Merge pull request 'v0.32.0: per-recording delete and nav link, cloud-served note, tracker hardening, bounded LLM reads (#37 #51 #52 #53)' (#58) from sprint/v032 into main

Skipping 'by', 'reconciled' and '+' as words everywhere let an alias with one of those
names pass as local. The two-engine shape is now split on its own separators and each alias
judged whole; a reconciler that is not local is pinned too. Hardening suggested by the third
PR #58 review.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/uploads.go

@@ -275,24 +275,25 @@ func titleFromFilename(name string) string {
 // definition the start-up validation uses, not a second string match here (#52).
 //
 // The endpoint is one alias, except for the two-engine path (ADR-034), which writes
-// "<base> + <alt>, reconciled by <model>". Every alias in it is judged on its own, so a
+// "<base> + <alt>, reconciled by <model>" (ensemble.go). That shape is taken apart exactly
-// composite of local models is local and one naming a cloud alias names that provider.
+// and each alias is judged whole, so a composite of local models is local, and anything
+// else (a cloud alias, one with no provider prefix, one with a space or a connector word in
+// it) is not. A string that is not that shape is one alias.
 func cloudProvider(endpoint string) (string, bool) {
-	if strings.TrimSpace(endpoint) == "" {
+	endpoint = strings.TrimSpace(endpoint)
+	if endpoint == "" {
 		return "", false
 	}
-	aliases := []string{}
+	aliases := []string{endpoint}
-	for _, tok := range strings.Fields(endpoint) {
+	if engines, reconciler, ok := strings.Cut(endpoint, ", reconciled by "); ok {
-		if tok = strings.Trim(tok, ","); strings.Contains(tok, "/") {
+		aliases = append(strings.Split(engines, " + "), reconciler)
-			aliases = append(aliases, tok)
-		}
-	}
-	if len(aliases) == 0 {
-		aliases = append(aliases, strings.TrimSpace(endpoint))
 	}
 	for _, a := range aliases {
-		if !config.IsLocalModel(a) {
+		if a = strings.TrimSpace(a); !config.IsLocalModel(a) {
 			provider, _, _ := strings.Cut(a, "/")
+			if provider = strings.TrimSpace(provider); provider == "" {
+				provider = a
+			}
 			return provider, true
 		}
 	}

internal/web/uploads_cloud_note_test.go

@@ -82,3 +82,59 @@ func TestUploadStatus_AReconciledEndpointNamingACloudEngineStillNamesTheCloudPro
 
 	assert.Contains(t, b, "cloud service (berget)")
 }
+
+// An alias without a provider prefix is not a local model, wherever it sits in the
+// composite: it must never be dropped from the judgement (PR #58 re-review).
+func TestUploadStatus_AReconciledEndpointWithAnUnprefixedAliasIsNotCalledLocal(t *testing.T) {
+	for _, endpoint := range []string{
+		"iguana/kb-whisper + whisper-1, reconciled by iguana/gemma4-26b",
+		"iguana/kb-whisper + whisper 1, reconciled by iguana/gemma4-26b",
+		"iguana/kb-whisper + berget / x, reconciled by iguana/gemma4-26b",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			app, _ := newUploadApp(t, audioOK, 200<<20)
+			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
+			setEndpoint(t, id, endpoint)
+
+			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
+
+			assert.Contains(t, b, "left the homelab")
+			assert.NotContains(t, b, "cloud service ()", "the note names a provider")
+		})
+	}
+}
+
+// "by", "reconciled" and "+" are connectors only inside the composite format. As a whole
+// endpoint, or as an alias within the composite, they are model names and are judged.
+func TestUploadStatus_AConnectorWordUsedAsAModelNameIsStillJudged(t *testing.T) {
+	for _, endpoint := range []string{
+		"by",
+		"reconciled",
+		"+",
+		"iguana/kb-whisper + by, reconciled by iguana/gemma4-26b",
+		"iguana/kb-whisper + reconciled, reconciled by iguana/gemma4-26b",
+		"iguana/kb-whisper + +, reconciled by iguana/gemma4-26b",
+		"/x", // no provider at all: the note must still name something
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			app, _ := newUploadApp(t, audioOK, 200<<20)
+			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
+			setEndpoint(t, id, endpoint)
+
+			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
+
+			assert.Contains(t, b, "left the homelab")
+			assert.NotContains(t, b, "cloud service ()")
+		})
+	}
+}
+
+func TestUploadStatus_AReconcilerThatIsNotLocalNamesTheCloudProvider(t *testing.T) {
+	app, _ := newUploadApp(t, audioOK, 200<<20)
+	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
+	setEndpoint(t, id, "iguana/kb-whisper + koala/whisper, reconciled by berget/mistral-large")
+
+	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
+
+	assert.Contains(t, b, "cloud service (berget)")
+}