t, out.Reconciliation.Contested, "compounds and fillers were never judged; they are counted, not listed")
 }
 
 func TestReconcileSpots_ASpotCarriesTheWordsJustBeforeIt(t *testing.T) {
-	out := merge(t, tr("vi skickar in ett special meddelande till taxsystemet"), tr("vi skickar in ett CAMT meddelande till taxsystemet"), always(reconcile.VerdictAlt))
+	out := merge(t, tr("grannen målar ett vanligt staket mot gatan"), tr("grannen målar ett KORT staket mot gatan"), always(reconcile.VerdictAlt))
 
 	require.Len(t, out.Reconciliation.Contested, 1)
-	assert.Equal(t, "vi skickar in ett", out.Reconciliation.Contested[0].Before)
+	assert.Equal(t, "grannen målar ett", out.Reconciliation.Contested[0].Before)
 }
 
 func TestReconcileSpots_TheContextIsAFewWordsNotTheWholeMeeting(t *testing.T) {

internal/reconcile/reconcile_test.go

@@ -58,10 +58,10 @@ func TestReconcile_IdenticalTextsNeedNoModelAndComeBackUnchanged(t *testing.T) {
 func TestReconcile_TrivialDisputesAreResolvedWithoutAskingTheModel(t *testing.T) {
 	adj := always(reconcile.VerdictAlt)
 
-	out := merge(t, tr("i crossborder delen ska vi ju betala"), tr("i crossborderdelen ska vi betala"), adj)
+	out := merge(t, tr("i takrenns delen ska vi ju betala"), tr("i takrennsdelen ska vi betala"), adj)
 
 	assert.Empty(t, adj.calls, "a compound split and a filler particle are not worth a model call")
-	assert.Equal(t, "i crossborder delen ska vi ju betala", out.Text, "the base reading is kept")
+	assert.Equal(t, "i takrenns delen ska vi ju betala", out.Text, "the base reading is kept")
 	assert.Equal(t, 2, out.Reconciliation.Disputes)
 	assert.Equal(t, 2, out.Reconciliation.AutoResolved)
 	assert.Zero(t, out.Reconciliation.Adjudicated)
@@ -76,13 +76,13 @@ func TestReconcile_AltVerdictReplacesTheSpanWithTheAlternativesOwnWords(t *testi
 }
 
 func TestReconcile_BaseAndUnsureVerdictsKeepTheBaseButOnlyUnsureIsFlagged(t *testing.T) {
-	base := tr("Totalt 1015 kronor till SEB.")
-	alt := tr("Totalt 1050 kronor till SCB.")
+	base := tr("Totalt 1015 kronor till Axel.")
+	alt := tr("Totalt 1050 kronor till Alex.")
 
 	keptBase := merge(t, base, alt, always(reconcile.VerdictBase))
 	unsure := merge(t, base, alt, always(reconcile.VerdictUnsure))
 
-	assert.Equal(t, "Totalt 1015 kronor till SEB.", keptBase.Text)
+	assert.Equal(t, "Totalt 1015 kronor till Axel.", keptBase.Text)
 	assert.Zero(t, keptBase.Reconciliation.Unsure)
 	require.Len(t, keptBase.Reconciliation.Contested, 2,
 		"every judged spot is stored, kept ones too: without them the reconciler cannot be compared with either engine alone (ADR-035)")
@@ -90,7 +90,7 @@ func TestReconcile_BaseAndUnsureVerdictsKeepTheBaseButOnlyUnsureIsFlagged(t *tes
 		assert.Equal(t, "base", c.Used)
 		assert.False(t, c.Unsure, "a confident 'the base is right' is stored but is not an uncertain spot")
 	}
-	assert.Equal(t, "Totalt 1015 kronor till SEB.", unsure.Text, "unsure keeps the base")
+	assert.Equal(t, "Totalt 1015 kronor till Axel.", unsure.Text, "unsure keeps the base")
 	assert.Equal(t, 2, unsure.Reconciliation.Unsure)
 	require.Len(t, unsure.Reconciliation.Contested, 2)
 	assert.True(t, unsure.Reconciliation.Contested[0].Unsure)
@@ -98,12 +98,12 @@ func TestReconcile_BaseAndUnsureVerdictsKeepTheBaseButOnlyUnsureIsFlagged(t *tes
 }
 
 func TestReconcile_ChangedSpotsAreRecordedWithBothReadings(t *testing.T) {
-	out := merge(t, tr("det blir T+1 imorgon"), tr("det blir en T imorgon"), always(reconcile.VerdictAlt))
+	out := merge(t, tr("det blir A+2 imorgon"), tr("det blir en A imorgon"), always(reconcile.VerdictAlt))
 
 	require.Len(t, out.Reconciliation.Contested, 1)
 	c := out.Reconciliation.Contested[0]
-	assert.Equal(t, "T+1", c.Base)
-	assert.Equal(t, "en T", c.Alt)
+	assert.Equal(t, "A+2", c.Base)
+	assert.Equal(t, "en A", c.Alt)
 	assert.Equal(t, "alt", c.Used)
 	assert.False(t, c.Unsure)
 }
@@ -122,16 +122,16 @@ func TestReconcile_AWordOnlyTheBaseHeardCanBeRemoved(t *testing.T) {
 
 func TestReconcile_SeveralDisputesAreAppliedIndependentlyAndInOrder(t *testing.T) {
 	adj := &scripted{fn: func(i int, r reconcile.Request) (reconcile.Verdict, error) {
-		if r.Alt == "omvårdade" || r.Alt == "SCB" {
+		if r.Alt == "mölade" || r.Alt == "Alex" {
 			return reconcile.VerdictAlt, nil
 		}
 		return reconcile.VerdictBase, nil
 	}}
 
-	out := merge(t, tr("kunderna onboardade nu och sen betalas till SEB via ombud med 1050 kronor"),
-		tr("kunderna omvårdade nu och sen betalas till SCB via ombud med 2050 kronor"), adj)
+	out := merge(t, tr("kunderna målade nu och sen betalas till Axel via ombud med 1050 kronor"),
+		tr("kunderna mölade nu och sen betalas till Alex via ombud med 2050 kronor"), adj)
 
-	assert.Equal(t, "kunderna omvårdade nu och sen betalas till SCB via ombud med 1050 kronor", out.Text)
+	assert.Equal(t, "kunderna mölade nu och sen betalas till Alex via ombud med 1050 kronor", out.Text)
 	assert.Equal(t, 3, out.Reconciliation.Disputes)
 	assert.Equal(t, 2, out.Reconciliation.Changed)
 }
@@ -193,7 +193,8 @@ func TestReconcile_ConsecutiveModelErrorsStopTheWholeReconciliationInsteadOfWait
 	assert.Len(t, adj.calls, 3, "three consecutive failures and it stops asking")
 	assert.Equal(t, strings.Join(a, " "), out.Text, "the base text, with none of the partial changes")
 	assert.Equal(t, domain.ReconcileSkipped, out.Reconciliation.Status)
-	assert.Contains(t, out.Reconciliation.Reason, "gateway down")
+	assert.Contains(t, out.Reconciliation.Reason, "3 times in a row")
+	assert.NotContains(t, out.Reconciliation.Reason, "gateway down", "the reason is shown on the page: a kind, not the model's own text")
 }
 
 func TestReconcile_ASuccessBetweenFailuresResetsTheBreaker(t *testing.T) {

internal/reconcile/tokens_test.go

@@ -34,9 +34,9 @@ func TestTokenize_KeepsTheWordAsWrittenAndKeysItWithoutCaseOrPunctuation(t *test
 }
 
 func TestTokenize_KeysIgnoreHyphensAndPlusSoOnlyWordsDecideEquality(t *testing.T) {
-	got := reconcile.Tokenize("end-to-end T+1 5 000 kr")
+	got := reconcile.Tokenize("end-to-end A+2 5 000 kr")
 
-	assert.Equal(t, []string{"endtoend", "t1", "5", "000", "kr"}, keys(got))
+	assert.Equal(t, []string{"endtoend", "a2", "5", "000", "kr"}, keys(got))
 }
 
 func TestTokenize_APunctuationOnlyWordJoinsThePreviousWordInsteadOfBecomingOne(t *testing.T) {

internal/uploads/intake.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"time"
 
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
@@ -33,6 +34,9 @@ type Job struct {
 	UserID   string
 	UploadID string
 	Path     string
+	// Duration is what the file CLAIMED when probed. The worker compares it with what
+	// was really converted; zero means unknown (ADR-035 review).
+	Duration time.Duration
 }
 
 // Submitter hands accepted jobs to the in-process worker (ADR-033).
@@ -54,12 +58,42 @@ func NewIntake(s Store, p Prober, sub Submitter, l Limits, tmpDir string) *Intak
 	return &Intake{store: s, prober: p, sub: sub, limits: l, tmpDir: tmpDir}
 }
 
+// ErrClientRead marks an error that came from READING the client's body: a connection that
+// dropped, a body cut short. It is the sender's to retry, unlike a spool, probe or database
+// fault, which is ours. It is a marker on the error, not a sentinel that others may wrap:
+// io.ErrUnexpectedEOF alone is also what a database drop looks like.
+var ErrClientRead = errors.New("uploads: client body read failed")
+
+// clientReader remembers the last non-EOF error its source returned, so Accept can tell
+// a failure reading the client from a failure writing the spool file.
+type clientReader struct {
+	r   io.Reader
+	err error
+}
+
+func (c *clientReader) Read(p []byte) (int, error) {
+	n, err := c.r.Read(p)
+	if err != nil && !errors.Is(err, io.EOF) {
+		c.err = err
+	}
+	return n, err
+}
+
+// busyMessage is what a user is told when the queue is full.
+const busyMessage = "Too many recordings are waiting to be transcribed. Please try again in a few minutes."
+
 // Accept spools src to disk (bounded by MaxBytes), probes it, validates it, records
 // a queued upload and submits the job. It returns the upload id. A file that fails
 // validation yields a *RejectError and creates NO row — rejection is synchronous
 // and leaves nothing behind. On success the temp file is handed to the job and the
 // worker deletes it; on every failure path Accept deletes it itself.
 func (in *Intake) Accept(ctx context.Context, userID, title string, src io.Reader) (string, error) {
+	// Refuse before spooling when the queue has no room, if the submitter can say so: a full
+	// queue otherwise cost up to the upload cap on disk, an ffprobe run and a failed row for
+	// every refused attempt.
+	if rc, ok := in.sub.(interface{ HasRoom(userID string) bool }); ok && !rc.HasRoom(userID) {
+		return "", &RejectError{Reason: ReasonBusy, Message: busyMessage}
+	}
 	f, err := os.CreateTemp(in.tmpDir, "upload-*")
 	if err != nil {
 		return "", fmt.Errorf("uploads: spool: %w", err)
@@ -73,11 +107,15 @@ func (in *Intake) Accept(ctx context.Context, userID, title string, src io.Reade
 	}()
 
 	// Read one byte past the cap so "exactly at the limit" and "over" are told apart.
-	n, err := io.Copy(f, io.LimitReader(src, in.limits.MaxBytes+1))
+	cr := &clientReader{r: io.LimitReader(src, in.limits.MaxBytes+1)}
+	n, err := io.Copy(f, cr)
 	if cerr := f.Close(); err == nil {
 		err = cerr
 	}
 	if err != nil {
+		if cr.err != nil && errors.Is(err, cr.err) {
+			return "", fmt.Errorf("%w: %w", ErrClientRead, err)
+		}
 		return "", fmt.Errorf("uploads: receive: %w", err)
 	}
 	if n > in.limits.MaxBytes {
@@ -103,7 +141,15 @@ func (in *Intake) Accept(ctx context.Context, userID, title string, src io.Reade
 	if err != nil {
 		return "", fmt.Errorf("uploads: create: %w", err)
 	}
-	if err := in.sub.Submit(Job{UserID: userID, UploadID: id, Path: path}); err != nil {
+	if err := in.sub.Submit(Job{UserID: userID, UploadID: id, Path: path, Duration: probe.Duration}); err != nil {
+		if errors.Is(err, ErrQueueFull) {
+			// The user's to retry, not a server fault: refuse it as such, and do not leave
+			// the row queued -- that is the stuck spinner.
+			if ferr := in.store.FailUpload(ctx, userID, id, domain.UploadErrBusy); ferr != nil {
+				return "", fmt.Errorf("uploads: submit: %w (and failing the row: %v)", err, ferr)
+			}
+			return "", &RejectError{Reason: ReasonBusy, Message: busyMessage}
+		}
 		// A row that will never run must not sit queued: that is the stuck spinner.
 		if ferr := in.store.FailUpload(ctx, userID, id, domain.UploadErrInterrupted); ferr != nil {
 			return "", fmt.Errorf("uploads: submit: %w (and failing the row: %v)", err, ferr)

internal/uploads/intake_busy_test.go

@@ -0,0 +1,96 @@
+package uploads_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+// A full queue is the user's to retry, not a server fault: a typed rejection, the row
+// failed honestly, the audio removed (adversarial review F6).
+
+func TestAccept_AFullQueueIsABusyRejectionNotAServerErrorAndLeavesNothingBehind(t *testing.T) {
+	r := newRig(t)
+	r.sub.err = uploads.ErrQueueFull
+
+	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
+
+	var rej *uploads.RejectError
+	require.True(t, errors.As(err, &rej), "a full queue must be a rejection the web layer can answer with 429: %v", err)
+	assert.Equal(t, uploads.ReasonBusy, rej.Reason)
+	assert.Contains(t, rej.Message, "waiting")
+	assert.Equal(t, domain.UploadErrBusy, r.st.failed["up-1"], "the row must not sit queued: that is the stuck spinner")
+	assert.Empty(t, r.tmpFiles(t), "the audio is deleted")
+}
+
+// roomSubmitter is a Submitter that can say, before anything is spooled, that there is no room.
+type roomSubmitter struct {
+	fakeSubmitter
+	room bool
+}
+
+func (r *roomSubmitter) HasRoom(string) bool { return r.room }
+
+func TestAccept_ANoRoomQueueIsRefusedBeforeAnythingIsSpooledProbedOrStored(t *testing.T) {
+	// Checking only at Submit meant 200 MB was spooled and ffprobe run for every refused
+	// attempt, and a failed row was left behind each time (second adversarial review).
+	r := newRig(t)
+	full := &roomSubmitter{room: false}
+	in := uploads.NewIntake(r.st, r.pr, full, uploads.Limits{MaxBytes: 1024, MaxDuration: 90 * time.Minute}, r.tmp)
+
+	_, err := in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
+
+	var rej *uploads.RejectError
+	require.True(t, errors.As(err, &rej))
+	assert.Equal(t, uploads.ReasonBusy, rej.Reason)
+	assert.Empty(t, r.st.created, "no row for an upload that was never accepted")
+	assert.Empty(t, r.pr.paths, "ffprobe was never run on it")
+	assert.Empty(t, r.tmpFiles(t), "nothing was spooled")
+	assert.Empty(t, full.jobs)
+}
+
+func TestAccept_ASubmitterThatCannotSayStillWorksAsBefore(t *testing.T) {
+	r := newRig(t)
+
+	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
+
+	require.NoError(t, err, "a Submitter without HasRoom is accepted: the check at Submit remains")
+}
+
+// brokenBody is a client body that fails mid-read, like a connection that dropped.
+type brokenBody struct{ n int }
+
+func (b *brokenBody) Read(p []byte) (int, error) {
+	if b.n > 0 {
+		b.n = 0
+		return copy(p, "partial audio"), nil
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+func TestAccept_AnErrorReadingTheClientsBodyIsMarkedAsTheClientsAndAWrappedSubmitErrorIsNot(t *testing.T) {
+	r := newRig(t)
+
+	_, err := r.in.Accept(context.Background(), "user-1", "t", &brokenBody{n: 1})
+
+	require.Error(t, err)
+	assert.ErrorIs(t, err, uploads.ErrClientRead, "a dropped client body is the sender's to retry")
+	assert.Empty(t, r.tmpFiles(t))
+
+	// A fault that is ours must NOT carry the marker, even if it wraps the same sentinel.
+	r2 := newRig(t)
+	r2.sub.err = fmt.Errorf("db: %w", io.ErrUnexpectedEOF)
+	_, err = r2.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
+	require.Error(t, err)
+	assert.NotErrorIs(t, err, uploads.ErrClientRead)
+}

internal/uploads/intake_test.go

@@ -106,7 +106,8 @@ func TestAccept_ValidAudioIsStoredProbedQueuedAndSubmitted(t *testing.T) {
 	assert.Equal(t, audio, r.pr.seen, "the prober must see the complete uploaded bytes, on disk")
 	require.Len(t, r.sub.jobs, 1)
 	job := r.sub.jobs[0]
-	assert.Equal(t, uploads.Job{UserID: "user-1", UploadID: "up-1", Path: job.Path}, job)
+	assert.Equal(t, uploads.Job{UserID: "user-1", UploadID: "up-1", Path: job.Path, Duration: 10 * time.Minute}, job,
+		"the job carries what the file CLAIMED, so the worker can compare it with what was converted")
 	assert.Equal(t, filepath.Dir(job.Path), r.tmp, "the temp file lives in the configured directory")
 	got, err := os.ReadFile(job.Path)
 	require.NoError(t, err)

internal/uploads/validate.go

@@ -34,6 +34,8 @@ const (
 	ReasonTooLong    Reason = "too_long"
 	ReasonTooLarge   Reason = "too_large"
 	ReasonUnreadable Reason = "unreadable"
+	// ReasonBusy: the queue is full. Not about the file: the user retries later.
+	ReasonBusy Reason = "busy"
 )
 
 // RejectError is a synchronous, user-presentable refusal. Message is written for

internal/uploads/worker.go

@@ -10,12 +10,18 @@ import (
 	"time"
 
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 	"git.d-ma.be/mathias/tapir/internal/progress"
 )
 
 // ErrStopped is returned by Submit once the worker has stopped.
 var ErrStopped = errors.New("uploads: worker stopped")
 
+// ErrQueueFull is returned by Submit when the queue, or one user's share of it, is at
+// its cap. Every queued job holds up to the upload cap on disk until its turn, so an
+// unbounded queue is a disk-filling lever (ADR-035 review).
+var ErrQueueFull = errors.New("uploads: queue full")
+
 // Converter turns the uploaded file into the 16 kHz mono PCM WAV whisper wants.
 type Converter interface {
 	ToWAV(ctx context.Context, src, dst string) error
@@ -53,10 +59,24 @@ func WithHeartbeat(beat, still time.Duration) WorkerOption {
 	return func(w *Worker) { w.beatEvery, w.stillEvery = beat, still }
 }
 
+// WithQueueLimits bounds how many jobs may WAIT: in total, and per user. A job being
+// processed is not waiting. The defaults are 20 and 3 (one instance, one job at a time).
+func WithQueueLimits(total, perUser int) WorkerOption {
+	return func(w *Worker) { w.maxQueued, w.maxPerUser = total, perUser }
+}
+
+// WithMaxDuration makes the worker measure the converted audio and fail a job whose real
+// length exceeds the limit, or falls far short of what the file claimed. Zero (the
+// default) measures nothing. The limit is first checked against the file's header, which
+// can lie (ADR-035 review).
+func WithMaxDuration(d time.Duration) WorkerOption { return func(w *Worker) { w.maxDuration = d } }
+
 // WithLogger replaces slog.Default() as the worker's logger.
 func WithLogger(l *slog.Logger) WorkerOption { return func(w *Worker) { w.log = l } }
 
 const (
+	defaultMaxQueued  = 20
+	defaultMaxPerUser = 3
 	defaultBeatEvery  = 10 * time.Second
 	defaultStillEvery = 5 * time.Minute
 )
@@ -87,6 +107,8 @@ type Worker struct {
 
 	log                   *slog.Logger
 	beatEvery, stillEvery time.Duration
+	maxDuration           time.Duration
+	maxQueued, maxPerUser int
 
 	mu      sync.Mutex
 	queue   []Job
@@ -100,6 +122,7 @@ func NewWorker(s WorkerStore, c Converter, t Transcriber, tmpDir string, timeout
 	w := &Worker{
 		store: s, conv: c, tr: t, tmpDir: tmpDir, timeout: timeout, wake: make(chan struct{}, 1),
 		beatEvery: defaultBeatEvery, stillEvery: defaultStillEvery,
+		maxQueued: defaultMaxQueued, maxPerUser: defaultMaxPerUser,
 	}
 	for _, o := range opts {
 		o(w)
@@ -107,6 +130,24 @@ func NewWorker(s WorkerStore, c Converter, t Transcriber, tmpDir string, timeout
 	return w
 }
 
+// HasRoom reports whether a job from this user would be accepted right now. It lets the
+// intake refuse BEFORE spooling up to the upload cap and running ffprobe; Submit still
+// enforces the same limits atomically, so a race costs at worst one refused submit.
+func (w *Worker) HasRoom(userID string) bool {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.stopped || len(w.queue) >= w.maxQueued {
+		return false
+	}
+	mine := 0
+	for _, q := range w.queue {
+		if q.UserID == userID {
+			mine++
+		}
+	}
+	return mine < w.maxPerUser
+}
+
 // Submit queues a job. It never blocks. It satisfies Submitter.
 func (w *Worker) Submit(j Job) error {
 	w.mu.Lock()
@@ -114,6 +155,18 @@ func (w *Worker) Submit(j Job) error {
 	if w.stopped {
 		return ErrStopped
 	}
+	if len(w.queue) >= w.maxQueued {
+		return ErrQueueFull
+	}
+	mine := 0
+	for _, q := range w.queue {
+		if q.UserID == j.UserID {
+			mine++
+		}
+	}
+	if mine >= w.maxPerUser {
+		return ErrQueueFull
+	}
 	w.queue = append(w.queue, j)
 	select {
 	case w.wake <- struct{}{}:
@@ -189,8 +242,8 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	start := time.Now()
 
 	if err := w.store.StartTranscribing(ctx, job.UserID, job.UploadID); err != nil {
-		log.Error("upload: start transcribing", "err", err)
-		w.fail(ctx, job, log)
+		log.Error("upload: start transcribing", "kind", errkind.Of(err))
+		w.fail(ctx, job, log, domain.UploadErrTranscriptionFailed)
 		return
 	}
 
@@ -217,17 +270,17 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 
 	// abort records where the job stopped. A shutdown (the parent context ended) is not
 	// a failure: the row is left for the start-up sweep, so the step stays as it was.
-	abort := func() {
+	abort := func(kind domain.UploadErrorKind) {
 		if ctx.Err() == nil {
 			tr.FailRunning()
 		}
-		w.fail(ctx, job, log)
+		w.fail(ctx, job, log, kind)
 	}
 
 	wav, err := w.tempWAV()
 	if err != nil {
-		log.Error("upload: temp wav", "err", err)
-		abort()
+		log.Error("upload: temp wav", "kind", errkind.Of(err))
+		abort(domain.UploadErrTranscriptionFailed)
 		return
 	}
 	defer func() { _ = os.Remove(wav) }()
@@ -236,10 +289,22 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	defer cancel()
 	tr.Begin("audio", 0)
 	if err := w.conv.ToWAV(jobCtx, job.Path, wav); err != nil {
-		log.Error("upload: convert", "err", err)
-		abort()
+		log.Error("upload: convert", "kind", errkind.Of(err))
+		abort(domain.UploadErrTranscriptionFailed)
 		return
 	}
+	got, tooLong := w.audioLengthProblem(wav)
+	if tooLong {
+		abort(domain.UploadErrTooLong)
+		log.Error("upload: converted audio is over the limit", "audio_s", int(got.Seconds()), "limit_s", int(w.maxDuration.Seconds()))
+		return
+	}
+	if w.maxDuration > 0 && job.Duration > 0 {
+		if note := shortfallNote(got, job.Duration); note != "" {
+			log.Warn("upload: audio is much shorter than the file claimed", "audio_s", int(got.Seconds()), "claimed_s", int(job.Duration.Seconds()))
+			tr.Annotate("audio", note)
+		}
+	}
 	tr.Done("audio")
 
 	if !planned {
@@ -247,8 +312,8 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	}
 	t, err := w.tr.Transcribe(progress.With(jobCtx, tr), wav)
 	if err != nil {
-		log.Error("upload: transcribe", "err", err, "elapsed", time.Since(start).Round(time.Second))
-		abort()
+		log.Error("upload: transcribe", "kind", errkind.Of(err), "elapsed", time.Since(start).Round(time.Second))
+		abort(domain.UploadErrTranscriptionFailed)
 		return
 	}
 	if !planned {
@@ -257,8 +322,8 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 
 	tr.Begin("save", 0)
 	if err := w.store.CompleteUpload(ctx, job.UserID, job.UploadID, t); err != nil {
-		log.Error("upload: store transcript", "err", err)
-		abort()
+		log.Error("upload: store transcript", "kind", errkind.Of(err))
+		abort(domain.UploadErrTranscriptionFailed)
 		return
 	}
 	tr.Done("save")
@@ -269,12 +334,12 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 
 // fail records a transcription failure — unless the PARENT context ended, which
 // is a shutdown, not a failure: the row is left for the start-up sweep.
-func (w *Worker) fail(ctx context.Context, job Job, log *slog.Logger) {
+func (w *Worker) fail(ctx context.Context, job Job, log *slog.Logger, kind domain.UploadErrorKind) {
 	if ctx.Err() != nil {
 		return
 	}
-	if err := w.store.FailUpload(ctx, job.UserID, job.UploadID, domain.UploadErrTranscriptionFailed); err != nil {
-		log.Error("upload: record failure", "err", err)
+	if err := w.store.FailUpload(ctx, job.UserID, job.UploadID, kind); err != nil {
+		log.Error("upload: record failure", "kind", errkind.Of(err))
 	}
 }
 
@@ -290,3 +355,42 @@ func (w *Worker) tempWAV() (string, error) {
 	}
 	return name, nil
 }
+
+const (
+	// tooLongSlack is how far over the limit the converted audio may be before the claim
+	// in the file's header is called a lie: ffmpeg rounds.
+	tooLongSlack = 30 * time.Second
+	// A file counts as truncated when it converts to under 80% of the length it claimed
+	// AND more than two minutes short. Probe estimates for variable-bitrate files are
+	// imprecise; refusing real recordings would be worse than the problem.
+	incompleteBelow     = 0.8
+	incompleteShortfall = 2 * time.Minute
+)
+
+// audioLengthProblem measures the converted WAV (16 kHz mono 16-bit PCM is 32,000 bytes a
+// second after a 44-byte header) against the limit. It returns the real length and whether
+// that is over the limit by more than the tolerance.
+func (w *Worker) audioLengthProblem(wav string) (got time.Duration, tooLong bool) {
+	if w.maxDuration <= 0 {
+		return 0, false
+	}
+	info, err := os.Stat(wav)
+	if err != nil {
+		return 0, false
+	}
+	got = time.Duration(float64(max(info.Size()-44, 0)) / 32000 * float64(time.Second))
+	return got, got > w.maxDuration+tooLongSlack
+}
+
+// shortfallNote is a remark for the audio step when the converted audio is much shorter
+// than the file claimed, or "" when it is not. It is a NOTE and never a failure: a
+// container header can over-estimate a complete file (a variable-bitrate MP3 without a Xing
+// header claimed 79 minutes for 20 real ones), so refusing would turn away real
+// recordings, while saying nothing about a truncated one would hide a partial transcript.
+func shortfallNote(got, claimed time.Duration) string {
+	if float64(got) >= incompleteBelow*float64(claimed) || claimed-got <= incompleteShortfall {
+		return ""
+	}
+	return fmt.Sprintf("The audio is %s long; the file claimed %s. If the recording was cut off, upload the complete one.",
+		FormatDuration(got), FormatDuration(claimed))
+}

internal/uploads/worker_duration_test.go

@@ -0,0 +1,187 @@
+package uploads_test
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+// The duration limit is a claim in the file's header. The worker measures what was
+// really converted and refuses both a recording that is longer than the limit (the
+// header lied low) and one that ends far earlier than the file claimed (it was truncated
+// and would otherwise yield a partial transcript with no warning) -- adversarial review F2.
+
+// sizedConverter writes a (sparse) 16 kHz mono PCM WAV of the given length, without
+// actually allocating it: 32,000 bytes per second plus a 44-byte header.
+type sizedConverter struct{ seconds float64 }
+
+func (c sizedConverter) ToWAV(_ context.Context, _, dst string) error {
+	f, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = f.Close() }()
+	return f.Truncate(44 + int64(c.seconds*32000))
+}
+
+func durationWorker(t *testing.T, r *wrig, wavSeconds float64, max time.Duration) *uploads.Worker {
+	t.Helper()
+	opts := []uploads.WorkerOption{}
+	if max > 0 {
+		opts = append(opts, uploads.WithMaxDuration(max))
+	}
+	return uploads.NewWorker(r.st, sizedConverter{seconds: wavSeconds}, r.tr, r.tmp, time.Minute, opts...)
+}
+
+func jobWith(r *wrig, t *testing.T, claimed time.Duration) uploads.Job {
+	j := r.spool(t, "a")
+	j.Duration = claimed
+	return j
+}
+
+func TestWorkerDuration_AConvertedLengthOverTheLimitFailsTheJobBeforeAnyEngineSeesIt(t *testing.T) {
+	r := newWRig(t, time.Minute)
+	w := durationWorker(t, r, 100*60, 90*time.Minute)
+
+	w.Process(context.Background(), jobWith(r, t, 10*time.Second))
+
+	_, failed := r.st.snapshot()
+	assert.Equal(t, domain.UploadErrTooLong, failed["a"], "a header that claimed 10 s must not let 100 minutes through")
+	assert.Empty(t, r.tr.paths, "no engine may be sent audio that is over the limit")
+	assert.Empty(t, r.leftovers(t), "the audio is still deleted")
+}
+
+func TestWorkerDuration_JustOverTheLimitWithinTheSlackStillTranscribes(t *testing.T) {
+	r := newWRig(t, time.Minute)
+	w := durationWorker(t, r, 90*60+20, 90*time.Minute)
+
+	w.Process(context.Background(), jobWith(r, t, 90*time.Minute))
+
+	completed, failed := r.st.snapshot()
+	assert.Empty(t, failed)
+	assert.Contains(t, completed, "a", "ffmpeg rounds: 20 s over a 90-minute limit is not a lie")
+}
+
+func audioStepNote(r *wrig) string {
+	for _, st := range r.st.lastSteps() {
+		if st.Key == "audio" {
+			return st.Note
+		}
+	}
+	return ""
+}
+
+func TestWorkerDuration_AFileThatEndsFarEarlierThanItClaimedIsStillTranscribedAndSaysSo(t *testing.T) {
+	// A container header can over-estimate a complete file (VBR MP3 without a Xing header
+	// claimed 79 minutes for 20 real ones). Refusing it was wrong; staying silent about a
+	// truncated one is wrong too. So it is transcribed, and the audio step carries a note.
+	r := newWRig(t, time.Minute)
+	w := durationWorker(t, r, 20*60, 90*time.Minute)
+
+	w.Process(context.Background(), jobWith(r, t, 79*time.Minute))
+
+	completed, failed := r.st.snapshot()
+	assert.Empty(t, failed, "a complete recording with a bad header estimate must not be refused")
+	assert.Contains(t, completed, "a")
+	note := audioStepNote(r)
+	assert.Contains(t, note, "20 min", "what was really transcribed")
+	assert.Contains(t, note, "1 h 19 min", "what the file claimed")
+	assert.Contains(t, note, "cut off", "and what to do if that is not a surprise")
+}
+
+func TestWorkerDuration_TheShortfallNoteIsPinnedAtEightyPercentAndTwoMinutes(t *testing.T) {
+	tests := []struct {
+		name    string
+		claimed time.Duration
+		wav     float64
+		noted   bool
+	}{
+		{"79 percent of an hour", 60 * time.Minute, 0.79 * 3600, true},
+		{"exactly 80 percent of an hour", 60 * time.Minute, 2880, false},
+		{"one second under 80 percent of an hour", 60 * time.Minute, 2879, true},
+		{"81 percent of an hour", 60 * time.Minute, 0.81 * 3600, false},
+		{"exactly two minutes short and under 80 percent", 6 * time.Minute, 4 * 60, false},
+		{"two minutes and a second short and under 80 percent", 6 * time.Minute, 4*60 - 1, true},
+		{"unknown claimed length", 0, 20 * 60, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := newWRig(t, time.Minute)
+			w := durationWorker(t, r, tt.wav, 90*time.Minute)
+
+			w.Process(context.Background(), jobWith(r, t, tt.claimed))
+
+			assert.Equal(t, tt.noted, audioStepNote(r) != "")
+			completed, _ := r.st.snapshot()
+			assert.Contains(t, completed, "a", "a note never stops the job")
+		})
+	}
+}
+
+func TestWorkerDuration_TheTooLongToleranceIsExactlyThirtySeconds(t *testing.T) {
+	tests := []struct {
+		name string
+		wav  float64
+		fail bool
+	}{
+		{"at the limit plus 30 s", 90*60 + 30, false},
+		{"at the limit plus 31 s", 90*60 + 31, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := newWRig(t, time.Minute)
+			w := durationWorker(t, r, tt.wav, 90*time.Minute)
+
+			w.Process(context.Background(), jobWith(r, t, 90*time.Minute))
+
+			_, failed := r.st.snapshot()
+			if tt.fail {
+				assert.Equal(t, domain.UploadErrTooLong, failed["a"])
+			} else {
+				assert.Empty(t, failed)
+			}
+		})
+	}
+}
+
+func TestWorkerDuration_AnEstimateThatIsMerelyALittleOffIsNotTruncation(t *testing.T) {
+	tests := []struct {
+		name    string
+		claimed time.Duration
+		wav     float64
+	}{
+		{"five percent short", 60 * time.Minute, 57 * 60},
+		{"under two minutes short of a long file", 60 * time.Minute, 59 * 60},
+		{"unknown claimed length", 0, 20 * 60},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := newWRig(t, time.Minute)
+			w := durationWorker(t, r, tt.wav, 90*time.Minute)
+
+			w.Process(context.Background(), jobWith(r, t, tt.claimed))
+
+			completed, failed := r.st.snapshot()
+			assert.Empty(t, failed)
+			assert.Contains(t, completed, "a")
+		})
+	}
+}
+
+func TestWorkerDuration_WithNoMaximumConfiguredNothingIsMeasured(t *testing.T) {
+	r := newWRig(t, time.Minute)
+	w := durationWorker(t, r, 100*60, 0)
+
+	w.Process(context.Background(), jobWith(r, t, 0))
+
+	completed, _ := r.st.snapshot()
+	assert.Contains(t, completed, "a")
+	require.NotNil(t, w)
+}

internal/uploads/worker_progress_test.go

@@ -146,7 +146,7 @@ func TestWorkerProgress_TheHeartbeatBeatsWhileAnEngineCallIsStuckAndStopsWhenThe
 	assert.Equal(t, after, r.st.beatCount(), "no heartbeat may outlive its job")
 }
 
-func TestWorkerProgress_TheLogNamesEveryPhaseInOrderAndNeverTheTranscriptOrThePath(t *testing.T) {
+func TestWorkerProgress_OnASuccessfulJobTheLogNamesEveryPhaseInOrderAndNeverTheTranscriptOrThePath(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	r.tr.result = domain.Transcription{Text: "zebrakaka secret meeting words", Endpoint: "iguana/kb-whisper", AudioSeconds: 3}
 	buf := &syncLog{}
@@ -162,4 +162,54 @@ func TestWorkerProgress_TheLogNamesEveryPhaseInOrderAndNeverTheTranscriptOrThePa
 	assert.Contains(t, out, "upload=a", "every line says which upload it is about")
 	assert.NotContains(t, out, "zebrakaka", "no transcript text in the log")
 	assert.NotContains(t, out, r.tmp, "no spool path, which carries the upload's identity, in the log")
+	assert.Contains(t, out, "upload transcribed", "the job's own summary line")
+	assert.Contains(t, out, "endpoint=iguana/kb-whisper", "which endpoint served it is a quality fact")
+}
+
+func TestWorkerProgress_AFailureLogsAKindNeverTheErrorTextOrThePath(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(*wrig)
+		line  string
+	}{
+		{"conversion fails and names the spool file", func(r *wrig) {
+			r.conv.err = errors.New("Error opening input file " + r.tmp + "/upload-a: Invalid data zebrakaka")
+		}, "upload: convert"},
+		{"every engine fails and the gateway echoed a word", func(r *wrig) {
+			r.tr.err = errors.New("gateway echoed: zebrakaka secret words")
+		}, "upload: transcribe"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := newWRig(t, time.Minute)
+			tt.setup(r)
+			buf := &syncLog{}
+			w := newProgressWorker(t, r, r.tr, uploads.WithLogger(slog.New(slog.NewTextHandler(buf, nil))))
+
+			w.Process(context.Background(), r.spool(t, "a"))
+
+			out := buf.String()
+			assert.NotContains(t, out, "zebrakaka", "provider text or file contents in the log")
+			assert.NotContains(t, out, r.tmp, "the spool path in the log")
+			assert.Contains(t, out, tt.line, "the failure must be logged at all, not only scrubbed")
+			assert.Contains(t, out, "kind=error")
+			assert.Contains(t, out, "upload=a")
+		})
+	}
+}
+
+func TestWorkerProgress_AStoreFailureLogsItsSQLStateNeverTheValueItQuotes(t *testing.T) {
+	// A Postgres error can quote the offending value; for a transcript row that is the
+	// transcript (fourth adversarial review). The log gets the SQLSTATE.
+	r := newWRig(t, time.Minute)
+	r.st.completeErr = dbErr{}
+	buf := &syncLog{}
+	w := newProgressWorker(t, r, r.tr, uploads.WithLogger(slog.New(slog.NewTextHandler(buf, nil))))
+
+	w.Process(context.Background(), r.spool(t, "a"))
+
+	out := buf.String()
+	assert.NotContains(t, out, "zebrakaka")
+	assert.Contains(t, out, "upload: store transcript")
+	assert.Contains(t, out, "kind=sql_22P02")
 }

internal/uploads/worker_queue_test.go

@@ -0,0 +1,108 @@
+package uploads_test
+
+import (
+	"context"
+	"errors"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+// The queue was append-only: 100,000 submits with the worker idle all succeeded, and each
+// queued job holds up to the upload cap on disk until its turn (adversarial review F6).
+
+func queueWorker(t *testing.T, total, perUser int) *uploads.Worker {
+	t.Helper()
+	r := newWRig(t, time.Minute)
+	return uploads.NewWorker(r.st, r.conv, r.tr, r.tmp, time.Minute, uploads.WithQueueLimits(total, perUser))
+}
+
+func submit(w *uploads.Worker, user string, n int) error {
+	return w.Submit(uploads.Job{UserID: user, UploadID: user + "-" + strconv.Itoa(n), Path: "/nonexistent"})
+}
+
+func TestWorkerSubmit_RefusesBeyondTheTotalQueueCap(t *testing.T) {
+	w := queueWorker(t, 3, 10)
+
+	for i := 0; i < 3; i++ {
+		require.NoError(t, submit(w, "u"+strconv.Itoa(i), i))
+	}
+
+	err := submit(w, "u9", 9)
+	assert.ErrorIs(t, err, uploads.ErrQueueFull)
+}
+
+func TestWorkerSubmit_OneUserCannotFillTheQueueForEveryoneElse(t *testing.T) {
+	w := queueWorker(t, 100, 2)
+
+	require.NoError(t, submit(w, "alice", 1))
+	require.NoError(t, submit(w, "alice", 2))
+	errAlice := submit(w, "alice", 3)
+	errBob := submit(w, "bob", 1)
+
+	assert.True(t, errors.Is(errAlice, uploads.ErrQueueFull), "a third waiting upload from one user is refused")
+	assert.NoError(t, errBob, "another user is not affected by alice's queue")
+}
+
+func TestWorkerSubmit_ThereIsADefaultCapSoANeglectedWorkerCannotBeFilledForever(t *testing.T) {
+	r := newWRig(t, time.Minute)
+	w := uploads.NewWorker(r.st, r.conv, r.tr, r.tmp, time.Minute)
+
+	refused := 0
+	for i := 0; i < 1000; i++ {
+		if err := submit(w, "u"+strconv.Itoa(i), i); errors.Is(err, uploads.ErrQueueFull) {
+			refused++
+		}
+	}
+
+	assert.Positive(t, refused, "with the defaults, 1,000 submits to an idle worker must not all be accepted")
+}
+
+func TestWorkerSubmit_AJobThatHasLeftTheQueueFreesItsPlace(t *testing.T) {
+	r := newWRig(t, time.Minute)
+	w := uploads.NewWorker(r.st, r.conv, r.tr, r.tmp, time.Minute, uploads.WithQueueLimits(1, 1))
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() { defer close(done); w.Run(ctx) }()
+	defer func() { cancel(); <-done }()
+
+	job := r.spool(t, "first")
+	require.NoError(t, w.Submit(job))
+	require.Eventually(t, func() bool { c, _ := r.st.snapshot(); _, ok := c["first"]; return ok },
+		5*time.Second, 5*time.Millisecond, "the first job never completed")
+
+	assert.NoError(t, w.Submit(r.spool(t, "second")), "the cap counts jobs waiting, not jobs ever submitted")
+}
+
+func TestWorkerHasRoom_SaysWhetherASubmitWouldBeAccepted(t *testing.T) {
+	w := queueWorker(t, 3, 2)
+	assert.True(t, w.HasRoom("alice"))
+	require.NoError(t, submit(w, "alice", 1))
+	require.NoError(t, submit(w, "alice", 2))
+
+	assert.False(t, w.HasRoom("alice"), "alice is at her share")
+	assert.True(t, w.HasRoom("bob"), "bob is not")
+	require.NoError(t, submit(w, "bob", 1))
+	assert.False(t, w.HasRoom("carol"), "the queue as a whole is at its cap")
+}
+
+func TestWorkerHasRoom_AgreesWithSubmitAtEveryStepAndIsFalseOnceStopped(t *testing.T) {
+	w := queueWorker(t, 2, 1)
+	for i, user := range []string{"a", "a", "b", "c"} {
+		room := w.HasRoom(user)
+		err := submit(w, user, i)
+		assert.Equal(t, room, err == nil, "step %d (%s): HasRoom=%v but Submit returned %v", i, user, room, err)
+	}
+
+	r := newWRig(t, time.Minute)
+	stopped := uploads.NewWorker(r.st, r.conv, r.tr, r.tmp, time.Minute)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	stopped.Run(ctx)
+	assert.False(t, stopped.HasRoom("a"), "a worker that has stopped has no room")
+}

internal/uploads/worker_test.go

@@ -23,8 +23,10 @@ type wStore struct {
 	completed map[string]domain.Transcription
 	failed    map[string]domain.UploadErrorKind
 	startErr  error
-	saves     [][]domain.ProgressStep
-	beats     int
+	// completeErr makes CompleteUpload fail, as a database outage would.
+	completeErr error
+	saves       [][]domain.ProgressStep
+	beats       int
 	// beatDelay makes each heartbeat write slow, so one is still in flight when a job
 	// ends -- which is what proves the worker waits for its heartbeat to finish.
 	beatDelay time.Duration
@@ -44,6 +46,9 @@ func (s *wStore) StartTranscribing(_ context.Context, _, id string) error {
 func (s *wStore) CompleteUpload(_ context.Context, _, id string, t domain.Transcription) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if s.completeErr != nil {
+		return s.completeErr
+	}
 	s.completed[id] = t
 	return nil
 }
@@ -208,6 +213,10 @@ func TestWorkerProcess_FailuresAreTypedAndStillDeleteTheAudio(t *testing.T) {
 	}{
 		{"conversion fails", func(r *wrig) { r.conv.err = errors.New("moov atom not found") }},
 		{"every transcription endpoint fails", func(r *wrig) { r.tr.err = errors.New("iguana down; berget down") }},
+		{"storing the finished transcript fails", func(r *wrig) { r.st.completeErr = errors.New("db down") }},
+		{"the temporary WAV cannot be created", func(r *wrig) {
+			r.w = uploads.NewWorker(r.st, r.conv, r.tr, filepath.Join(r.tmp, "missing"), time.Minute)
+		}},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -315,3 +324,11 @@ func TestWorkerRun_StoppingDeletesQueuedAudioAndRefusesNewJobs(t *testing.T) {
 	assert.Empty(t, r.leftovers(t), "audio of queued jobs is deleted on stop: the rows are swept to interrupted at next start")
 	assert.ErrorIs(t, r.w.Submit(r.spool(t, "c")), uploads.ErrStopped)
 }
+
+// dbErr is an error shaped like pgx's: a message that quotes a value, and an SQLSTATE.
+type dbErr struct{}
+
+func (dbErr) Error() string {
+	return `ERROR: invalid input syntax for type json: "zebrakaka secret words"`
+}
+func (dbErr) SQLState() string { return "22P02" }

internal/web/handlers.go

@@ -122,6 +122,11 @@ type App struct {
 	// summarizer's (koala/phi4-mini, 8,192-token context) and cannot hold an hour of
 	// speech.
 	UploadChatModel string
+	// UploadChatModels is the set of models chat over an uploaded recording offers and
+	// accepts. The whole private transcript goes to the one chosen, so it must hold
+	// LOCAL models only, and the caller decides that. Nil or empty fails closed: no
+	// model is offered and none is called (ADR-035 review).
+	UploadChatModels []string
 	// Processing tracks in-flight immediate summarizations so the status endpoint
 	// shows the animation until the summary lands. The zero value is ready to use.
 	Processing ProcessingSet

internal/web/uploads.go

@@ -8,8 +8,10 @@ import (
 	"math"
 	"net/http"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
+	"unicode"
 	"unicode/utf8"
 
 	"github.com/a-h/templ"
@@ -17,6 +19,7 @@ import (
 	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/errkind"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 
@@ -91,13 +94,32 @@ func (a *App) handleUploadPost(w http.ResponseWriter, r *http.Request) {
 			break
 		}
 		if err != nil {
+			var tooBig *http.MaxBytesError
+			if a.abandoned(w, r) {
+				return
+			}
+			if !errors.As(err, &tooBig) {
+				// A malformed multipart body (a header with a control byte, a truncated
+				// part) is the sender's to fix: a 400, not a server error, and the error
+				// text is never logged: it quotes the headers, which carry the file name.
+				a.logger().Info("upload rejected", "reason", "malformed")
+				a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "That upload could not be read. Please try again.")
+				return
+			}
 			a.uploadFailure(w, r, userID, err)
 			return
 		}
 		switch part.FormName() {
 		case "title":
-			b, _ := io.ReadAll(io.LimitReader(part, maxTitleRunes*utf8.UTFMax))
-			title = clipRunes(strings.TrimSpace(string(b)), maxTitleRunes)
+			b, err := io.ReadAll(io.LimitReader(part, maxTitleRunes*utf8.UTFMax))
+			if err != nil {
+				if a.abandoned(w, r) {
+					return
+				}
+				a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "That upload could not be read. Please try again.")
+				return
+			}
+			title = cleanTitle(string(b))
 		case "file":
 			if title == "" {
 				title = titleFromFilename(part.FileName())
@@ -114,10 +136,27 @@ func (a *App) handleUploadPost(w http.ResponseWriter, r *http.Request) {
 	a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "Choose an audio file to upload.")
 }
 
+// abandoned reports, logs at INFO and answers 499, because the client has already gone: its request
+// context is cancelled, so there is nobody to answer and rendering a page would run its
+// database read on a dead context and log a false ERROR. A hang-up mid-upload is routine.
+func (a *App) abandoned(w http.ResponseWriter, r *http.Request) bool {
+	if r.Context().Err() == nil {
+		return false
+	}
+	a.logger().Info("upload abandoned", "reason", "client_gone")
+	// 499 (the "client closed request" convention): a client that half-closed after sending
+	// can still read, and an unwritten status would reach it as a false, empty 200.
+	w.WriteHeader(499)
+	return true
+}
+
 // uploadFailure maps an Accept (or multipart) error to a response: a validation
 // rejection is the user's to fix (422, or 413 for size) and carries its own
 // message; anything else is ours.
 func (a *App) uploadFailure(w http.ResponseWriter, r *http.Request, userID string, err error) {
+	if a.abandoned(w, r) {
+		return
+	}
 	var rej *uploads.RejectError
 	var tooBig *http.MaxBytesError
 	switch {
@@ -125,16 +164,26 @@ func (a *App) uploadFailure(w http.ResponseWriter, r *http.Request, userID strin
 		// Logged by reason only: the filename and title are private content.
 		a.logger().Info("upload rejected", "reason", string(rej.Reason))
 		status := http.StatusUnprocessableEntity
-		if rej.Reason == uploads.ReasonTooLarge {
+		switch rej.Reason {
+		case uploads.ReasonTooLarge:
 			status = http.StatusRequestEntityTooLarge
+		case uploads.ReasonBusy:
+			status = http.StatusTooManyRequests
 		}
 		a.renderUploadsPage(w, r, userID, status, rej.Message)
 	case errors.As(err, &tooBig):
 		a.logger().Info("upload rejected", "reason", string(uploads.ReasonTooLarge))
 		a.renderUploadsPage(w, r, userID, http.StatusRequestEntityTooLarge,
 			"This file is larger than the upload limit.")
+	case errors.Is(err, uploads.ErrClientRead):
+		// An error reading the CLIENT's body: theirs to retry, not a server fault. Only that
+		// marker counts: io.ErrUnexpectedEOF alone is also what a database drop looks like.
+		a.logger().Info("upload rejected", "reason", "truncated")
+		a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "The upload was cut off before it finished. Please try again.")
 	default:
-		a.serverError(w, r, "upload", err)
+		// Not err: it can carry the file's name, a spool path or a database value.
+		a.logger().Error("upload failed", "kind", errkind.Of(err))
+		http.Error(w, "internal error", http.StatusInternalServerError)
 	}
 }
 
@@ -165,7 +214,14 @@ func (a *App) loadOwnedUpload(w http.ResponseWriter, r *http.Request) (*domain.U
 	if !ok {
 		return nil, false
 	}
-	u, err := a.Store.GetUpload(r.Context(), userID, r.PathValue("id"))
+	id := r.PathValue("id")
+	if !uuidShape.MatchString(id) {
+		// Not an id at all: the same 404 as an unknown or foreign one, never a database
+		// error that surfaces as a 500 (and no oracle about which ids exist).
+		http.NotFound(w, r)
+		return nil, false
+	}
+	u, err := a.Store.GetUpload(r.Context(), userID, id)
 	if errors.Is(err, store.ErrUploadNotFound) {
 		http.NotFound(w, r)
 		return nil, false
@@ -180,11 +236,49 @@ func (a *App) loadOwnedUpload(w http.ResponseWriter, r *http.Request) (*domain.U
 // titleFromFilename is the default title: the file's name without its extension.
 func titleFromFilename(name string) string {
 	base := filepath.Base(name)
-	t := strings.TrimSuffix(base, filepath.Ext(base))
+	t := cleanTitle(strings.TrimSuffix(base, filepath.Ext(base)))
 	if t == "" || t == "." {
 		return "Untitled recording"
 	}
-	return clipRunes(t, maxTitleRunes)
+	return t
+}
+
+// hasNote reports whether any phase carries a note. A note is the only warning for a
+// recording that is shorter than its file claimed, so a record that has one is shown open.
+func hasNote(steps []domain.ProgressStep) bool {
+	for _, s := range steps {
+		if s.Note != "" {
+			return true
+		}
+	}
+	return false
+}
+
+// uuidShape is the form of an upload id. Anything else cannot be one, so it is a 404.
+var uuidShape = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+
+// isBidiControl reports the invisible characters that change text direction. Emoji joiners
+// (ZWJ, ZWNJ) and variation selectors are not among them and are kept.
+func isBidiControl(r rune) bool {
+	return r >= 0x202A && r <= 0x202E || r >= 0x2066 && r <= 0x2069 || r == 0x200E || r == 0x200F || r == 0x061C
+}
+
+// cleanTitle makes a title safe to store and show: invalid UTF-8 dropped, control
+// characters (NUL, newlines, escapes) turned into spaces, runs of space collapsed, trimmed
+// and clipped. A title is cosmetic; bad bytes in it must never fail an upload, and Postgres
+// refuses NUL in text.
+func cleanTitle(s string) string {
+	s = strings.ToValidUTF8(s, "")
+	s = strings.Map(func(r rune) rune {
+		switch {
+		case isBidiControl(r):
+			return -1 // dropped: U+202E would reverse the rest of the title on its owner's page
+		case unicode.IsControl(r):
+			return ' '
+		}
+		return r
+	}, s)
+	return clipRunes(strings.Join(strings.Fields(s), " "), maxTitleRunes)
 }
 
 func clipRunes(s string, n int) string {
@@ -200,6 +294,10 @@ func uploadFailureMessage(k domain.UploadErrorKind) string {
 	switch k {
 	case domain.UploadErrInterrupted:
 		return "The server restarted before this recording was transcribed. Please upload it again."
+	case domain.UploadErrBusy:
+		return "Too many recordings were waiting to be transcribed when this one was uploaded. Please upload it again in a few minutes."
+	case domain.UploadErrTooLong:
+		return "This recording is longer than the limit once its audio is read (the file's header said otherwise). Please upload a shorter recording."
 	case domain.UploadErrTranscriptionFailed:
 		return "Transcription failed on every available service. Please upload it again later."
 	default:
@@ -220,7 +318,8 @@ func (a *App) handleUploadChat(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/uploads/"+u.ID, http.StatusSeeOther)
 		return
 	}
-	a.render(w, r, UploadChatPage(*u, a.uploadChatView(*u, a.Chat.DefaultModel(a.UploadChatModel), nil, false, "")))
+	model, _ := a.resolveUploadModel("")
+	a.render(w, r, UploadChatPage(*u, a.uploadChatView(*u, model, nil, false, "")))
 }
 
 // handleUploadChatMessage answers one question against the owner's uploaded
@@ -240,7 +339,13 @@ func (a *App) handleUploadChatMessage(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad form", http.StatusBadRequest)
 		return
 	}
-	model := a.resolveModel(r.FormValue("model"), a.UploadChatModel)
+	model, ok := a.resolveUploadModel(r.FormValue("model"))
+	if !ok {
+		a.logger().Error("upload chat: no local model is configured; nothing was sent", "upload", u.ID)
+		view := a.uploadChatView(*u, "", nil, false, "No local model is available for chat about a recording.")
+		a.render(w, r, UploadChatPage(*u, view))
+		return
+	}
 	history := parseHistory(r.Form["hq"], r.Form["ha"])
 	question := strings.TrimSpace(r.FormValue("question"))
 
@@ -254,7 +359,7 @@ func (a *App) handleUploadChatMessage(w http.ResponseWriter, r *http.Request) {
 			MaxChars:   a.UploadChatMaxChars,
 		})
 		if err != nil {
-			a.logger().Error("upload chat answer", "upload", u.ID, "model", model, "err", err)
+			a.logger().Error("upload chat answer", "upload", u.ID, "model", model, "kind", errkind.Of(err))
 			view.Error = "That model couldn't answer just now. Try again, or switch models."
 		} else {
 			view.History = appendTurn(history, chat.Turn{Question: question, Answer: reply.Answer})
@@ -273,7 +378,7 @@ func (a *App) uploadChatView(u domain.UploadedTranscript, model string, history
 		VideoID:   u.ID,
 		Title:     u.Title,
 		Available: true,
-		Models:    a.Chat.Models(),
+		Models:    a.UploadChatModels,
 		Selected:  model,
 		History:   history,
 		Truncated: truncated,
@@ -401,3 +506,27 @@ func minutesAgo(d time.Duration) string {
 	}
 	return "under a minute"
 }
+
+// resolveUploadModel picks the model for chat over an uploaded recording from the
+// offered LOCAL set only: the posted one when it is in the set, else the configured
+// default when it is, else the first. ok is false when no model is offered, in which
+// case nothing may be sent anywhere (the whole private transcript is the payload).
+func (a *App) resolveUploadModel(posted string) (model string, ok bool) {
+	offered := func(m string) bool {
+		for _, o := range a.UploadChatModels {
+			if o == m {
+				return true
+			}
+		}
+		return false
+	}
+	switch {
+	case posted != "" && offered(posted):
+		return posted, true
+	case a.UploadChatModel != "" && offered(a.UploadChatModel):
+		return a.UploadChatModel, true
+	case len(a.UploadChatModels) > 0:
+		return a.UploadChatModels[0], true
+	}
+	return "", false
+}

internal/web/uploads.templ

@@ -68,7 +68,7 @@ templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 				</p>
 				@reconciliationNote(u.Reconciliation)
 				if len(u.Progress) > 0 {
-					<details class="what-was-done">
+					<details class="what-was-done" if hasNote(u.Progress) { open }>
 						<summary>What was done</summary>
 						@progressSteps(u.Progress, now, false)
 					</details>
@@ -218,6 +218,9 @@ templ progressSteps(steps []domain.ProgressStep, now time.Time, live bool) {
 				if t := stepTime(s, now); t != "" {
 					<span class="step-time">{ t }</span>
 				}
+				if s.Note != "" {
+					<span class="step-note">{ s.Note }</span>
+				}
 				if s.State == domain.StepRunning && s.Total > 0 {
 					<progress class="step-bar" value={ strconv.Itoa(s.Done) } max={ strconv.Itoa(s.Total) }></progress>
 					<span class="step-count">{ strconv.Itoa(s.Done) } of { strconv.Itoa(s.Total) }</span>

internal/web/uploads_badinput_handler_test.go

@@ -0,0 +1,93 @@
+package web_test
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Input that cannot be right is the caller's to fix: a 4xx, never a 500 (adversarial
+// review F7). No cross-tenant oracle either way: unknown and foreign ids look the same.
+
+func TestUploadRoutes_ANonUUIDIdIs404NotA500(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	for _, path := range []string{"/uploads/not-a-uuid", "/uploads/not-a-uuid/status", "/uploads/not-a-uuid/chat", "/uploads/%00/status", "/uploads/1/status"} {
+		t.Run(path, func(t *testing.T) {
+			rec := do(t, app, get(path))
+
+			assert.Equal(t, http.StatusNotFound, rec.Code)
+		})
+	}
+}
+
+func TestUploadPost_ATitleWithControlCharactersOrInvalidUTF8IsCleanedNotA500(t *testing.T) {
+	tests := []struct{ name, title, filename string }{
+		{"a NUL in the title", "Sprint\x00review", "a.m4a"},
+		{"invalid UTF-8 in the title", "Sprint \xff\xfe review", "a.m4a"},
+		{"a newline in the title", "Sprint\nreview", "a.m4a"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			app, sub := newUploadApp(t, audioOK, 200<<20)
+
+			rec := do(t, app, uploadReq(t, tt.title, tt.filename, []byte("synthetic audio bytes")))
+
+			require.Equal(t, http.StatusSeeOther, rec.Code, "bad bytes in a cosmetic title must not fail the upload: %s", body(t, rec))
+			require.Len(t, sub.jobs, 1)
+			var title string
+			require.NoError(t, rawPool(t).QueryRow(context.Background(), `SELECT title FROM uploaded_transcripts WHERE id = $1`, sub.jobs[0].UploadID).Scan(&title))
+			assert.NotContains(t, title, "\x00")
+			assert.NotContains(t, title, "\n")
+			assert.True(t, len(title) > 0, "a title is still shown")
+		})
+	}
+}
+
+func TestUploadPost_AMalformedMultipartHeaderIsA400AndItsTextIsNotLogged(t *testing.T) {
+	// A control byte in the part's file name makes the multipart body malformed. It is the
+	// sender's to fix, and the parser's error quotes the header, which carries the name.
+	app, sub := newUploadApp(t, audioOK, 200<<20)
+	buf := &lockedBuf{}
+	app.Log = slog.New(slog.NewTextHandler(buf, nil))
+
+	rec := do(t, app, uploadReq(t, "", "zebrakaka\x00weekly.m4a", []byte("x")))
+
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+	assert.Empty(t, sub.jobs)
+	assert.NotContains(t, buf.String(), "zebrakaka", "a file name is private content")
+}
+
+func TestUploadPost_EveryBidirectionalControlCharacterIsStrippedFromATitle(t *testing.T) {
+	// U+202E reverses the text that follows it, so a title could render reversed on its
+	// owner's own page (second adversarial review). Every one of the twelve is pinned.
+	controls := []rune{0x202A, 0x202B, 0x202C, 0x202D, 0x202E, 0x2066, 0x2067, 0x2068, 0x2069, 0x200E, 0x200F, 0x061C}
+	for _, c := range controls {
+		t.Run(fmt.Sprintf("U+%04X", c), func(t *testing.T) {
+			app, sub := newUploadApp(t, audioOK, 200<<20)
+
+			rec := do(t, app, uploadReq(t, "Sprint"+string(c)+"review", "a.m4a", []byte("x")))
+
+			require.Equal(t, http.StatusSeeOther, rec.Code)
+			var title string
+			require.NoError(t, rawPool(t).QueryRow(context.Background(), `SELECT title FROM uploaded_transcripts WHERE id = $1`, sub.jobs[0].UploadID).Scan(&title))
+			assert.Equal(t, "Sprintreview", title, "dropped, not replaced by a space: a space would leave a visible gap")
+		})
+	}
+}
+
+func TestUploadPost_SwedishLettersAndEmojiSurviveTheTitleCleaning(t *testing.T) {
+	app, sub := newUploadApp(t, audioOK, 200<<20)
+
+	// Includes a ZWJ sequence (woman + ZWJ + laptop) and a ZWNJ: joiners are not direction controls.
+	rec := do(t, app, uploadReq(t, "Möte åäö 🎙️ 👩\u200d💻 a\u200cb", "a.m4a", []byte("x")))
+
+	require.Equal(t, http.StatusSeeOther, rec.Code)
+	var title string
+	require.NoError(t, rawPool(t).QueryRow(context.Background(), `SELECT title FROM uploaded_transcripts WHERE id = $1`, sub.jobs[0].UploadID).Scan(&title))
+	assert.Equal(t, "Möte åäö 🎙️ 👩\u200d💻 a\u200cb", title, "joiners and variation selectors belong to the text")
+}

internal/web/uploads_busy_handler_test.go

@@ -0,0 +1,31 @@
+package web_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+func TestUploadPost_ABusyRejectionIs429WithItsMessage(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	app.Uploads = failingUploader{err: &uploads.RejectError{Reason: uploads.ReasonBusy, Message: "Too many recordings are waiting. Try again in a few minutes."}}
+
+	rec := do(t, app, uploadReq(t, "t", "a.m4a", []byte("x")))
+
+	require.Equal(t, http.StatusTooManyRequests, rec.Code, "the user's to retry: not a 500, not a 422")
+	assert.Contains(t, body(t, rec), "Too many recordings are waiting")
+}
+
+func TestUploadStatus_ABusyFailureIsExplainedInWords(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	id := seedUpload(t, userID, "m", "failed", "queue_full")
+
+	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
+
+	assert.Contains(t, b, "waiting")
+	assert.NotContains(t, b, "This upload failed. Please upload it again.")
+}

internal/web/uploads_chat_handler_test.go

@@ -31,6 +31,7 @@ func newUploadChatApp(t *testing.T) (*web.App, *fakeChatter) {
 	}
 	app.Chat = fc
 	app.UploadChatMaxChars = 120000
+	app.UploadChatModels = fc.models
 	return app, fc
 }
 

internal/web/uploads_chat_local_handler_test.go

@@ -0,0 +1,73 @@
+package web_test
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
+	"git.d-ma.be/mathias/tapir/internal/web"
+)
+
+// The whole private transcript goes to the model chosen in the form, so the upload chat
+// offers and accepts local models only, even when the shared chat service knows a cloud
+// one (ADR-035 review). The cloud model here is only a name; no network is involved.
+
+func newUploadChatAppWithCloud(t *testing.T) (*web.App, *fakeChatter) {
+	t.Helper()
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	fc := &fakeChatter{
+		models: []string{"koala/phi4-mini", "iguana/gemma4-26b", "berget/mistral-small"},
+		reply:  chat.Reply{Answer: "Anders owns the timber order."},
+	}
+	app.Chat = fc
+	app.UploadChatMaxChars = 120000
+	app.UploadChatModels = []string{"koala/phi4-mini", "iguana/gemma4-26b"}
+	return app, fc
+}
+
+func TestUploadChatPage_DoesNotOfferACloudModelEvenThoughTheServiceKnowsOne(t *testing.T) {
+	app, _ := newUploadChatAppWithCloud(t)
+	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
+
+	b := body(t, do(t, app, get("/uploads/"+id+"/chat")))
+
+	assert.Contains(t, b, "iguana/gemma4-26b")
+	assert.NotContains(t, b, "berget/mistral-small", "the switcher must not list a model the transcript must not be sent to")
+}
+
+func TestUploadChatPost_AForgedCloudModelIsReplacedByALocalOneBeforeTheTranscriptIsSent(t *testing.T) {
+	app, fc := newUploadChatAppWithCloud(t)
+	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
+
+	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"Who owns timber?"}, "model": {"berget/mistral-small"}}))
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	require.Equal(t, 1, fc.callCount)
+	assert.NotEqual(t, "berget/mistral-small", fc.gotReq.Model, "a cloud model reached the chat service with the private transcript")
+	assert.Contains(t, []string{"koala/phi4-mini", "iguana/gemma4-26b"}, fc.gotReq.Model)
+}
+
+func TestUploadChatPost_ALocalModelThatIsOfferedIsHonoured(t *testing.T) {
+	app, fc := newUploadChatAppWithCloud(t)
+	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
+
+	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}, "model": {"koala/phi4-mini"}}))
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	assert.Equal(t, "koala/phi4-mini", fc.gotReq.Model)
+}
+
+func TestUploadChat_WithNoLocalModelConfiguredNothingIsSentAnywhere(t *testing.T) {
+	app, fc := newUploadChatAppWithCloud(t)
+	app.UploadChatModels = nil
+	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
+
+	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}, "model": {"berget/mistral-small"}}))
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	assert.Zero(t, fc.callCount, "failing closed: no local model offered means no model is called")
+}

internal/web/uploads_disconnect_handler_test.go

@@ -0,0 +1,124 @@
+package web_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A client that hangs up in the middle of an upload is routine, not a server fault. The
+// in-process recorder cannot see it (its context never cancels), so this talks to a real
+// listener (third adversarial review: over a socket every such case logged an ERROR and
+// half-close returned a 500, because the error page was rendered on a cancelled context).
+
+// body positions at which the client can hang up: inside the title field, inside the file
+// part's own headers, and mid-file. Every one must be handled alike (fourth adversarial
+// review: the title branch had no guard and still logged an ERROR).
+const (
+	inTitle   = "in the title"
+	inHeaders = "in the file part's headers"
+	midFile   = "mid-file"
+)
+
+func partialUpload(t *testing.T, addr, where string, hangUp func(*net.TCPConn)) {
+	t.Helper()
+	c, err := net.Dial("tcp", addr)
+	require.NoError(t, err)
+	tc := c.(*net.TCPConn)
+	const boundary = "xBOUNDARYx"
+	var body string
+	switch where {
+	case inTitle:
+		body = "--" + boundary + "\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nhalf a tit"
+	case inHeaders:
+		body = "--" + boundary + "\r\nContent-Disposition: form-data; name=\"file\"; filena"
+	default:
+		body = "--" + boundary + "\r\nContent-Disposition: form-data; name=\"file\"; filename=\"a.m4a\"\r\nContent-Type: audio/mp4\r\n\r\n" + strings.Repeat("a", 4000)
+	}
+	_, err = fmt.Fprintf(tc, "POST /uploads HTTP/1.1\r\nHost: x\r\nContent-Type: multipart/form-data; boundary=%s\r\nContent-Length: 200000\r\n\r\n%s", boundary, body)
+	require.NoError(t, err)
+	time.Sleep(50 * time.Millisecond) // let the server start reading
+	hangUp(tc)
+}
+
+func TestUploadPost_AClientThatHangsUpAnywhereInTheBodyIsLoggedAtInfoAndNeverAsAnError(t *testing.T) {
+	hangUps := map[string]func(*net.TCPConn){
+		"a half close":  func(c *net.TCPConn) { _ = c.CloseWrite(); time.Sleep(100 * time.Millisecond); _ = c.Close() },
+		"a full close":  func(c *net.TCPConn) { _ = c.Close() },
+		"a reset (RST)": func(c *net.TCPConn) { _ = c.SetLinger(0); _ = c.Close() },
+	}
+	for _, where := range []string{inTitle, inHeaders, midFile} {
+		for name, hangUp := range hangUps {
+			t.Run(where+", "+name, func(t *testing.T) {
+				app, sub := newUploadApp(t, audioOK, 200<<20)
+				buf := &lockedBuf{}
+				app.Log = slog.New(slog.NewTextHandler(buf, nil))
+				srv := httptest.NewServer(app.Router())
+				defer srv.Close()
+
+				partialUpload(t, strings.TrimPrefix(srv.URL, "http://"), where, hangUp)
+
+				require.Eventually(t, func() bool {
+					out := buf.String()
+					return strings.Contains(out, "upload abandoned") || strings.Contains(out, "upload rejected") || strings.Contains(out, "level=ERROR")
+				}, 3*time.Second, 20*time.Millisecond, "the server never finished handling the aborted upload")
+				time.Sleep(100 * time.Millisecond)
+				out := buf.String()
+				assert.NotContains(t, out, "level=ERROR", "a client hanging up is not a server fault:\n%s", out)
+				assert.Empty(t, sub.jobs)
+			})
+		}
+	}
+}
+
+// goneMidAccept is an Uploader during whose Accept the client disappears: the request's
+// context is cancelled, then Accept fails the way a read from a dead connection does.
+type goneMidAccept struct{ cancel context.CancelFunc }
+
+func (g goneMidAccept) Accept(context.Context, string, string, io.Reader) (string, error) {
+	g.cancel()
+	return "", fmt.Errorf("receive: %w", io.ErrClosedPipe)
+}
+
+func TestUploadPost_AnAbandonedRequestGetsA499NotAnImplicitEmpty200(t *testing.T) {
+	// If the context is cancelled but the connection can still be written to (a client that
+	// half-closed after sending), a missing status becomes 200 with an empty body: a false
+	// success (fourth adversarial review).
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	buf := &lockedBuf{}
+	app.Log = slog.New(slog.NewTextHandler(buf, nil))
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	app.Uploads = goneMidAccept{cancel: cancel}
+
+	rec := do(t, app, uploadReq(t, "t", "a.m4a", []byte("x")).WithContext(ctx))
+
+	assert.Equal(t, 499, rec.Code, "never an implicit 200 for an upload that was not accepted")
+	assert.Contains(t, buf.String(), "upload abandoned")
+	assert.NotContains(t, buf.String(), "level=ERROR")
+}
+
+func TestUploadPost_ADatabaseDropThatLooksLikeAnEOFIsStillAServerError(t *testing.T) {
+	// pgx turns a connection that drops mid-message into io.ErrUnexpectedEOF. Mapping that
+	// sentinel to "your upload was cut off" (a 400) would hide a real fault: only an error
+	// from reading the CLIENT's body is theirs (third adversarial review).
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	buf := &lockedBuf{}
+	app.Log = slog.New(slog.NewTextHandler(buf, nil))
+	app.Uploads = failingUploader{err: fmt.Errorf("failed to receive message: %w", io.ErrUnexpectedEOF)}
+
+	rec := do(t, app, uploadReq(t, "t", "a.m4a", []byte("x")))
+
+	assert.Equal(t, http.StatusInternalServerError, rec.Code)
+	assert.Contains(t, buf.String(), "level=ERROR")
+}

internal/web/uploads_handler_test.go

@@ -132,7 +132,7 @@ func TestUploadPost_AcceptedAudioQueuesARowAndRedirectsToIt(t *testing.T) {
 	assert.Equal(t, "Sprint review", title)
 	assert.Equal(t, "/uploads/"+id, rec.Header().Get("Location"))
 	require.Len(t, sub.jobs, 1)
-	assert.Equal(t, uploads.Job{UserID: userID, UploadID: id, Path: sub.jobs[0].Path}, sub.jobs[0])
+	assert.Equal(t, uploads.Job{UserID: userID, UploadID: id, Path: sub.jobs[0].Path, Duration: audioOK.Duration}, sub.jobs[0])
 	spooled, err := os.ReadFile(sub.jobs[0].Path)
 	require.NoError(t, err)
 	assert.Equal(t, "synthetic audio bytes", string(spooled))
@@ -366,8 +366,8 @@ func setReconciliation(t *testing.T, id, json string) {
 const reconciledJSON = `{"status":"reconciled","base":"iguana/pianissimo","alt":"iguana/kb-whisper","reconciler":"iguana/gemma4-26b",
  "disputes":380,"auto_resolved":90,"adjudicated":285,"changed":120,"unsure":5,"errors":0,
  "contested":[
-  {"seconds":2210.5,"base":"SEB","alt":"SCB","used":"alt","unsure":false},
-  {"seconds":3400,"base":"T+1","alt":"en T","used":"base","unsure":true}]}`
+  {"seconds":2210.5,"base":"Axel","alt":"Alex","used":"alt","unsure":false},
+  {"seconds":3400,"base":"A+2","alt":"en A","used":"base","unsure":true}]}`
 
 func TestUploadStatus_ReconciledSaysWhatWasDoneInPlainWords(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
@@ -394,11 +394,11 @@ func TestUploadStatus_ListsTheContestedSpotsWithAMinuteMarkBothReadingsAndWhichW
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 
 	assert.Contains(t, b, "~37 min", "2210.5 s")
-	assert.Contains(t, b, "SEB")
-	assert.Contains(t, b, "SCB")
+	assert.Contains(t, b, "Axel")
+	assert.Contains(t, b, "Alex")
 	assert.Contains(t, b, "~57 min", "3400 s")
-	assert.Contains(t, b, "T+1")
-	assert.Contains(t, b, "en T")
+	assert.Contains(t, b, "A+2")
+	assert.Contains(t, b, "en A")
 	assert.Contains(t, b, "uncertain", "an unsure spot is marked so the reader knows to check it")
 }
 
@@ -460,3 +460,20 @@ func TestUploadStatus_AVeryLongListOfContestedSpotsIsShortenedWithItsTrueCount(t
 	assert.NotContains(t, b, ">b119<", "the page does not render every one")
 	assert.Contains(t, b, "70 more", "120 stored, 50 shown")
 }
+
+func TestUploadStatus_ALengthFailureIsExplainedInWordsAndNotAsAGenericError(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	tests := []struct{ kind, want string }{
+		{"audio_too_long", "longer than the limit"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.kind, func(t *testing.T) {
+			id := seedUpload(t, userID, "m-"+tt.kind, "failed", tt.kind)
+
+			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
+
+			assert.Contains(t, b, tt.want)
+			assert.NotContains(t, b, "This upload failed. Please upload it again.")
+		})
+	}
+}

internal/web/uploads_logging_handler_test.go

@@ -0,0 +1,72 @@
+package web_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Error paths of the upload routes log a kind, never the error's text, which can carry
+// a file name, a path, a database value or a provider's output (adversarial review F5).
+
+type lockedBuf struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (l *lockedBuf) Write(p []byte) (int, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.b.Write(p)
+}
+
+func (l *lockedBuf) String() string {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.b.String()
+}
+
+type failingUploader struct{ err error }
+
+func (f failingUploader) Accept(context.Context, string, string, io.Reader) (string, error) {
+	return "", f.err
+}
+
+func TestUploadPost_AnUnexpectedFailureLogsAKindAndNotItsText(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	buf := &lockedBuf{}
+	app.Log = slog.New(slog.NewTextHandler(buf, nil))
+	app.Uploads = failingUploader{err: errors.New(`ffprobe: Error opening input file /spool/upload-555 for "zebrakaka-meeting.m4a"`)}
+
+	rec := do(t, app, uploadReq(t, "t", "zebrakaka-meeting.m4a", []byte("x")))
+
+	assert.Equal(t, http.StatusInternalServerError, rec.Code)
+	out := buf.String()
+	assert.NotContains(t, out, "zebrakaka", "a file name is private content")
+	assert.NotContains(t, out, "/spool/", "a spool path carries the upload's identity")
+	assert.Contains(t, out, "kind=error")
+}
+
+func TestUploadChatPost_AModelFailureLogsAKindAndNotItsText(t *testing.T) {
+	app, fc := newUploadChatApp(t)
+	buf := &lockedBuf{}
+	app.Log = slog.New(slog.NewTextHandler(buf, nil))
+	fc.err = errors.New("LLM returned 400: the prompt was zebrakaka secret words")
+	id := seedUpload(t, userID, "m", "done", meetingText)
+
+	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}}))
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	out := buf.String()
+	assert.NotContains(t, out, "zebrakaka")
+	assert.Contains(t, out, "kind=error")
+}

internal/web/uploads_progress_handler_test.go

@@ -229,16 +229,59 @@ func TestUploadProgress_ADoneJobKeepsItsRecordOfWhatWasDoneAndHowLongEachTook(t
 	assert.NotContains(t, b, "spinner")
 }
 
-func TestUploadProgress_TheFullPageRendersTheSameDisplayAsTheFragment(t *testing.T) {
+// stepsBlock is the progress list of a page: from its opening tag to its closing one.
+func stepsBlock(t *testing.T, html string) string {
+	t.Helper()
+	start := strings.Index(html, `<ol class="steps"`)
+	require.GreaterOrEqual(t, start, 0, "no progress list in:\n%s", html)
+	end := strings.Index(html[start:], "</ol>")
+	require.GreaterOrEqual(t, end, 0)
+	return html[start : start+end+len("</ol>")]
+}
+
+func TestUploadProgress_TheFullPageCarriesTheVerySameProgressListAsTheFragment(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	fixedClock(app)
 	id := seedUpload(t, userID, "m", "transcribing", "")
 	seedProgress(t, id, twoEngineRun(), progressNow.Add(-10*time.Second), progressNow.Add(-4*time.Second))
 
-	rec := do(t, app, get("/uploads/"+id))
+	full := body(t, do(t, app, get("/uploads/"+id)))
+	fragment := statusBody(t, app, id)
 
-	require.Equal(t, 200, rec.Code)
-	b := body(t, rec)
-	assert.Contains(t, b, "Transcribing with iguana/kb-whisper", "the page a user opens, not only the polled fragment, shows the phases")
-	assert.Contains(t, b, "3m 12s")
+	assert.Equal(t, stepsBlock(t, fragment), stepsBlock(t, full),
+		"the page a user opens and the fragment HTMX swaps in must show the same list, or the display jumps on the first poll")
+}
+
+func TestUploadProgress_AStepNoteIsShownDirectlyUnderItsStepAndEscaped(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	fixedClock(app)
+	id := seedUpload(t, userID, "m", "transcribing", "")
+	steps := twoEngineRun()
+	steps[1].Note = "The audio is 20 min long; the file claimed 1 h 19 min. <b>cut off</b>?"
+	seedProgress(t, id, steps, progressNow.Add(-10*time.Second), progressNow.Add(-4*time.Second))
+
+	b := statusBody(t, app, id)
+
+	audio := strings.Index(b, "Preparing the audio")
+	note := strings.Index(b, "The audio is 20 min long")
+	next := strings.Index(b, "Transcribing with iguana/pianissimo")
+	require.True(t, audio >= 0 && note > audio && next > note, "the note must sit between its own step and the next one:\n%s", b)
+	assert.Contains(t, b, "step-note")
+	assert.NotContains(t, b, "<b>cut off</b>", "a note is words, never markup")
+}
+
+func TestUploadProgress_ADonePageShowsItsRecordOpenWhenAStepHasANote(t *testing.T) {
+	// A truncated recording must not look like a clean one: the note that replaced the
+	// refusal is the only warning, so it cannot sit inside a collapsed list (third review).
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	fixedClock(app)
+	noted := seedUpload(t, userID, "noted", "done", "Synthetic transcript text.")
+	steps := []domain.ProgressStep{step("audio", "Preparing the audio", domain.StepDone, 20*time.Minute, 40*time.Second, 0, 0)}
+	steps[0].Note = "The audio is 20 min long; the file claimed 1 h 19 min."
+	seedProgress(t, noted, steps, progressNow.Add(-time.Minute), progressNow.Add(-time.Minute))
+	clean := seedUpload(t, userID, "clean", "done", "Synthetic transcript text.")
+	seedProgress(t, clean, []domain.ProgressStep{step("audio", "Preparing the audio", domain.StepDone, 20*time.Minute, 40*time.Second, 0, 0)}, progressNow.Add(-time.Minute), progressNow.Add(-time.Minute))
+
+	assert.Contains(t, statusBody(t, app, noted), `<details class="what-was-done" open>`)
+	assert.NotContains(t, statusBody(t, app, clean), `<details class="what-was-done" open>`, "a clean record stays collapsed")
 }

internal/web/uploads_shots_test.go

@@ -47,6 +47,9 @@ func TestRenderUploadProgressStatesForReview(t *testing.T) {
 		step("save", "Saving the transcript", domain.StepDone, time.Minute, time.Second, 0, 0),
 	}
 
+	noted := twoEngineRun()
+	noted[1].Note = "The audio is 20 min long; the file claimed 1 h 19 min. If the recording was cut off, upload the complete one."
+
 	cases := []struct {
 		name, status, content string
 		steps                 []domain.ProgressStep
@@ -58,6 +61,7 @@ func TestRenderUploadProgressStatesForReview(t *testing.T) {
 		{"lost", "transcribing", "", twoEngineRun(), 3 * time.Minute, 3 * time.Minute},
 		{"failed", "failed", "transcription_failed", failed, 2 * time.Minute, 2 * time.Minute},
 		{"done", "done", "Synthetic transcript text for the review.", done, time.Minute, time.Minute},
+		{"noted", "transcribing", "", noted, 10 * time.Second, 4 * time.Second},
 		{"queued", "queued", "", nil, 0, 0},
 	}
 	for _, c := range cases {

internal/web/uploads_spots_handler_test.go

@@ -62,11 +62,11 @@ func TestUploadStatus_ASpotShowsTheWordsJustBeforeIt(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript.")
 	setReconciliation(t, id, `{"status":"reconciled","base":"a","alt":"b","reconciler":"c","disputes":1,"changed":1,
-	  "contested":[{"seconds":2640,"base":"special","alt":"CAMT","used":"alt","unsure":false,"before":"vi skickar in ett"}]}`)
+	  "contested":[{"seconds":2640,"base":"vanligt","alt":"KORT","used":"alt","unsure":false,"before":"grannen målar ett"}]}`)
 
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 
-	assert.Contains(t, b, "vi skickar in ett", "the words before the spot are how a reader finds it in the audio")
-	assert.Contains(t, b, "special")
-	assert.Contains(t, b, "CAMT")
+	assert.Contains(t, b, "grannen målar ett", "the words before the spot are how a reader finds it in the audio")
+	assert.Contains(t, b, "vanligt")
+	assert.Contains(t, b, "KORT")
 }

internal/web/uploads_templ.go

@@ -312,7 +312,17 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 				return templ_7745c5c3_Err
 			}
 			if len(u.Progress) > 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<details class=\"what-was-done\"><summary>What was done</summary>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<details class=\"what-was-done\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if hasNote(u.Progress) {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, " open")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "><summary>What was done</summary>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -320,13 +330,13 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</details> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</details> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			if chatEnabled {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<p><a class=\"btn\" href=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<p><a class=\"btn\" href=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -339,12 +349,12 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\">Ask about this recording</a></p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\">Ask about this recording</a></p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<details open><summary>Transcript</summary><pre class=\"transcript\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<details open><summary>Transcript</summary><pre class=\"transcript\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -357,12 +367,12 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</pre></details></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</pre></details></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		case domain.UploadFailed:
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<div class=\"upload-status upload-failed flash flash-error\" role=\"alert\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<div class=\"upload-status upload-failed flash flash-error\" role=\"alert\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -370,7 +380,7 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -383,12 +393,12 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if len(u.Progress) > 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<details class=\"what-was-done\" open><summary>Where it stopped</summary>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<details class=\"what-was-done\" open><summary>Where it stopped</summary>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -396,17 +406,17 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</details>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</details>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		default:
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<div class=\"upload-status upload-working\" role=\"status\" hx-get=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<div class=\"upload-status upload-working\" role=\"status\" hx-get=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -419,7 +429,7 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" hx-trigger=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\" hx-trigger=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -432,7 +442,7 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\" hx-swap=\"outerHTML\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" hx-swap=\"outerHTML\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -447,7 +457,7 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, " ")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, " ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -456,18 +466,18 @@ func uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<p>Transcribing… a long recording takes a few minutes.</p>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<p>Transcribing… a long recording takes a few minutes.</p>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<p>Queued — waiting for its turn to be transcribed.</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<p>Queued — waiting for its turn to be transcribed.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -511,7 +521,7 @@ func UploadChatPage(u domain.UploadedTranscript, v chatView) templ.Component {
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<article class=\"account\"><h1>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<article class=\"account\"><h1>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -524,7 +534,7 @@ func UploadChatPage(u domain.UploadedTranscript, v chatView) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</h1><section id=\"chat-section\" class=\"chat-dock chat-dock-open\"><h2 class=\"chat-heading\">Ask about this recording</h2><p class=\"chat-scope muted\">Answers come only from this recording's transcript, which is private to you.</p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "</h1><section id=\"chat-section\" class=\"chat-dock chat-dock-open\"><h2 class=\"chat-heading\">Ask about this recording</h2><p class=\"chat-scope muted\">Answers come only from this recording's transcript, which is private to you.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -532,7 +542,7 @@ func UploadChatPage(u domain.UploadedTranscript, v chatView) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "</section><p><a href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</section><p><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -545,7 +555,7 @@ func UploadChatPage(u domain.UploadedTranscript, v chatView) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\">Back to the transcript</a></p></article>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\">Back to the transcript</a></p></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -585,7 +595,7 @@ func videoNotice(hadVideo bool) templ.Component {
 		}
 		ctx = templ.ClearChildren(ctx)
 		if hadVideo {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<p class=\"muted video-notice\">This file contained a video track. Only its audio was used; the video was discarded and nothing from it was kept.</p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<p class=\"muted video-notice\">This file contained a video track. Only its audio was used; the video was discarded and nothing from it was kept.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -622,7 +632,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 		if r != nil {
 			switch r.Status {
 			case domain.ReconcileDone:
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<div class=\"reconciliation\"><p>Reconciled from two transcripts (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<div class=\"reconciliation\"><p>Reconciled from two transcripts (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -635,7 +645,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, " and ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, " and ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -648,7 +658,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "): ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "): ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -661,7 +671,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, " differences, ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, " differences, ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -674,7 +684,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, " settled automatically, ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, " settled automatically, ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -687,7 +697,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, " decided by the model (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, " decided by the model (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -700,7 +710,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "), ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "), ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -713,17 +723,17 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, " uncertain.</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, " uncertain.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if len(shownSpots(r)) > 0 {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "<details><summary>Spots to check against the audio</summary><ul>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "<details><summary>Spots to check against the audio</summary><ul>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					for _, c := range shownSpots(r) {
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<li>")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<li>")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
@@ -736,12 +746,12 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, ": ")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, ": ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 						if c.Before != "" {
-							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<span class=\"muted\">…")
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "<span class=\"muted\">…")
 							if templ_7745c5c3_Err != nil {
 								return templ_7745c5c3_Err
 							}
@@ -754,7 +764,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 							if templ_7745c5c3_Err != nil {
 								return templ_7745c5c3_Err
 							}
-							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</span> ")
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</span> ")
 							if templ_7745c5c3_Err != nil {
 								return templ_7745c5c3_Err
 							}
@@ -768,7 +778,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, " / ")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, " / ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
@@ -781,12 +791,12 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, " — ")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, " — ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 						if c.Unsure {
-							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "<span class=\"chip chip-warn\">uncertain</span> kept ")
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "<span class=\"chip chip-warn\">uncertain</span> kept ")
 							if templ_7745c5c3_Err != nil {
 								return templ_7745c5c3_Err
 							}
@@ -800,7 +810,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 								return templ_7745c5c3_Err
 							}
 						} else {
-							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<span class=\"chip\">changed</span> used ")
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<span class=\"chip\">changed</span> used ")
 							if templ_7745c5c3_Err != nil {
 								return templ_7745c5c3_Err
 							}
@@ -814,17 +824,17 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 								return templ_7745c5c3_Err
 							}
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</li>")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</li>")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</ul>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "</ul>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					if moreSpots(r) > 0 {
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<p class=\"muted\">and ")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<p class=\"muted\">and ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
@@ -837,22 +847,22 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, " more not listed</p>")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, " more not listed</p>")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</details>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "</details>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "</div>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "</div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			case domain.ReconcileSingle:
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "<p class=\"muted reconciliation\">Only one engine produced this transcript (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<p class=\"muted reconciliation\">Only one engine produced this transcript (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -865,12 +875,12 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "), so there was no second opinion to reconcile it with.</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "), so there was no second opinion to reconcile it with.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			case domain.ReconcileSkipped:
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<p class=\"muted reconciliation\">Two transcripts were made but could not be reconciled (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<p class=\"muted reconciliation\">Two transcripts were made but could not be reconciled (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -883,7 +893,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "); the text shown is ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "); the text shown is ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -896,7 +906,7 @@ func reconciliationNote(r *domain.Reconciliation) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "'s, unreconciled.</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "'s, unreconciled.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -932,7 +942,7 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 			templ_7745c5c3_Var43 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<ol class=\"steps\" aria-label=\"Progress\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "<ol class=\"steps\" aria-label=\"Progress\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -942,7 +952,7 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "<li class=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "<li class=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -955,32 +965,32 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if s.State == domain.StepRunning {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, " aria-current=\"step\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, " aria-current=\"step\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, ">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, ">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if s.State == domain.StepRunning && live {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "<span class=\"step-mark\" aria-hidden=\"true\"><span class=\"spinner\"></span></span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "<span class=\"step-mark\" aria-hidden=\"true\"><span class=\"spinner\"></span></span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else if s.State == domain.StepRunning {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, "<span class=\"step-mark step-mark-warn\" aria-hidden=\"true\">!</span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "<span class=\"step-mark step-mark-warn\" aria-hidden=\"true\">!</span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "<span class=\"step-mark\" aria-hidden=\"true\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "<span class=\"step-mark\" aria-hidden=\"true\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -993,12 +1003,12 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "</span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "</span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "<span class=\"step-label\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "<span class=\"step-label\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -1011,12 +1021,12 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "</span> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "</span> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if t := stepTime(s, now); t != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "<span class=\"step-time\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<span class=\"step-time\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -1029,75 +1039,94 @@ func progressSteps(steps []domain.ProgressStep, now time.Time, live bool) templ.
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "</span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</span> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			if s.Note != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "<span class=\"step-note\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var49 string
+				templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(s.Note)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 222, Col: 37}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "</span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			if s.State == domain.StepRunning && s.Total > 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<progress class=\"step-bar\" value=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var49 string
-				templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.ResolveAttributeValue(strconv.Itoa(s.Done))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 222, Col: 60}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var49)
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "\" max=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<progress class=\"step-bar\" value=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var50 string
-				templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.ResolveAttributeValue(strconv.Itoa(s.Total))
+				templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.ResolveAttributeValue(strconv.Itoa(s.Done))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 222, Col: 90}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 225, Col: 60}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var50)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "\"></progress> <span class=\"step-count\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\" max=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var51 string
-				templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(strconv.Itoa(s.Done))
+				templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.ResolveAttributeValue(strconv.Itoa(s.Total))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 223, Col: 52}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 225, Col: 90}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var51)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, " of ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\"></progress> <span class=\"step-count\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var52 string
-				templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(strconv.Itoa(s.Total))
+				templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(strconv.Itoa(s.Done))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 223, Col: 81}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 226, Col: 52}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var52))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, " of ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var53 string
+				templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(strconv.Itoa(s.Total))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 226, Col: 81}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "</li>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "</li>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "</ol>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "</ol>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1123,45 +1152,45 @@ func healthNote(h jobHealth, silent time.Duration) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var53 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var53 == nil {
-			templ_7745c5c3_Var53 = templ.NopComponent
+		templ_7745c5c3_Var54 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var54 == nil {
+			templ_7745c5c3_Var54 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		switch h {
 		case healthLost:
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "<p class=\"step-health step-health-lost\" role=\"alert\">The service stopped reporting ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var54 string
-			templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.JoinStringErrs(minutesAgo(silent))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 236, Col: 54}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var54))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, " ago. It may have restarted or crashed. This page keeps checking; if nothing changes, upload the recording again.</p>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		case healthQuiet:
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<p class=\"step-health step-health-quiet\">Nothing new for ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "<p class=\"step-health step-health-lost\" role=\"alert\">The service stopped reporting ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var55 string
 			templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.JoinStringErrs(minutesAgo(silent))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 241, Col: 40}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 239, Col: 54}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var55))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, ": the model may be slow. The service is still running, and the job gives up on its own if it takes too long.</p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, " ago. It may have restarted or crashed. This page keeps checking; if nothing changes, upload the recording again.</p>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		case healthQuiet:
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<p class=\"step-health step-health-quiet\">Nothing new for ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var56 string
+			templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.JoinStringErrs(minutesAgo(silent))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 244, Col: 40}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var56))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 100, ": the model may be slow. The service is still running, and the job gives up on its own if it takes too long.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}

internal/web/view.go

@@ -780,6 +780,7 @@ a.btn, a.btn:visited { color: var(--accent-fg); }
 .step-skipped { opacity: .7; }
 .step-pending { opacity: .75; }
 .step-bar { flex: none; width: calc(100% - 1.6rem); margin: 0 0 0 1.6rem; height: .5rem; accent-color: var(--accent); }
+.step-note { flex: none; width: calc(100% - 1.6rem); margin-left: 1.6rem; font-weight: 400; color: var(--muted); font-family: system-ui, -apple-system, sans-serif; font-size: .82rem; }
 .step-count { flex: none; width: calc(100% - 1.6rem); margin-left: 1.6rem; font-weight: 400; color: var(--muted); }
 .step-running .step-mark-warn { color: var(--err-fg); }
 .spinner { display: inline-block; vertical-align: -.1em; width: .8rem; height: .8rem; box-sizing: border-box; border: 2px solid var(--line); border-top-color: var(--accent); border-radius: 50%; animation: tapir-spin 1s linear infinite; }

test/acceptance/scenario_coverage_test.go

@@ -135,17 +135,26 @@ var scenarioCoverage = map[string]string{
 	"A single-engine transcript claims no second opinion":                     "TestUploadStatus_ASingleEngineTranscriptDoesNotClaimASecondOpinion",
 
 	// audio_upload.feature, ADR-035
-	"I can see which phase my upload is in":                             "TestUploadProgress_ARunningJobShowsEveryPhaseInOrderWithTheRunningOneMarked",
-	"A bar appears only where the count is real":                        "TestUploadProgress_OnlyACountedPhaseGetsABarAndItShowsRealCounts",
-	"A slow engine call is not mistaken for a dead service":             "TestUploadProgress_ALongEngineCallWithAFreshHeartbeatIsStillJustRunning",
-	"A service that stopped reporting is called lost":                   "TestUploadProgress_AHeartbeatThatStoppedMeansTheServiceIsLostAndTheJobIsNotCalledRunning",
-	"A model that stops advancing is called quiet":                      "TestUploadProgress_ACountedPhaseThatStopsAdvancingGoesQuietNotLost",
-	"A failed job shows where it stopped":                               "TestUploadProgress_AFailedJobShowsWhichPhaseFailedAndWhatNeverStarted",
-	"A finished job keeps its record of what was done":                  "TestUploadProgress_ADoneJobKeepsItsRecordOfWhatWasDoneAndHowLongEachTook",
-	"The heartbeat runs on its own while an engine call is stuck":       "TestWorkerProgress_TheHeartbeatBeatsWhileAnEngineCallIsStuckAndStopsWhenTheJobEnds",
-	"The log names every phase and never the transcript":                "TestWorkerProgress_TheLogNamesEveryPhaseInOrderAndNeverTheTranscriptOrThePath",
-	"Every judged spot is stored but only the ones to check are listed": "TestUploadStatus_OnlyChangedAndUncertainSpotsAreListedNotTheKeptOnes",
-	"The saved segments carry the merged words":                         "TestReconcileSegments_AChangedWordReplacesTheBaseWordInItsOwnSegmentOnly",
+	"I can see which phase my upload is in":                                   "TestUploadProgress_ARunningJobShowsEveryPhaseInOrderWithTheRunningOneMarked",
+	"A bar appears only where the count is real":                              "TestUploadProgress_OnlyACountedPhaseGetsABarAndItShowsRealCounts",
+	"A slow engine call is not mistaken for a dead service":                   "TestUploadProgress_ALongEngineCallWithAFreshHeartbeatIsStillJustRunning",
+	"A service that stopped reporting is called lost":                         "TestUploadProgress_AHeartbeatThatStoppedMeansTheServiceIsLostAndTheJobIsNotCalledRunning",
+	"A model that stops advancing is called quiet":                            "TestUploadProgress_ACountedPhaseThatStopsAdvancingGoesQuietNotLost",
+	"A failed job shows where it stopped":                                     "TestUploadProgress_AFailedJobShowsWhichPhaseFailedAndWhatNeverStarted",
+	"A finished job keeps its record of what was done":                        "TestUploadProgress_ADoneJobKeepsItsRecordOfWhatWasDoneAndHowLongEachTook",
+	"The heartbeat runs on its own while an engine call is stuck":             "TestWorkerProgress_TheHeartbeatBeatsWhileAnEngineCallIsStuckAndStopsWhenTheJobEnds",
+	"The log names every phase and never the transcript":                      "TestWorkerProgress_OnASuccessfulJobTheLogNamesEveryPhaseInOrderAndNeverTheTranscriptOrThePath",
+	"Every judged spot is stored but only the ones to check are listed":       "TestUploadStatus_OnlyChangedAndUncertainSpotsAreListedNotTheKeptOnes",
+	"Chat about a recording is offered with local models only":                "TestUploadChatPage_DoesNotOfferACloudModelEvenThoughTheServiceKnowsOne",
+	"A forged cloud model is never sent the transcript":                       "TestUploadChatPost_AForgedCloudModelIsReplacedByALocalOneBeforeTheTranscriptIsSent",
+	"A wedged engine does not use up the whole job":                           "TestChain_AHungPrimaryReachesTheFallbackWhenItHasItsOwnDeadline",
+	"A file that lies about its length is refused":                            "TestWorkerDuration_AConvertedLengthOverTheLimitFailsTheJobBeforeAnyEngineSeesIt",
+	"A recording much shorter than its file claimed is transcribed and noted": "TestWorkerDuration_AFileThatEndsFarEarlierThanItClaimedIsStillTranscribedAndSaysSo",
+	"A full queue is a retry, not an error":                                   "TestAccept_AFullQueueIsABusyRejectionNotAServerErrorAndLeavesNothingBehind",
+	"One user cannot fill the queue for everyone":                             "TestWorkerSubmit_OneUserCannotFillTheQueueForEveryoneElse",
+	"Errors are shown as kinds, never their text":                             "TestReconcile_TheBreakerReasonCarriesAKindNotTheModelsText",
+	"Input that cannot be right is a client error":                            "TestUploadRoutes_ANonUUIDIdIs404NotA500",
+	"The saved segments carry the merged words":                               "TestReconcileSegments_AChangedWordReplacesTheBaseWordInItsOwnSegmentOnly",
 
 	// summarize_new_video.feature
 	"A subscribed channel posts a video that has captions":         "TestSubscribedVideoWithCaptionsIsSummarizedAndDelivered",