test(web): the 499 test cancels the client mid-Accept, as a real hang-up does

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
fix(web): the title-part hang-up is handled like the rest, and an abandoned request is answered 499, not an implicit 200 (fourth review)
2026-10-02 17:47:13 +02:00 · 2026-10-02 17:47:13 +02:00 · 2026-10-02 17:47:13 +02:00 · 2026-10-02 17:47:13 +02:00 · 2026-10-02 17:46:07 +02:00 · 2026-10-02 17:46:07 +02:00
61 changed files with 870 additions and 3679 deletions
@@ -1434,12 +1434,7 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
     empty disables), recorded per row, and called out in Open items rather than defaulted
     silently.
   - Swedish only (`language=sv`). Language detection and routing (#28 decision 2) are not
-     touched. **Amended 2026-10-04 (#61, interim):** the language is now a per-upload choice on
+     touched.
     the form, `sv` (preselected, and what an upload that names none gets) or `auto` ("Other":
     `language` is omitted so the engine detects it), a closed set held by the form, the request
     code and a CHECK constraint on `uploaded_transcripts.language` (migration 021). Automatic
     detection and a general-purpose engine for other languages are still not built (#61); an
     `auto` upload goes to the same configured engine, which is not tuned for it.
   - `-H 'Expect:'`, multipart field `file` — encoded in the adapter and its tests, not rediscovered.
 7. **Jobs run in-process, one at a time (ADR-018 stands).** Transcription is minutes (~7.5 min
@@ -1452,25 +1447,6 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
   re-uploads. The single-replica assumption gains a second dependent (the semaphore is
   process-local) and is recorded here.
   *Amended 2026-10-03 (#50, #47).* The process now handles SIGTERM (what Kubernetes sends on
   every deploy; only SIGINT was handled, so shutdown code never ran). On shutdown the running job
   is recorded `interrupted` at once and the process waits, bounded to 10 s each, for in-flight
   requests and for that write; the start-up sweep stays the backstop for a kill. **Known
   limitation, deliberately not built: a deploy still loses a job in flight** (finishing it needs
   a drain of up to the job time, a ~330 s termination grace and `strategy: Recreate`, i.e.
   downtime on every deploy; a 90-minute file takes ~4.5 min and a deploy lands on a running job
   perhaps one time in five at current volume). Jobs still queued at shutdown stay `queued` until
   the next start's sweep. The user re-uploads, with an honest message.
   *Receive limits (#47).* Request bodies are received at most 4 at a time, 2 per user, answered
   as busy beyond that. Together with the 20-job queue and the running job that bounds the spool
   at about (4 + 20 + 1) x 200 MiB = 5 GiB of the 6 Gi `emptyDir` (infra): raising any of those or
   `TAPIR_UPLOAD_MAX_BYTES` must revisit that sum (pinned by `TestNewIntake_Defaults...`, not
   enforced against infra). **A slow-drip body holds its slot without a time bound**: the server
   sets `ReadHeaderTimeout` only, because a `ReadTimeout` would cut legitimate 200 MiB uploads on
   slow links; two slow bodies take a user's two slots and two such users make everyone's upload
   busy. It needs a valid session; recorded as a limitation with a follow-up issue.
 8. **Chat reuses `chat.Service`; it is not forked.** The uploaded-transcript chat handlers
   look the row up through the RLS-scoped store, so a non-owner gets 404 by the same mechanism
   as ADR-027's summary gate, **before any model is called**. ADR-027's decisions (ephemeral,
@@ -1555,15 +1531,9 @@ deferred. The scope cut — chat first, no rich analysis, no video — is what k
  #33 specifies, with the serving endpoint shown **(recommended, matches the issue)**; (B)
  disabled by default, a failed iguana job fails honestly and the user retries. *Blocks:*
  the production default only; the adapter ships either way.
- ~~Verify Tapir's ingress `proxy-body-size` against the 200 MB cap (`infra`).~~ **Resolved 2026-10-03:** real unauthenticated bodies of 2, 30, 120 and 210 MiB all pass NPM (TLS, piguard) and Traefik to tapir (a 302 to login); there is no body limit in that range. Uploads were enabled in production the same day, local engines only (infra#520).
+- Verify Tapir's ingress `proxy-body-size` against the 200 MB cap (`infra`).
- ~~Per-transcript deletion is not built; account deletion cascades.~~ **Built 2026-10-03
+- Per-transcript deletion is not built; account deletion cascades. A private-content store
-  (#37):** `POST /uploads/{id}/delete`, owner-scoped (a non-owner gets 404 by the same RLS
+  without a delete button is a gap worth a ticket, not a silent omission.
  mechanism), confirm-then-delete on the recording's page. A recording that is **queued or
  transcribing is refused (409) until it ends**, because the worker would otherwise write to a
  row that is gone; a job whose service was lost stays undeletable until the next start's sweep
  marks it failed. The refusal reflects the row's state when the delete was attempted: a
  recording that finishes in the same instant still gets a 409 once, and a retry deletes it.
  The home list now links to `/uploads` when uploads are mounted.
 **Reversibility.** Additive: one table (down-migration drops it), one adapter, one upload
 surface, one image change. Removing the upload route removes the feature; `transcripts`, `videos`
@@ -1650,10 +1620,6 @@ on the slow numbers and is reopened: 31B scored 97% against 92%.
   job timeout rises from 30 to 60 minutes: ~4 min of kb-whisper and ~40 s of pianissimo per hour of
   audio, plus the adjudication.
   **Amended 2026-10-04 (#61, interim):** reconcile is for Swedish. A recording whose language is
   `auto` is never sent to the base engine (it is Swedish-only) and is not reconciled: the other
   engine transcribes alone, then the cloud fallback if that fails and the job is live, and the
   page does not claim a second opinion.
 8. **Not decided here.** A cloud adjudicator (rejected: private content); tuning the prompt; making
   `gemma4-31b` the default; a "reconciling" progress state (the page says "transcribing" for the whole
   job); feeding the uncertain spots to chat; whether pianissimo should also be a middle tier in the
@@ -34,7 +34,7 @@ tasks:
  lint:
    desc: golangci-lint (installed by CI; skipped locally if absent).
    cmds:
-      - 'if command -v golangci-lint >/dev/null 2>&1; then golangci-lint run ./...; else echo "golangci-lint not installed — skipping (CI installs it)"; fi'
+      - 'command -v golangci-lint >/dev/null 2>&1 && golangci-lint run ./... || echo "golangci-lint not installed — skipping (CI installs it)"'
  test:
    desc: Run all tests. -p 1 serializes packages so the embedded-postgres tests
@@ -17,9 +17,9 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
 	"os"
 	"os/signal"
 	"sync"
 	"time"
@@ -41,7 +41,7 @@ func main() {
 	}
 	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	ctx, stop := shutdownContext(context.Background())
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
 	defer stop()
 	var err error
@@ -215,11 +215,9 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 	if err != nil {
 		return err
 	}
 	var workerDone chan struct{} // nil without uploads: nothing to wait for at shutdown
 	wireUploads(app, cfg, intake)
 	if intake != nil {
-		workerDone = make(chan struct{})
+		go worker.Run(ctx)
 		go func() { worker.Run(ctx); close(workerDone) }()
 		log.Info("audio upload enabled", "model", cfg.TranscribeModel, "fallback", cfg.TranscribeFallbackModel,
 			"max_mb", cfg.UploadMaxBytes>>20, "max_minutes", int(cfg.UploadMaxDuration.Minutes()))
 		log.Warn("audio upload assumes a SINGLE replica: the transcription queue is process-local (ADR-033, ADR-018)")
@@ -352,19 +350,20 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 		}()
 	}
-	// Graceful shutdown on signal: stop accepting, drain in-flight requests, and let the
+	// Graceful shutdown on signal: stop accepting, drain in-flight requests.
-	// worker record the job it was running as interrupted (#50).
+	go func() {
-	var extra []*http.Server
+		<-ctx.Done()
-	if metricsSrv != nil {
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		extra = append(extra, metricsSrv)
+		defer cancel()
-	}
+		_ = srv.Shutdown(shutdownCtx)
-	ln, err := net.Listen("tcp", srv.Addr)
+		if metricsSrv != nil {
-	if err != nil {
+			_ = metricsSrv.Shutdown(shutdownCtx)
-		return fmt.Errorf("serve: listen: %w", err)
+		}
-	}
+	}()
 	log.Info("serving web ui", "addr", cfg.HTTPAddr, "user", cfg.UserID)
-	if err := serveHTTP(ctx, srv, ln, extra, workerDone, shutdownGrace); err != nil {
+	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return err
+		return fmt.Errorf("serve: %w", err)
 	}
 	return nil
 }
@@ -1,55 +0,0 @@
 package main
 import (
 	"context"
 	"errors"
 	"fmt"
 	"net"
 	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
 )
 // shutdownGrace bounds each wait at shutdown (in-flight requests, then the worker). Two of
 // them stay inside Kubernetes' default 30 s termination grace.
 const shutdownGrace = 10 * time.Second
 // shutdownContext is cancelled by SIGINT (a terminal) or SIGTERM (what Kubernetes sends
 // on every deploy). Handling only SIGINT meant a deploy killed the process before any
 // shutdown code ran (#50).
 func shutdownContext(parent context.Context) (context.Context, context.CancelFunc) {
 	return signal.NotifyContext(parent, os.Interrupt, syscall.SIGTERM)
 }
 // serveHTTP serves srv on ln until it fails or ctx ends, then shuts every server down and
 // waits for in-flight requests and for workerDone (nil: no worker) to finish, each for at
 // most grace. It must not return earlier: Serve returns http.ErrServerClosed as soon as
 // Shutdown STARTS, and returning from main kills the drain and the worker's last write.
 func serveHTTP(ctx context.Context, srv *http.Server, ln net.Listener, extra []*http.Server, workerDone <-chan struct{}, grace time.Duration) error {
 	errc := make(chan error, 1)
 	go func() { errc <- srv.Serve(ln) }()
 	select {
 	case err := <-errc:
 		if !errors.Is(err, http.ErrServerClosed) {
 			return fmt.Errorf("serve: %w", err)
 		}
 		return nil
 	case <-ctx.Done():
 	}
 	shutdownCtx, cancel := context.WithTimeout(context.Background(), grace)
 	defer cancel()
 	for _, s := range append([]*http.Server{srv}, extra...) {
 		_ = s.Shutdown(shutdownCtx)
 	}
 	if workerDone != nil {
 		select {
 		case <-workerDone:
 		case <-time.After(grace):
 		}
 	}
 	return nil
 }
@@ -1,124 +0,0 @@
 package main
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"sync"
 	"syscall"
 	"testing"
 	"time"
 )
 // Kubernetes stops a pod with SIGTERM; only SIGINT was handled, so a deploy killed the
 // process without running any shutdown code (#50).
 func TestShutdownContext_IsCancelledBySIGTERMAndSIGINT(t *testing.T) {
 	for _, sig := range []syscall.Signal{syscall.SIGTERM, syscall.SIGINT} {
 		t.Run(sig.String(), func(t *testing.T) {
 			ctx, stop := shutdownContext(context.Background())
 			defer stop()
 			if err := syscall.Kill(os.Getpid(), sig); err != nil {
 				t.Fatalf("send %v: %v", sig, err)
 			}
 			select {
 			case <-ctx.Done():
 			case <-time.After(2 * time.Second):
 				t.Fatalf("context not cancelled by %v", sig)
 			}
 		})
 	}
 }
 // serveHTTP must not return while a request is in flight or the worker is still recording
 // its job: Serve returns http.ErrServerClosed as soon as Shutdown STARTS, and returning
 // from it let the process exit before either finished (#50). Each half is tested with the
 // other already satisfied, so neither can hold the call open on the other's behalf.
 func pendingFor(t *testing.T, returned <-chan error, why string) {
 	t.Helper()
 	select {
 	case err := <-returned:
 		t.Fatalf("serveHTTP returned (%v) %s", err, why)
 	case <-time.After(150 * time.Millisecond):
 	}
 }
 func TestServeHTTP_DrainsAnInFlightRequestBeforeReturning(t *testing.T) {
 	release := make(chan struct{})
 	entered := make(chan struct{})
 	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		close(entered)
 		<-release
 		_, _ = w.Write([]byte("ok"))
 	}))
 	srv.Start()
 	defer srv.Close()
 	var once sync.Once
 	releaseHandler := func() { once.Do(func() { close(release) }) }
 	defer releaseHandler() // runs before srv.Close: a failing test must not hang on the blocked handler
 	ctx, cancel := context.WithCancel(context.Background())
 	workerDone := make(chan struct{})
 	close(workerDone) // the worker is already done: only the request can hold serveHTTP open
 	returned := make(chan error, 1)
 	go func() { returned <- serveHTTP(ctx, srv.Config, srv.Listener, nil, workerDone, 5*time.Second) }()
 	go func() { _, _ = http.Get(srv.URL) }()
 	<-entered
 	cancel()
 	pendingFor(t, returned, "while a request was still in flight")
 	releaseHandler()
 	select {
 	case err := <-returned:
 		if err != nil {
 			t.Fatalf("serveHTTP: %v", err)
 		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("serveHTTP did not return once the request finished")
 	}
 }
 func TestServeHTTP_WaitsForTheWorkerBeforeReturning(t *testing.T) {
 	srv := httptest.NewUnstartedServer(http.NotFoundHandler())
 	srv.Start()
 	defer srv.Close()
 	ctx, cancel := context.WithCancel(context.Background())
 	workerDone := make(chan struct{})
 	returned := make(chan error, 1)
 	go func() { returned <- serveHTTP(ctx, srv.Config, srv.Listener, nil, workerDone, 5*time.Second) }() // no request in flight
 	cancel()
 	pendingFor(t, returned, "before the worker finished")
 	close(workerDone)
 	select {
 	case err := <-returned:
 		if err != nil {
 			t.Fatalf("serveHTTP: %v", err)
 		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("serveHTTP did not return once the worker finished")
 	}
 }
 func TestServeHTTP_GivesUpOnAWorkerThatNeverFinishesAfterTheGrace(t *testing.T) {
 	srv := httptest.NewUnstartedServer(http.NotFoundHandler())
 	srv.Start()
 	defer srv.Close()
 	ctx, cancel := context.WithCancel(context.Background())
 	returned := make(chan error, 1)
 	go func() {
 		returned <- serveHTTP(ctx, srv.Config, srv.Listener, nil, make(chan struct{}), 200*time.Millisecond)
 	}()
 	cancel()
 	select {
 	case <-returned:
 	case <-time.After(3 * time.Second):
 		t.Fatal("a stuck worker must not hold the process past the grace period")
 	}
 }
@@ -25,7 +25,7 @@ type fakeUploadsStore struct {
 	failedKinds []domain.UploadErrorKind
 }
-func (f *fakeUploadsStore) CreateUpload(context.Context, string, string, domain.Language, bool) (string, error) {
+func (f *fakeUploadsStore) CreateUpload(context.Context, string, string, bool) (string, error) {
 	return "id", nil
 }
@@ -44,7 +44,7 @@ func (f *fakeUploadsStore) SaveProgress(context.Context, string, string, []domai
 	return nil
 }
-func (f *fakeUploadsStore) Heartbeat(context.Context, string, string, time.Time) error { return nil }
+func (f *fakeUploadsStore) Heartbeat(context.Context, string, string) error { return nil }
 func (f *fakeUploadsStore) FailInterruptedUploads(context.Context) (int, error) {
 	f.sweeps++
@@ -14,8 +14,7 @@ it** — endpoints and aliases drift, and this file is a snapshot (2026-06-06),
    not LiteLLM. Use `30401` for off-cluster LiteLLM. `confirm` resolved.
 - **Speech-to-text (ADR-033):** the same gateway serves `POST /v1/audio/transcriptions` for
  `iguana/kb-whisper` (primary, local) and `berget/kb-whisper` (fallback, EU cloud — private audio
-  leaves the homelab if it is used: when the primary fails **or returns an empty transcript**,
+  leaves the homelab if it is used). **Call it via the NodePort / in-cluster address above, NOT
  e.g. a silent or music-only file; the transcript page then says so, #52). **Call it via the NodePort / in-cluster address above, NOT
  `https://llm-api.d-ma.be`:** that public ingress (openresty) returns `413` for bodies over
  roughly 8–10 MB (~5 minutes of 16 kHz WAV), while the NodePort took 174 MB (90 minutes) in one
  request (measured 2026-10-01, `docs/research/audio-length-ceiling-2026-10-01.md`). Send multipart
@@ -1,69 +0,0 @@
 # ADR-034 second blind check: protocol (ready to run; tapir#33, D9, D10)
 This repo is public and the recordings are private, so this file holds the method only. The
 sheet, the key and the filled-in verdicts stay outside the repo, and the trial data is deleted
 after the check. Results go back here as aggregate numbers, as in
 `reconcile-blind-check-2026-10-02.md`.
 ## What the check decides
 ADR-034 (two engines, a local model reconciles their disagreements) is `Proposed` and off in
 production. Two conditions were set for keeping it. The first run answered the first one on one
 reading only and did not answer the second:
 1. **The reconciled reading is right at least 85% of the time.** Open flaw in the bar: it did not
   say how ties count. The first run gave 95% (decided items only) or 70% (all 30), so it was met on
   one reading and missed on the other.
 2. **It is no worse than the better single engine.** Not answered: before ADR-035 the spots the
   model *kept* as the base were not stored, so kb-whisper alone could not be compared.
 ADR-035 now stores every judged spot (`reconciliation.contested`: both readings, which one was
 used, unsure or not, a few words of left context, a time). That makes condition 2 measurable.
 ## Rules to fix BEFORE looking at any result (the owner confirms or changes them)
 | Rule | Proposed |
 |---|---|
 | Who judges | The speaker, hearing the audio where the text cannot settle it (D9). Not Opus: it cannot hear, and its agreement with the speaker was only shown on items picked as decidable. |
 | Sample | 30 spots drawn at random with a fixed seed, from ALL judged spots (changed and kept-base alike), not only the changed ones. Insertions and deletions that cannot be placed are listed separately and not sampled. |
 | Verdict per spot | `x`, `y` (the two readings, shown in random order, key kept apart), `neither`, or `cannot tell`. |
 | Condition 1 | Reconciled is right on at least 85% of the spots where the judge could tell (`cannot tell` excluded, reported, and `neither` counts as not right). Also report all-30. Pass needs the decided-only figure at 85% or more AND the all-30 figure above 70%. |
 | Condition 2 | Over the same spots, the reconciled text is right at least as often as the better single engine (base engine alone is right where the base reading is right; the other engine alone where the alt reading is right). Ties favour the single engine. |
 | If it fails | Switch reconcile off by configuration; the single-engine path is unchanged (ADR-034 reversibility). |
 Why a fixed all-30 floor: the literal 70% last time sat well under the bar, and "decided only" can
 hide a model that mostly lands on spelling differences.
 ## What a run needs (D10: the owner is present)
 - The same real recording as before (about 60 minutes). Only the owner has it.
 - A **throwaway** tapir instance with its own Postgres, not the production pod, so production's
  key pin and deployment are untouched. Settings: `TAPIR_RECONCILE_BASE_MODEL=iguana/pianissimo`,
  `TAPIR_TRANSCRIBE_MODEL=iguana/kb-whisper`, `TAPIR_RECONCILE_MODEL=iguana/gemma4-31b`, cloud
  fallbacks empty. Job time was 21 min 49 s per 63.6 min last run.
 - iguana with Low Power Mode off and gemma4-31b able to load (the production-iguana model load
  that needs a quiet window; D6).
 ## Steps
 1. Start the throwaway instance, upload the recording, wait for `done` (about 22 minutes).
 2. Read `reconciliation.contested` from the throwaway database. From it build, **outside the repo**:
   `sheet` (spot number, time, left context, reading x, reading y, random order) and `key` (which
   of x/y is the base, which is the other engine, which one the reconciler used).
 3. The speaker fills in the sheet (about 20 to 30 minutes for 30 spots, audio open at the times).
   The agent does not see the key until the sheet is returned.
 4. Score with the rules above. Write the aggregate numbers into a dated note next to this one,
   and amend ADR-034's validation section (kept, or switched off, and the tie rule used).
 5. Delete the throwaway instance, its database and the sheet, as last time.
 6. Only if the check passes and the owner wants it in production: enabling reconcile there is
   the separate D10 step (it needs `iguana/pianissimo` and the reconciler added to the tapir key
   pin in the infra repo plus the env vars on the deployment, `risk/medium`, owner present).
 ## Open and owner-only
 - Confirm or change the rules table above before the run.
 - The **tool that builds the sheet and key** is the one piece not in the repo (last time it was a
  one-off script). It can be built test-first on request; until then the agent builds it ad hoc
  outside the repo.
 - A Berget adjudicator (D8, tapir#45) is a different question with its own measurement and is
  not part of this check: this check judges the local setup that ADR-034 describes.
@@ -1,115 +0,0 @@
 # Sprint: audio upload follow-ups (Sweep Sprint, 2026-10)
 Method: Sweep Sprint (phase 1 parallel read-only research per issue: **done**; phase 2 sequential
 execution, one issue per commit: **v0.31.1 and v0.32.0 shipped 2026-10-03/04, the owner-held items
 below remain open**). Closing oath below.
 Milestones: [v0.31.1 - security and robustness](https://git.d-ma.be/mathias/tapir/milestone/10),
 [v0.32.0 - audio upload follow-ups](https://git.d-ma.be/mathias/tapir/milestone/11).
 Context: v0.31.0 shipped audio upload (ADR-033/034/035) and is live in production behind auth at
 `/uploads`, with the Berget cloud fallback on for audio (infra#522). A real 63.7 min upload
 transcribed in 2m53s with no errors. The phase-1 investigation found two pre-existing or new
 weaknesses an authenticated user can reach, so the first release is a hotfix.
 ## Oath (closing gates, every clause must hold; blocked = descoped and tracked, never "done")
 | # | Clause | Evidence |
 |---|--------|----------|
 | SG1 | Every issue in the sprint is closed with a linked commit, or moved out with a stated reason | issue list of both milestones |
 | SG2 | Each fix has a test that was seen red on main first, named after the mechanism it observes | red/green output in the issue |
 | SG3 | `task check` AND `golangci-lint run ./...` exit 0 (checked by `$?`, not by grep); `task check` does not gate lint until #41 | gate output |
 | SG4 | Control code (#48, #49, the upload cap in #47) has a recorded adversarial review verified by execution, verdict in the issue | gatekeeper verdict comment |
 | SG5 | Docs current in the same commit: ADR-033/035 text, feature file, use-case coverage test | diff |
 | SG6 | Each release tagged (v0.31.1, v0.32.0), pushed, deployed, and observed live (pod running the new image, no restart loop, a real upload still works) | `kubectl`/log + one upload |
 | SG7 | Learnings written to the brain; deferred work filed as issues; decisions that are the owner's recorded as DECISION NEEDED | brain ids + issue numbers |
 ## Work order
 ### v0.31.1 (security and robustness; hotfix, do first)
 1. **#41 lint gate.** `task check` swallows lint findings (`|| echo`). Make the gate fail on findings,
   fix what it surfaces. First, so every later gate means something. (Decision D1.)
 2. **#48 cross-origin POST protection.** `http.NewCrossOriginProtection()` around `Router()`.
   Red: foreign-origin POST to `/account/delete`, `/uploads`, `/uploads/{id}/chat` is refused.
 3. **#49 ffprobe/ffmpeg limits.** `-max_streams 32` + narrower probe output; probe stdout cap;
   probe deadline. Three commits.
 4. **#47 concurrent-upload cap (remaining item).** Bound the spool: reservation per accepted upload
   against the 6Gi emptyDir so concurrent uploads cannot evict the pod.
 5. **#50 SIGTERM interim.** Handle SIGTERM; record the interrupted job at once; fix the false
   comment. Full drain recorded as a limitation. (Decision D2.)
 Release v0.31.1: one adversarial review round over 2-5, then tag, push, observe.
 ### v0.32.0 (follow-ups)
 6. **#52** label a cloud-served transcript in plain words; document the empty-transcript trigger.
 7. **#53** bound the LLM client's response body read.
 8. **#51** tracker: save timeout, then app-clock heartbeat.
 9. **#37** nav link to uploads and per-recording delete (queued/transcribing: refuse until it
   ends). (Decision D3.)
 10. **#36** chat default model after measurement. (Decision D4.)
 11. **#38** measurements (Berget length limit, large models on production iguana). (D5, D6.)
 12. **#46** remainder of the hardening list after the items above are split out.
 13. **#45** evaluate Berget as the reconciler: a question, not work. (D8.)
 ## DECISION NEEDED (owner's call; recommendation first)
 | # | Question | Recommendation | Blocks |
 |---|----------|----------------|--------|
 | D1 | #41: should any linter be allowed to opt out of the gate? | No opt-out; fix findings | #41 |
 | D2 | #50: full SIGTERM drain, or record as a limitation and ship the interim fix? | Limitation + interim; a drain costs 4-6 h and downtime on every deploy at current volume | #50 |
 | D3 | #37: delete of a queued/transcribing recording | Refuse until it ends | #37 |
 | D4 | #36: make a 31B model the chat default? | Only after measurement, conditional | #36 |
 | D5 | #38: Berget length measurement needs a throwaway key | Yes, throwaway key | #38 |
 | D6 | #38: load large models on production iguana | Yes, in a quiet window with the owner present | #38 |
 | D7 | #46: where the ffmpeg tarball lives | Do nothing now; file an issue | none |
 | D8 | #45: evaluate Berget as the reconciler | **Decided 2026-10-04 by the owner: yes, Berget may be used, and each user must be able to keep a recording on local models only** (reverses the recommendation). Opt-out first: #60; #45 stays as the model measurement | #60, #45 |
 | D9 | Who judges ADR-034's second blind check | The owner; do not reuse the one-off Opus authorisation. Protocol: `docs/research/reconcile-second-check-protocol.md` | ADR-034 |
 | D10 | When to enable reconcile in production | Needs `iguana/pianissimo` in the key pin and env vars; owner present | ADR-034 |
 ## Dropped or reduced, with reasons
 - **#46 item 1 (`alis`/`dref` external reference):** checked, not a problem. Under the application's
  flags ffmpeg skips the external track and writes a 78-byte WAV.
 - **#46 item 2 / #47 item 2:** merged into #49.
 - **#47 item 3 (full drain):** reduced to #50 plus a recorded limitation.
 - **#46 `Beat` taking the tracker mutex:** incorrect in #46; only `logStill` does. Corrected in #51.
 ## Human-present items (do not run unattended)
 - Production iguana model loads (#38, D6).
 - Enabling reconcile in production (D10).
 - Any key change or `apply` in infra (infra#523, infra#524 are open and not part of this sprint).
 ## Release plan
 SemVer: v0.31.1 patch (fixes, no new behaviour); v0.32.0 minor (nav link, delete, cloud labelling).
 Every push to tapir main redeploys the pod and fails any job in flight: push when no upload is
 running (check the pod log first).
 ## Status (2026-10-04)
 **Shipped and deployed:** v0.31.1 (PR #55, merge e037c6b) and v0.32.0 (PR #58, merge 85f4cc3; pod
 tapir-597dbfccc-ng78q 1/1, 0 restarts, image 85f4cc3). Each went through an adversarial review
 round by agent with the verdicts recorded on the PR (v0.31.1: BLOCK then APPROVE; v0.32.0: BLOCK,
 BLOCK, APPROVE, APPROVE; every block was a real defect, fixed test-first).
 **Live evidence:** a foreign-origin `POST` to `/account/delete` and to `/uploads/{id}/delete` is
 refused (403) on production, a same-origin one reaches the login redirect (302).
 **Not observed live (needs an authenticated session, so it is the owner's look; closed on word or screenshot):**
 - #52, cloud side: a transcript served by the Berget fallback names `berget`; a reconciled all-local
  one shows no note. The local side was observed on 2026-10-04 (a new clip served by iguana: chip
  `iguana/…`, no cloud note). The cloud side is carried as an acceptance item in #60.
 **Observed live since:** #37 (owner, 2026-10-04: link, confirm-then-delete, no control while transcribing; closed). #50: at the 2026-10-04 rollout the old pod went `Terminating` then `Completed`
 (not `Error`), 0 restarts; #50 closed. No job was in flight, so a drained job is still unobserved
 (a recorded limitation, D2).
 **Still open (owner's call, milestone 11):** #36, #38, #45 (now the Berget adjudicator measurement), #60 (per-recording local-only choice, 4 sub-decisions), #46 remainder, #56 (slow-drip bodies hold
 a receive slot), #57 (shutdown logging, second signal). Decisions D4-D6, D9, D10 above are unchanged; D8 is decided (above).
 **Deferred and filed from the reviews:** #56, #57, #59 (start-up exits when the identity provider's OIDC
 discovery returns 503 (seen once at 19:40 on 2026-10-03; the pod restarted itself and recovered)).
@@ -240,24 +240,6 @@ Feature: Upload an audio recording, get a private Swedish transcript, discuss it
    Then it is transcribed anyway and its audio step says how long the audio really is
    And a complete recording whose header over-estimated its length is not refused
  Scenario: A transcript made by the cloud fallback says the audio left the homelab
    When the transcript was produced by an endpoint that is not local
    Then its page says in plain words that the audio left the homelab and names the provider
    And a locally transcribed recording carries no such note
  Scenario: I can delete a finished recording
    When I confirm deleting a done or failed recording
    Then the recording and its transcript are gone and I am back on my list
    And another user's recording is a 404 and is untouched
  Scenario: A recording still being transcribed cannot be deleted
    When I try to delete a recording that is queued or transcribing
    Then I am told it is still being transcribed and nothing is removed
  Scenario: The home list links to my recordings when uploads are on
    Given audio upload is enabled
    Then the home list links to the recordings page
  Scenario: A full queue is a retry, not an error
    When too many recordings are already waiting
    Then the upload is answered as busy, its row is failed honestly and its audio is deleted
@@ -274,20 +256,3 @@ Feature: Upload an audio recording, get a private Swedish transcript, discuss it
  Scenario: Input that cannot be right is a client error
    When the id is not an id, or a header or title holds control bytes
    Then the answer is a 4xx or the title is cleaned, never a server error
  Scenario: I choose the language of a recording
    When I upload a recording and choose Swedish or Other on the form
    Then the recording is transcribed as that language and its page says which
  Scenario: Swedish stays the default
    When an upload names no language
    Then it is transcribed as Swedish, as before the choice existed
  Scenario: A language outside the list is refused
    When an upload names a language the form does not offer
    Then it is answered 400 before anything is stored or sent to an engine
  Scenario: A recording in another language never reaches the Swedish-only engine
    When I choose Other for a recording
    Then the language is left for the engine to detect and the Swedish-only base engine and the reconcile are not used
    And the engine that does run is the configured one, which is not tuned for other languages
@@ -47,15 +47,11 @@ func (f *FFmpeg) ToWAV(ctx context.Context, src, dst string) error {
 	args = append(args, "-f", "wav", dst)
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
-	// Only a bounded head of ffmpeg's output is kept: a hostile file made it print ~0.4
+	if out, err := cmd.CombinedOutput(); err != nil {
 	// bytes per input byte, all of which CombinedOutput would buffer and copy (#49).
 	out := &headWriter{max: maxStderr}
 	cmd.Stdout, cmd.Stderr = out, out
 	if err := cmd.Run(); err != nil {
 		if ctxErr := ctx.Err(); ctxErr != nil {
 			return fmt.Errorf("audio: ffmpeg: %w", ctxErr)
 		}
-		return fmt.Errorf("audio: ffmpeg: %w: %s", err, strings.TrimSpace(out.buf.String()))
+		return fmt.Errorf("audio: ffmpeg: %w: %s", err, strings.TrimSpace(string(out)))
 	}
 	// A zero exit that wrote nothing is still a failure: never hand whisper a
 	// missing file and let the error surface three layers later.
@@ -109,32 +109,3 @@ printf data > "$last"`)
 	require.NoError(t, err)
 	assert.NotContains(t, " "+strings.ReplaceAll(string(raw), "\n", " ")+" ", " -t ")
 }
 func TestFFmpegToWAV_CapsTheStreamCountBeforeTheInput(t *testing.T) {
 	// ffmpeg also allocated ~570 MB opening the 900-stream file (#49).
 	rec := filepath.Join(t.TempDir(), "argv")
 	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
 for a; do last="$a"; done
 printf data > "$last"`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "o.wav"))
 	require.NoError(t, err)
 	args := argvOf(t, rec)
 	ms, in := indexOf(args, "-max_streams"), indexOf(args, "-i")
 	require.GreaterOrEqual(t, ms, 0, "argv: %v", args)
 	assert.Equal(t, "32", args[ms+1])
 	assert.Less(t, ms, in, "an input option placed after -i is applied to the output")
 }
 func TestFFmpegToWAV_ABoundedPartOfAFloodingStderrIsKept(t *testing.T) {
 	// A hostile mp3 made ffmpeg print ~0.4 bytes of stderr per input byte (83 MB for a
 	// 209 MB file), all of it buffered, then copied twice into the error (#49 review).
 	bin := stub(t, `head -c 5000000 /dev/zero | tr '\0' 'e' >&2; exit 1`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "o.wav"))
 	require.Error(t, err)
 	assert.Less(t, len(err.Error()), 16*1024, "the error carries a bounded head of stderr, not all of it")
 	assert.Contains(t, err.Error(), "eeee", "and still carries some of it")
 }
@@ -4,7 +4,6 @@
 package audio
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -20,51 +19,6 @@ import (
 type FFprobe struct {
 	// Bin is the ffprobe executable ("ffprobe" resolves via PATH).
 	Bin string
 	// MaxOutput bounds how much of ffprobe's stdout is read; zero means DefaultMaxOutput.
 	MaxOutput int
 	// Timeout bounds one probe; zero means DefaultProbeTimeout. A probe is milliseconds of
 	// work on a real file, so one that runs this long is the FILE's doing (#49).
 	Timeout time.Duration
 }
 // DefaultProbeTimeout is the probe deadline when FFprobe.Timeout is unset.
 const DefaultProbeTimeout = 45 * time.Second
 // DefaultMaxOutput is far above the narrowed probe output of a legitimate file (a few
 // hundred bytes) and far below what a hostile one can make ffprobe print.
 const DefaultMaxOutput = 1 << 20
 // maxStderr is how much of ffprobe's stderr is kept for the error message.
 const maxStderr = 4096
 // errOutputCap is the write error that stops ffprobe once it prints past the cap.
 var errOutputCap = errors.New("audio: ffprobe output exceeds the cap")
 // capWriter collects up to max bytes and then refuses further writes, which closes the
 // pipe and ends the process instead of buffering whatever it prints.
 type capWriter struct {
 	buf bytes.Buffer
 	max int
 }
 func (w *capWriter) Write(p []byte) (int, error) {
 	if w.buf.Len()+len(p) > w.max {
 		return 0, errOutputCap
 	}
 	return w.buf.Write(p)
 }
 // headWriter keeps the first max bytes and silently drops the rest.
 type headWriter struct {
 	buf bytes.Buffer
 	max int
 }
 func (w *headWriter) Write(p []byte) (int, error) {
 	if room := w.max - w.buf.Len(); room > 0 {
 		w.buf.Write(p[:min(room, len(p))])
 	}
 	return len(p), nil
 }
 // AllowedDemuxers are the input formats an upload may be. The input is
@@ -76,22 +30,9 @@ func (w *headWriter) Write(p []byte) (int, error) {
 // formats. "mov" covers .mp4/.m4a/.3gp; "matroska" covers .webm.
 const AllowedDemuxers = "wav,mov,mp4,m4a,3gp,mp3,ogg,matroska,webm,flac,aac,opus,aiff,amr,asf"
 // MaxStreams bounds how many streams a file may declare. A 1.3 MB file declaring 900 of
 // them cost ~570 MB of RSS in each of ffprobe and ffmpeg (#49), against a 512 Mi pod;
 // real recordings have a handful.
 const MaxStreams = "32"
 // inputRestrictions are ffmpeg/ffprobe INPUT options and must precede the input.
-// Local files and pipes only: no network, no other protocols, and a bounded stream count.
+// Local files and pipes only: no network, no other protocols.
-var inputRestrictions = []string{
+var inputRestrictions = []string{"-protocol_whitelist", "file,pipe", "-format_whitelist", AllowedDemuxers}
 	"-protocol_whitelist", "file,pipe",
 	"-format_whitelist", AllowedDemuxers,
 	"-max_streams", MaxStreams,
 }
 // probeEntries is exactly what ParseProbe reads. -show_format/-show_streams print every
 // tag too, and a 120 MB WAV made 491 MB of JSON that Output() buffers.
 const probeEntries = "format=duration:stream=codec_type:stream_disposition=attached_pic"
 // killGrace bounds how long Probe waits for a cancelled ffprobe's pipes to close.
 const killGrace = 2 * time.Second
@@ -107,38 +48,21 @@ func (f *FFprobe) Probe(ctx context.Context, path string) (uploads.Probe, error)
 		bin = "ffprobe"
 	}
 	args := append([]string{"-v", "error"}, inputRestrictions...)
-	args = append(args, "-print_format", "json", "-show_entries", probeEntries, path)
+	args = append(args, "-print_format", "json", "-show_format", "-show_streams", path)
-	timeout := f.Timeout
+	cmd := exec.CommandContext(ctx, bin, args...)
 	if timeout <= 0 {
 		timeout = DefaultProbeTimeout
 	}
 	probeCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 	cmd := exec.CommandContext(probeCtx, bin, args...)
 	cmd.WaitDelay = killGrace
-	maxOut := f.MaxOutput
+	out, err := cmd.Output()
-	if maxOut <= 0 {
+	if err != nil {
-		maxOut = DefaultMaxOutput
+		if ctxErr := ctx.Err(); ctxErr != nil {
 	}
 	stdout, stderr := &capWriter{max: maxOut}, &headWriter{max: maxStderr}
 	cmd.Stdout, cmd.Stderr = stdout, stderr
 	if err := cmd.Run(); err != nil {
 		if ctxErr := ctx.Err(); ctxErr != nil { // the caller gave up: not a verdict on the file
 			return uploads.Probe{}, fmt.Errorf("audio: ffprobe: %w", ctxErr)
 		}
 		if probeCtx.Err() != nil { // our own deadline passed while the caller was still waiting
 			return uploads.Probe{}, fmt.Errorf("%w: ffprobe did not finish within %s", uploads.ErrUnreadable, timeout)
 		}
 		if errors.Is(err, errOutputCap) {
 			return uploads.Probe{}, fmt.Errorf("%w: ffprobe printed more than %d bytes", uploads.ErrUnreadable, maxOut)
 		}
 		var exit *exec.ExitError
 		if errors.As(err, &exit) {
-			return uploads.Probe{}, fmt.Errorf("%w: ffprobe: %s", uploads.ErrUnreadable, stderr.buf.String())
+			return uploads.Probe{}, fmt.Errorf("%w: ffprobe: %s", uploads.ErrUnreadable, exit.Stderr)
 		}
 		return uploads.Probe{}, fmt.Errorf("audio: run ffprobe: %w", err)
 	}
-	p, err := ParseProbe(stdout.buf.Bytes())
+	p, err := ParseProbe(out)
 	if err != nil {
 		return uploads.Probe{}, fmt.Errorf("audio: ffprobe output: %w", err)
 	}
@@ -184,78 +184,3 @@ func TestAllowedDemuxers_ExcludeThePlaylistFormats(t *testing.T) {
 		assert.Contains(t, strings.Split(audio.AllowedDemuxers, ","), good)
 	}
 }
 func TestFFprobeProbe_CapsTheStreamCountBeforeTheInput(t *testing.T) {
 	// A 1.3 MB file declaring 900 streams cost ~570 MB of RSS in ffprobe (#49) against
 	// a 512 Mi pod. -max_streams is an input option: it must precede the path.
 	bin, argvFile := argvStub(t)
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/spool/upload-1")
 	require.NoError(t, err)
 	args := argvOf(t, argvFile)
 	ms := indexOf(args, "-max_streams")
 	require.GreaterOrEqual(t, ms, 0, "argv: %v", args)
 	assert.Equal(t, "32", args[ms+1])
 	assert.Less(t, ms, len(args)-1, "must come before the path, which stays last")
 }
 func TestFFprobeProbe_AsksOnlyForTheFieldsParseProbeReads(t *testing.T) {
 	// -show_format/-show_streams print every tag: a 120 MB WAV produced 491 MB of JSON
 	// that cmd.Output() buffers in Go (#49).
 	bin, argvFile := argvStub(t)
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/spool/upload-1")
 	require.NoError(t, err)
 	args := argvOf(t, argvFile)
 	assert.Equal(t, -1, indexOf(args, "-show_format"), "argv: %v", args)
 	assert.Equal(t, -1, indexOf(args, "-show_streams"), "argv: %v", args)
 	se := indexOf(args, "-show_entries")
 	require.GreaterOrEqual(t, se, 0, "argv: %v", args)
 	assert.Equal(t, "format=duration:stream=codec_type:stream_disposition=attached_pic", args[se+1])
 }
 func TestFFprobeProbe_OutputPastTheCapIsUnreadableNotBuffered(t *testing.T) {
 	// ffprobe's stdout is attacker-influenced (tags, 491 MB observed). Past the cap the
 	// probe is stopped and the file is reported as unreadable (#49).
 	bin := stub(t, `head -c 200000 /dev/zero | tr '\0' 'a'`)
 	_, err := (&audio.FFprobe{Bin: bin, MaxOutput: 4096}).Probe(context.Background(), "/x")
 	assert.ErrorIs(t, err, uploads.ErrUnreadable)
 }
 func TestFFprobeProbe_OutputWithinTheCapIsParsed(t *testing.T) {
 	bin := stub(t, `echo '{"streams":[{"codec_type":"audio"}],"format":{"duration":"90"}}'`)
 	got, err := (&audio.FFprobe{Bin: bin, MaxOutput: 4096}).Probe(context.Background(), "/x")
 	require.NoError(t, err)
 	assert.True(t, got.HasAudio)
 }
 func TestFFprobeProbe_AHungProbeTimesOutOnItsOwnDeadlineAsUnreadableNotAsOurFault(t *testing.T) {
 	// Accept runs the probe on the request context, which has no deadline of its own;
 	// a probe that never returns would pin a request (#49). `exec` so the sleep is the
 	// process itself and not a child holding the pipe open.
 	bin := stub(t, `exec sleep 30`)
 	start := time.Now()
 	_, err := (&audio.FFprobe{Bin: bin, Timeout: 200 * time.Millisecond}).Probe(context.Background(), "/x")
 	assert.ErrorIs(t, err, uploads.ErrUnreadable)
 	assert.Less(t, time.Since(start), 3*time.Second)
 }
 func TestFFprobeProbe_ParentCancellationIsStillNotUnreadableWhenATimeoutIsSet(t *testing.T) {
 	bin := stub(t, `exec sleep 30`)
 	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
 	defer cancel()
 	_, err := (&audio.FFprobe{Bin: bin, Timeout: time.Minute}).Probe(ctx, "/x")
 	require.Error(t, err)
 	assert.False(t, errors.Is(err, uploads.ErrUnreadable), "the caller giving up is not a verdict on the file")
 	assert.ErrorIs(t, err, context.DeadlineExceeded)
 }
@@ -1,156 +0,0 @@
 package llm
 // Observes how much of a gateway response the client will read. The body is read before
 // the status is looked at, so a misbehaving gateway or proxy that streams forever was
 // bounded only by the client's overall timeout (#53).
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 )
 // endlessGateway answers with the given status and streams filler until the client hangs
 // up; wrote reports how many bytes it managed to send.
 func endlessGateway(t *testing.T, status int, wrote *atomic.Int64) *httptest.Server {
 	t.Helper()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(status)
 		chunk := []byte(strings.Repeat("a", 4096))
 		for {
 			n, err := w.Write(chunk)
 			wrote.Add(int64(n))
 			if err != nil {
 				return
 			}
 			if f, ok := w.(http.Flusher); ok {
 				f.Flush()
 			}
 		}
 	}))
 	t.Cleanup(srv.Close)
 	return srv
 }
 func TestClient_ASuccessBodyLargerThanTheCapIsAnErrorAndTheClientStopsReading(t *testing.T) {
 	var wrote atomic.Int64
 	srv := endlessGateway(t, http.StatusOK, &wrote)
 	c := New(srv.URL, "", "m", 30*time.Second, WithMaxResponseBytes(8192))
 	start := time.Now()
 	_, err := c.Complete(context.Background(), "s", "u")
 	if err == nil || !strings.Contains(err.Error(), "exceeds") {
 		t.Fatalf("want a response-too-large error, got %v", err)
 	}
 	if time.Since(start) > 5*time.Second {
 		t.Fatalf("the client kept reading: took %s", time.Since(start))
 	}
 	// Hanging up lets the server's writes fail; allow what the transport had already buffered.
 	time.Sleep(100 * time.Millisecond)
 	if got := wrote.Load(); got > 8192+1<<20 {
 		t.Fatalf("server managed to send %d bytes after a cap of 8192", got)
 	}
 }
 func TestClient_AFailingBodyIsReadOnlyUpToTheErrorBound(t *testing.T) {
 	var wrote atomic.Int64
 	srv := endlessGateway(t, http.StatusBadGateway, &wrote)
 	c := New(srv.URL, "", "m", 30*time.Second)
 	start := time.Now()
 	_, err := c.Complete(context.Background(), "s", "u")
 	he, ok := err.(*HTTPError)
 	if !ok {
 		t.Fatalf("want *HTTPError, got %T: %v", err, err)
 	}
 	if he.Code != http.StatusBadGateway {
 		t.Fatalf("code %d", he.Code)
 	}
 	if len(he.Body) > maxErrorBody+1 {
 		t.Fatalf("kept %d bytes of an error body, bound is %d", len(he.Body), maxErrorBody)
 	}
 	if time.Since(start) > 5*time.Second {
 		t.Fatalf("the client kept reading an endless error body: took %s", time.Since(start))
 	}
 }
 // sizedGateway answers 200 with a valid completion padded with trailing whitespace to
 // exactly size bytes, so the boundary of the cap can be probed to the byte.
 func sizedGateway(t *testing.T, size int) *httptest.Server {
 	t.Helper()
 	const base = `{"choices":[{"message":{"content":"ok"}}]}`
 	payload := base + strings.Repeat(" ", size-len(base))
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(payload))
 	}))
 	t.Cleanup(srv.Close)
 	return srv
 }
 func TestClient_ABodyOfExactlyTheCapIsReadAndOneByteMoreIsRefused(t *testing.T) {
 	const capBytes = 4096
 	for _, tt := range []struct {
 		name    string
 		size    int
 		wantErr bool
 	}{
 		{"one under", capBytes - 1, false},
 		{"exactly the cap", capBytes, false},
 		{"one over", capBytes + 1, true},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			c := New(sizedGateway(t, tt.size).URL, "", "m", 5*time.Second, WithMaxResponseBytes(capBytes))
 			got, err := c.Complete(context.Background(), "s", "u")
 			if tt.wantErr {
 				if err == nil || !strings.Contains(err.Error(), "exceeds") {
 					t.Fatalf("want a response-too-large error, got %q, %v", got, err)
 				}
 				return
 			}
 			if err != nil || got != "ok" {
 				t.Fatalf("want ok, got %q, %v", got, err)
 			}
 		})
 	}
 }
 // New is what production calls: no option. The default is therefore the live bound.
 func TestClient_TheDefaultCapIsEightMiBWhenNoOptionIsGiven(t *testing.T) {
 	for _, tt := range []struct {
 		name    string
 		size    int
 		wantErr bool
 	}{
 		{"exactly 8 MiB", 8 << 20, false},
 		{"8 MiB plus one", 8<<20 + 1, true},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			c := New(sizedGateway(t, tt.size).URL, "", "m", 10*time.Second)
 			_, err := c.Complete(context.Background(), "s", "u")
 			if (err != nil) != tt.wantErr {
 				t.Fatalf("size %d: err = %v, wantErr %v", tt.size, err, tt.wantErr)
 			}
 		})
 	}
 }
 func TestClient_ANonPositiveCapOptionKeepsTheDefault(t *testing.T) {
 	for _, n := range []int64{0, -1} {
 		c := New(sizedGateway(t, 1024).URL, "", "m", 5*time.Second, WithMaxResponseBytes(n))
 		if got, err := c.Complete(context.Background(), "s", "u"); err != nil || got != "ok" {
 			t.Fatalf("WithMaxResponseBytes(%d): want ok from the default cap, got %q, %v", n, got, err)
 		}
 	}
 }
@@ -37,21 +37,6 @@ type Client struct {
 	temp       float64
 	httpClient *http.Client
 	usageHook  func(model string, prompt, completion int)
 	maxBody    int64
 }
 // defaultMaxResponseBytes bounds a success body. A completion is a few KB of text; this
 // leaves room for a long one and none for a gateway that streams forever (#53).
 const defaultMaxResponseBytes = 8 << 20
 // WithMaxResponseBytes overrides the bound on a success response body. A non-positive n is
 // ignored (keeps the default).
 func WithMaxResponseBytes(n int64) Option {
 	return func(c *Client) {
 		if n > 0 {
 			c.maxBody = n
 		}
 	}
 }
 // Option configures a Client at construction. Variadic so the existing 4-arg
@@ -116,7 +101,6 @@ func New(baseURL, apiKey, model string, timeout time.Duration, opts ...Option) *
 		maxTokens:  defaultMaxTokens,
 		temp:       defaultTemperature,
 		httpClient: &http.Client{Timeout: timeout},
 		maxBody:    defaultMaxResponseBytes,
 	}
 	for _, opt := range opts {
 		opt(c)
@@ -200,18 +184,12 @@ func (c *Client) Complete(ctx context.Context, system, user string) (string, err
 	}
 	defer resp.Body.Close() //nolint:errcheck
-	if resp.StatusCode != http.StatusOK {
+	out, err := io.ReadAll(resp.Body)
 		// Only the bounded head is ever used (HTTPError.Error truncates to it), so read no more.
 		// A read error here only shortens a diagnostic; the status code below is what callers act on.
 		head, _ := io.ReadAll(io.LimitReader(resp.Body, maxErrorBody+1))
 		return "", &HTTPError{Code: resp.StatusCode, Body: string(head)}
 	}
 	out, err := io.ReadAll(io.LimitReader(resp.Body, c.maxBody+1))
 	if err != nil {
 		return "", fmt.Errorf("read response: %w", err)
 	}
-	if int64(len(out)) > c.maxBody {
+	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("LLM response exceeds %d bytes", c.maxBody)
+		return "", &HTTPError{Code: resp.StatusCode, Body: string(out)}
 	}
 	var cr chatResponse
@@ -1,2 +0,0 @@
 ALTER TABLE uploaded_transcripts
    DROP COLUMN language;
@@ -1,13 +0,0 @@
 -- Migration 021: the language an upload is transcribed as (tapir#61).
 --
 -- 'sv'   Swedish: the engines are sent language=sv. Every row before this migration was
 --        transcribed that way (the request hard-coded it), so the default is true history.
 -- 'auto' Other: the engine detects the language and the Swedish-only engine is not used.
 --
 -- A closed set held by the table as well as by the form and the request code, so a second
 -- writer or a bug cannot store a value the engines are never meant to receive. The column
 -- sits on the already-FORCE'd, RLS-scoped uploaded_transcripts, so the exact-set isolation
 -- test is unaffected.
 ALTER TABLE uploaded_transcripts
    ADD COLUMN language TEXT NOT NULL DEFAULT 'sv'
        CONSTRAINT uploaded_transcripts_language_check CHECK (language IN ('sv', 'auto'));
@@ -17,10 +17,6 @@ import (
 // nothing about whether someone else's upload exists (ADR-033).
 var ErrUploadNotFound = errors.New("store: uploaded transcript not found")
 // ErrUploadInProgress is returned by DeleteUpload for an upload that is still queued or
 // transcribing: the worker would write its result to a row that no longer exists.
 var ErrUploadInProgress = errors.New("store: uploaded transcript is still being processed")
 // Uploaded transcripts are PRIVATE per-user content, stored in their own
 // RLS-scoped table (migration 017) — never in the shared `transcripts` (ADR-021).
 // Every method goes through withUser, so row-level security confines it to the
@@ -31,12 +27,12 @@ var ErrUploadInProgress = errors.New("store: uploaded transcript is still being
 // CreateUpload records a new upload in the queued state and returns its id.
 // hadVideo records that the file carried a video track (only its audio is used);
 // it is kept for the life of the row so the page can say so.
-func (s *Store) CreateUpload(ctx context.Context, userID, title string, lang domain.Language, hadVideo bool) (string, error) {
+func (s *Store) CreateUpload(ctx context.Context, userID, title string, hadVideo bool) (string, error) {
 	var id string
 	if err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		return tx.QueryRow(ctx,
-			`INSERT INTO uploaded_transcripts (user_id, title, language, had_video) VALUES ($1, $2, $3, $4) RETURNING id`,
+			`INSERT INTO uploaded_transcripts (user_id, title, had_video) VALUES ($1, $2, $3) RETURNING id`,
-			userID, title, string(lang), hadVideo).Scan(&id)
+			userID, title, hadVideo).Scan(&id)
 	}); err != nil {
 		return "", fmt.Errorf("store: create upload: %w", err)
 	}
@@ -84,56 +80,23 @@ func (s *Store) SaveProgress(ctx context.Context, userID, id string, steps []dom
 		  WHERE id = $1 AND user_id = $2`, b, at)
 }
-// Heartbeat stamps the upload as alive at the given time. It does not touch progress_at:
+// Heartbeat stamps the upload as alive now. It does not touch progress_at: alive says
-// alive says the service is still reporting, not that work is moving (ADR-035). The time
+// the service is still reporting, not that work is moving (ADR-035).
-// comes from the application clock, the one progress_at and the page's health check use,
+func (s *Store) Heartbeat(ctx context.Context, userID, id string) error {
 // so a database clock that disagrees cannot make a healthy job look lost (#51).
 func (s *Store) Heartbeat(ctx context.Context, userID, id string, at time.Time) error {
 	return s.updateUpload(ctx, userID, id, "heartbeat",
-		`UPDATE uploaded_transcripts SET alive_at = $3
+		`UPDATE uploaded_transcripts SET alive_at = NOW()
-		  WHERE id = $1 AND user_id = $2`, at)
+		  WHERE id = $1 AND user_id = $2`)
 }
-// FailUpload moves a queued or transcribing upload to failed with a typed reason. A
+// FailUpload moves an upload to failed with a typed reason.
 // finished upload is left as it was: a shutdown can record a job as failed after its
 // transcript was already committed (the commit lands, the caller sees a cancelled
 // context), and that must not hide the text. Such a call touches no row and returns
 // ErrUploadNotFound.
 func (s *Store) FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error {
 	return s.updateUpload(ctx, userID, id, "fail upload",
 		`UPDATE uploaded_transcripts
 		    SET status = 'failed', error_kind = $3, finished_at = NOW()
-		  WHERE id = $1 AND user_id = $2 AND status IN ('queued', 'transcribing')`,
+		  WHERE id = $1 AND user_id = $2`,
 		string(kind))
 }
 // DeleteUpload removes one of the caller's finished (done or failed) uploads. An upload
 // still queued or transcribing is refused with ErrUploadInProgress and left untouched; one
 // that is not the caller's is ErrUploadNotFound, as for every other write (#37).
 func (s *Store) DeleteUpload(ctx context.Context, userID, id string) error {
 	return s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		ct, err := tx.Exec(ctx,
 			`DELETE FROM uploaded_transcripts
 			  WHERE id = $1 AND user_id = $2 AND status IN ('done', 'failed')`, id, userID)
 		if err != nil {
 			return fmt.Errorf("store: delete upload: %w", err)
 		}
 		if ct.RowsAffected() > 0 {
 			return nil
 		}
 		var exists bool
 		if err := tx.QueryRow(ctx,
 			`SELECT EXISTS (SELECT 1 FROM uploaded_transcripts WHERE id = $1 AND user_id = $2)`,
 			id, userID).Scan(&exists); err != nil {
 			return fmt.Errorf("store: delete upload: %w", err)
 		}
 		if exists {
 			return ErrUploadInProgress
 		}
 		return ErrUploadNotFound
 	})
 }
 // updateUpload runs one UPDATE keyed on ($1 = id, $2 = userID) plus extra args,
 // and maps "no row touched" to ErrUploadNotFound — which is what a write to another
 // user's upload looks like under RLS (the row is invisible, not forbidden).
@@ -221,7 +184,7 @@ func (s *Store) FailInterruptedUploads(ctx context.Context) (int, error) {
 	return total, nil
 }
-const uploadSelect = `SELECT id, user_id, title, language, status, content, segments, endpoint,
+const uploadSelect = `SELECT id, user_id, title, status, content, segments, endpoint,
       audio_seconds, error_kind, had_video, reconciliation, progress, progress_at, alive_at,
       created_at, finished_at FROM uploaded_transcripts`
@@ -234,13 +197,11 @@ func scanUpload(row pgx.Row, u *domain.UploadedTranscript, withText bool) error
 		seconds                            *float64
 		finished, progressAt, aliveAt      *time.Time
 	)
-	var language string
+	if err := row.Scan(&u.ID, &u.UserID, &u.Title, &status, &content, &segments, &endpoint,
 	if err := row.Scan(&u.ID, &u.UserID, &u.Title, &language, &status, &content, &segments, &endpoint,
 		&seconds, &errKind, &u.HadVideo, &reconciliation, &progress, &progressAt, &aliveAt,
 		&u.CreatedAt, &finished); err != nil {
 		return err
 	}
 	u.Language = domain.Language(language)
 	u.Status = domain.UploadStatus(deref(status))
 	u.Endpoint = deref(endpoint)
 	u.ErrorKind = domain.UploadErrorKind(deref(errKind))
@@ -1,68 +0,0 @@
 package store_test
 // Deleting one recording (#37). A finished or failed upload can be removed by its owner;
 // one that is queued or transcribing is refused until it ends, because the worker would
 // otherwise write its result to a row that is gone (D3 in the sprint plan).
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 func TestDeleteUpload_RemovesAFinishedOrFailedUploadOfTheOwner(t *testing.T) {
 	for name, finish := range map[string]func(*store.Store, string) error{
 		"done": func(s *store.Store, id string) error {
 			return s.CompleteUpload(context.Background(), userA, id, domain.Transcription{Text: "synthetic", Endpoint: "iguana/kb-whisper"})
 		},
 		"failed": func(s *store.Store, id string) error {
 			return s.FailUpload(context.Background(), userA, id, domain.UploadErrTranscriptionFailed)
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			s := newStore(t)
 			id := startedUpload(t, s)
 			require.NoError(t, s.StartTranscribing(context.Background(), userA, id))
 			require.NoError(t, finish(s, id))
 			require.NoError(t, s.DeleteUpload(context.Background(), userA, id))
 			_, err := s.GetUpload(context.Background(), userA, id)
 			assert.ErrorIs(t, err, store.ErrUploadNotFound)
 		})
 	}
 }
 func TestDeleteUpload_RefusesAnUploadThatIsStillQueuedOrTranscribingAndKeepsTheRow(t *testing.T) {
 	s := newStore(t)
 	ctx := context.Background()
 	queued := startedUpload(t, s)
 	running, err := s.CreateUpload(ctx, userA, "running", domain.LangSwedish, false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, running))
 	for _, id := range []string{queued, running} {
 		assert.ErrorIs(t, s.DeleteUpload(ctx, userA, id), store.ErrUploadInProgress)
 		_, err := s.GetUpload(ctx, userA, id)
 		assert.NoError(t, err, "a refused delete must leave the row")
 	}
 }
 func TestDeleteUpload_AnotherUsersUploadIsNotFoundAndSurvives(t *testing.T) {
 	s := newStore(t)
 	ctx := context.Background()
 	id := startedUpload(t, s)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	require.NoError(t, s.FailUpload(ctx, userA, id, domain.UploadErrTranscriptionFailed))
 	assert.ErrorIs(t, s.DeleteUpload(ctx, userB, id), store.ErrUploadNotFound,
 		"existence is not disclosed to a non-owner")
 	_, err := s.GetUpload(ctx, userA, id)
 	assert.NoError(t, err, "B's delete must not have removed A's row")
 }
@@ -1,47 +0,0 @@
 package store_test
 // A shutdown can record a job as failed after its transcript was already committed (the
 // commit lands, the caller sees a cancelled context). FailUpload must not be able to turn a
 // finished row into a failed one and hide the text (#50 review).
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 func TestFailUpload_LeavesAFinishedUploadAsItWas(t *testing.T) {
 	s := newStore(t)
 	ctx := context.Background()
 	id := startedUpload(t, s)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	require.NoError(t, s.CompleteUpload(ctx, userA, id, domain.Transcription{Text: "synthetic text", Endpoint: "iguana/kb-whisper"}))
 	_ = s.FailUpload(ctx, userA, id, domain.UploadErrInterrupted)
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadDone, got.Status)
 	assert.Equal(t, "synthetic text", got.Content)
 	assert.Empty(t, got.ErrorKind)
 }
 func TestFailUpload_StillFailsAQueuedOrTranscribingUpload(t *testing.T) {
 	s := newStore(t)
 	ctx := context.Background()
 	queued := startedUpload(t, s)
 	running, err := s.CreateUpload(ctx, userA, "r", domain.LangSwedish, false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, running))
 	for _, id := range []string{queued, running} {
 		require.NoError(t, s.FailUpload(ctx, userA, id, domain.UploadErrBusy))
 		got, err := s.GetUpload(ctx, userA, id)
 		require.NoError(t, err)
 		assert.Equal(t, domain.UploadFailed, got.Status)
 	}
 }
@@ -20,7 +20,7 @@ import (
 func startedUpload(t *testing.T, s *store.Store) string {
 	t.Helper()
 	seedUsers(t, userA, userB)
-	id, err := s.CreateUpload(context.Background(), userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(context.Background(), userA, "m", false)
 	require.NoError(t, err)
 	return id
 }
@@ -68,13 +68,13 @@ func TestUploadProgress_AHeartbeatMovesAliveAtAndNotProgressAt(t *testing.T) {
 	ctx := context.Background()
 	at := time.Date(2026, 10, 2, 8, 30, 0, 0, time.UTC)
 	require.NoError(t, s.SaveProgress(ctx, userA, id, []domain.ProgressStep{{Key: "audio", Label: "a", State: domain.StepRunning}}, at))
-	beatAt := at.Add(90 * time.Second) // deliberately not the database's NOW()
+	before := time.Now().Add(-time.Second)
-	require.NoError(t, s.Heartbeat(ctx, userA, id, beatAt))
+	require.NoError(t, s.Heartbeat(ctx, userA, id))
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
-	assert.True(t, got.AliveAt.Equal(beatAt), "the heartbeat is stamped with the application's clock, the same one progress_at uses, not the database's NOW() (#51)")
+	assert.True(t, got.AliveAt.After(before), "the heartbeat must stamp the row with now")
 	assert.True(t, got.ProgressAt.Equal(at), "alive is not progress: a heartbeat must not move progress_at")
 }
@@ -99,7 +99,7 @@ func TestUploadProgress_ByAnotherUserChangesNothing(t *testing.T) {
 	ctx := context.Background()
 	errSave := s.SaveProgress(ctx, userB, id, []domain.ProgressStep{{Key: "x", Label: "X", State: domain.StepDone}}, time.Now())
-	errBeat := s.Heartbeat(ctx, userB, id, time.Now())
+	errBeat := s.Heartbeat(ctx, userB, id)
 	assert.ErrorIs(t, errSave, store.ErrUploadNotFound)
 	assert.ErrorIs(t, errBeat, store.ErrUploadNotFound)
@@ -33,7 +33,7 @@ func TestCreateUpload_StartsQueuedAndIsOwnedByTheCreator(t *testing.T) {
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "Teams export", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "Teams export", false)
 	require.NoError(t, err)
 	got, err := s.GetUpload(ctx, userA, id)
@@ -50,7 +50,7 @@ func TestUploadLifecycle_CompletedKeepsTextSegmentsEndpointAndDuration(t *testin
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
@@ -84,7 +84,7 @@ func TestUploadLifecycle_FailedRecordsTypedKindAndNoContent(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
@@ -102,7 +102,7 @@ func TestGetUpload_AnotherUsersIDIsNotFound(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "A's meeting", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "A's meeting", false)
 	require.NoError(t, err)
 	_, err = s.GetUpload(ctx, userB, id)
@@ -115,7 +115,7 @@ func TestUploadWrites_ByAnotherUserChangeNothing(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "A's meeting", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "A's meeting", false)
 	require.NoError(t, err)
 	assert.ErrorIs(t, s.StartTranscribing(ctx, userB, id), store.ErrUploadNotFound)
@@ -132,11 +132,11 @@ func TestListUploads_ReturnsOnlyTheCallersNewestFirstWithoutTranscriptText(t *te
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
-	first, err := s.CreateUpload(ctx, userA, "first", domain.LangSwedish, false)
+	first, err := s.CreateUpload(ctx, userA, "first", false)
 	require.NoError(t, err)
-	second, err := s.CreateUpload(ctx, userA, "second", domain.LangSwedish, false)
+	second, err := s.CreateUpload(ctx, userA, "second", false)
 	require.NoError(t, err)
-	_, err = s.CreateUpload(ctx, userB, "B's", domain.LangSwedish, false)
+	_, err = s.CreateUpload(ctx, userB, "B's", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, first))
 	require.NoError(t, s.CompleteUpload(ctx, userA, first, domain.Transcription{Text: "long text body", Endpoint: "e"}))
@@ -160,12 +160,12 @@ func TestFailInterruptedUploads_FailsOnlyUnfinishedRowsForEveryUser(t *testing.T
 		_, err := super.Exec(ctx, `INSERT INTO user_identities (dex_subject, user_id) VALUES ($1, $2)`, subject, uid)
 		require.NoError(t, err)
 	}
-	queued, err := s.CreateUpload(ctx, userA, "queued", domain.LangSwedish, false)
+	queued, err := s.CreateUpload(ctx, userA, "queued", false)
 	require.NoError(t, err)
-	running, err := s.CreateUpload(ctx, userB, "running", domain.LangSwedish, false)
+	running, err := s.CreateUpload(ctx, userB, "running", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userB, running))
-	done, err := s.CreateUpload(ctx, userA, "done", domain.LangSwedish, false)
+	done, err := s.CreateUpload(ctx, userA, "done", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, done))
 	require.NoError(t, s.CompleteUpload(ctx, userA, done, domain.Transcription{Text: "kept", Endpoint: "e"}))
@@ -191,9 +191,9 @@ func TestCreateUpload_RecordsWhetherTheFileHadAVideoTrack(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	withVideo, err := s.CreateUpload(ctx, userA, "camera off", domain.LangSwedish, true)
+	withVideo, err := s.CreateUpload(ctx, userA, "camera off", true)
 	require.NoError(t, err)
-	audioOnly, err := s.CreateUpload(ctx, userA, "voice only", domain.LangSwedish, false)
+	audioOnly, err := s.CreateUpload(ctx, userA, "voice only", false)
 	require.NoError(t, err)
 	gotVideo, err := s.GetUpload(ctx, userA, withVideo)
@@ -216,9 +216,9 @@ func TestUploadHadVideo_SurvivesCompletionAndFailure(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	done, err := s.CreateUpload(ctx, userA, "d", domain.LangSwedish, true)
+	done, err := s.CreateUpload(ctx, userA, "d", true)
 	require.NoError(t, err)
-	failed, err := s.CreateUpload(ctx, userA, "f", domain.LangSwedish, true)
+	failed, err := s.CreateUpload(ctx, userA, "f", true)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, done))
 	require.NoError(t, s.CompleteUpload(ctx, userA, done, domain.Transcription{Text: "x", Endpoint: "e"}))
@@ -235,7 +235,7 @@ func TestUploadLifecycle_ReconciliationRoundTripsWithItsContestedSpots(t *testin
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	want := &domain.Reconciliation{
@@ -258,7 +258,7 @@ func TestUploadLifecycle_ASingleEngineTranscriptHasNoReconciliation(t *testing.T
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	require.NoError(t, s.CompleteUpload(ctx, userA, id, domain.Transcription{Text: "x", Endpoint: "e"}))
@@ -273,7 +273,7 @@ func TestUploadLifecycle_ASkippedReconciliationKeepsItsReason(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
-	id, err := s.CreateUpload(ctx, userA, "m", domain.LangSwedish, false)
+	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	rec := &domain.Reconciliation{Status: domain.ReconcileSkipped, Reason: "the model failed 3 times in a row: gateway down", Errors: 3}
@@ -284,55 +284,3 @@ func TestUploadLifecycle_ASkippedReconciliationKeepsItsReason(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, rec, got.Reconciliation)
 }
 func TestCreateUpload_RecordsTheLanguageTheUserChoseAndTheListCarriesIt(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	swedish, err := s.CreateUpload(ctx, userA, "sv", domain.LangSwedish, false)
 	require.NoError(t, err)
 	auto, err := s.CreateUpload(ctx, userA, "auto", domain.LangAuto, false)
 	require.NoError(t, err)
 	gotSv, err := s.GetUpload(ctx, userA, swedish)
 	require.NoError(t, err)
 	gotAuto, err := s.GetUpload(ctx, userA, auto)
 	require.NoError(t, err)
 	listed, err := s.ListUploads(ctx, userA)
 	require.NoError(t, err)
 	assert.Equal(t, domain.LangSwedish, gotSv.Language)
 	assert.Equal(t, domain.LangAuto, gotAuto.Language)
 	byID := map[string]domain.Language{}
 	for _, u := range listed {
 		byID[u.ID] = u.Language
 	}
 	assert.Equal(t, map[string]domain.Language{swedish: domain.LangSwedish, auto: domain.LangAuto}, byID)
 }
 // The closed set is also held by the table, so a bug or a second writer cannot store a
 // value the engines are never meant to receive (tapir#61).
 func TestUploadedTranscripts_TheTableRefusesALanguageOutsideTheClosedSet(t *testing.T) {
 	newStore(t)
 	seedUsers(t, userA)
 	_, err := rawPool(t).Exec(context.Background(),
 		`INSERT INTO uploaded_transcripts (user_id, title, language) VALUES ($1, 'x', 'en')`, userA)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "language", "the CHECK constraint names the column")
 }
 // A row from before the column existed was transcribed as Swedish; the default says so.
 func TestUploadedTranscripts_ARowInsertedWithoutALanguageIsSwedish(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	var id string
 	require.NoError(t, rawPool(t).QueryRow(context.Background(),
 		`INSERT INTO uploaded_transcripts (user_id, title) VALUES ($1, 'old') RETURNING id`, userA).Scan(&id))
 	got, err := s.GetUpload(context.Background(), userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.LangSwedish, got.Language)
 }
@@ -32,24 +32,14 @@ func NewEnsemble(base, alt, fallback Backend, adj reconcile.Adjudicator, opts re
 	return &Ensemble{base: base, alt: alt, fallback: fallback, adj: adj, opts: opts}
 }
-// Plan implements uploads.Planner: the phases of a Swedish job, the two-engine one. The
+// Plan implements uploads.Planner: the phases this ensemble reports, so the page can
-// fallback is a phase only when one is configured.
+// show them before they run. The fallback is a phase only when one is configured.
-func (e *Ensemble) Plan() []progress.Planned { return e.PlanFor(domain.LangSwedish) }
+func (e *Ensemble) Plan() []progress.Planned {
-
+	plan := []progress.Planned{
-// PlanFor implements uploads.LanguagePlanner. A recording that is not Swedish never runs the
+		{Key: "engine_a", Label: "Transcribing with " + e.base.Name()},
-// base engine, the comparison or the decisions (transcribeOther), so the page lists only
+		{Key: "engine_b", Label: "Transcribing with " + e.alt.Name()},
-// what can run: the other engine, then the fallback if one is configured.
+		{Key: "compare", Label: "Comparing the two transcripts"},
-func (e *Ensemble) PlanFor(lang domain.Language) []progress.Planned {
+		{Key: "decide", Label: "Deciding the differences"},
 	var plan []progress.Planned
 	if lang == domain.LangSwedish || lang == "" {
 		plan = []progress.Planned{
 			{Key: "engine_a", Label: "Transcribing with " + e.base.Name()},
 			{Key: "engine_b", Label: "Transcribing with " + e.alt.Name()},
 			{Key: "compare", Label: "Comparing the two transcripts"},
 			{Key: "decide", Label: "Deciding the differences"},
 		}
 	} else {
 		plan = []progress.Planned{{Key: "engine_b", Label: "Transcribing with " + e.alt.Name()}}
 	}
 	if e.fallback != nil {
 		plan = append(plan, progress.Planned{Key: "fallback", Label: "Cloud fallback (" + e.fallback.Name() + ")"})
@@ -61,9 +51,6 @@ func (e *Ensemble) PlanFor(lang domain.Language) []progress.Planned {
 // progress.Reporter in ctx (a no-op when nobody listens).
 func (e *Ensemble) Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error) {
 	rep := progress.From(ctx)
 	if domain.LanguageFrom(ctx) != domain.LangSwedish {
 		return e.transcribeOther(ctx, rep, wavPath)
 	}
 	b, berr := e.run(ctx, rep, "engine_a", e.base, wavPath)
 	if err := ctx.Err(); err != nil {
 		return domain.Transcription{}, err
@@ -102,28 +89,6 @@ func (e *Ensemble) Transcribe(ctx context.Context, wavPath string) (domain.Trans
 	return e.single(f, e.fallback.Name(), "both local engines failed"), nil
 }
 // transcribeOther handles a recording that is not Swedish (tapir#61). The base engine is
 // Swedish-only, so it never receives the audio, and with one reading there is nothing to
 // reconcile: the other engine transcribes alone, then the cloud fallback if it fails and the
 // job is still live. The phases that did not run are shown as skipped by the tracker.
 func (e *Ensemble) transcribeOther(ctx context.Context, rep progress.Reporter, wavPath string) (domain.Transcription, error) {
 	t, err := e.run(ctx, rep, "engine_b", e.alt, wavPath)
 	if err == nil {
 		t.Endpoint = e.alt.Name()
 		return t, nil
 	}
 	if e.fallback == nil || ctx.Err() != nil {
 		return domain.Transcription{}, fmt.Errorf("%s: %w", e.alt.Name(), err)
 	}
 	f, ferr := e.run(ctx, rep, "fallback", e.fallback, wavPath)
 	if ferr != nil {
 		return domain.Transcription{}, errors.Join(
 			fmt.Errorf("%s: %w", e.alt.Name(), err), fmt.Errorf("%s: %w", e.fallback.Name(), ferr))
 	}
 	f.Endpoint = e.fallback.Name()
 	return f, nil
 }
 // run is one engine call, reported as a phase. A job that was stopped is not a broken
 // engine, so a cancelled context is never reported as a failed phase.
 func (e *Ensemble) run(ctx context.Context, rep progress.Reporter, key string, be Backend, wav string) (domain.Transcription, error) {
@@ -160,25 +160,3 @@ func TestEnsembleProgress_TheReconcileCountsAreNotedForTheOperator(t *testing.T)
 	assert.Equal(t, 0, n["unsure"])
 	assert.Equal(t, 0, n["errors"])
 }
 // An auto-language upload never runs the base engine, the comparison or the decisions, so the
 // page must not list them as coming (tapir#61, PR #62 review).
 func TestEnsemblePlanFor_AnAutoLanguageListsOnlyThePhasesThatCanRun(t *testing.T) {
 	with := newEnsemble("a", "a", nil, nil, true, &verdictAdj{}).e
 	without := newEnsemble("a", "a", nil, nil, false, &verdictAdj{}).e
 	keys := func(p []progress.Planned) []string {
 		var k []string
 		for _, s := range p {
 			k = append(k, s.Key)
 		}
 		return k
 	}
 	assert.Equal(t, []string{"engine_b", "fallback"}, keys(with.PlanFor(domain.LangAuto)))
 	assert.Equal(t, []string{"engine_b"}, keys(without.PlanFor(domain.LangAuto)), "no fallback configured: none promised")
 	assert.Equal(t, with.Plan(), with.PlanFor(domain.LangSwedish), "Swedish is the plan it always was")
 	assert.Contains(t, with.PlanFor(domain.LangAuto)[0].Label, "iguana/kb-whisper")
 	assert.Equal(t, with.Plan(), with.PlanFor(""), "a job queued before the choice existed is Swedish")
 	assert.Equal(t, with.PlanFor(domain.LangAuto), with.PlanFor(domain.Language("xx")),
 		"an unknown language is planned as it is run: not the Swedish phases")
 }
@@ -204,52 +204,3 @@ func TestEnsemble_AShutdownDuringTheSecondEngineIsAnErrorNotASingleEngineSuccess
 	assert.ErrorIs(t, err, context.Canceled, "a cancelled job must not be recorded as 'kb-whisper failed'")
 	assert.Empty(t, got.Text)
 }
 // The base engine is Swedish-only. A recording that is not Swedish must never reach it, and
 // there is no second opinion to reconcile: the other engine transcribes alone (tapir#61).
 func autoCtx() context.Context { return domain.WithLanguage(context.Background(), domain.LangAuto) }
 func TestEnsemble_AnAutoLanguageUploadNeverReachesTheBaseEngineAndIsNotReconciled(t *testing.T) {
 	adj := &verdictAdj{v: reconcile.VerdictAlt}
 	r := newEnsemble("base text", "alt text", nil, nil, true, adj)
 	got, err := r.e.Transcribe(autoCtx(), "/a.wav")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"iguana/kb-whisper"}, *r.calls, "only the other engine is called")
 	assert.Zero(t, adj.calls, "nothing is adjudicated")
 	assert.Equal(t, "alt text", got.Text)
 	assert.Equal(t, "iguana/kb-whisper", got.Endpoint)
 	assert.Nil(t, got.Reconciliation, "reconciliation does not apply, so none is recorded")
 }
 func TestEnsemble_AnAutoLanguageUploadFallsBackWhenItsEngineFailsAndStillSkipsTheBaseEngine(t *testing.T) {
 	r := newEnsemble("base text", "alt text", nil, errors.New("engine down"), true, &verdictAdj{})
 	got, err := r.e.Transcribe(autoCtx(), "/a.wav")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"iguana/kb-whisper", "berget/kb-whisper"}, *r.calls)
 	assert.Equal(t, "berget/kb-whisper", got.Endpoint)
 }
 func TestEnsemble_AnAutoLanguageUploadWithNoFallbackFailsWithoutTouchingTheBaseEngine(t *testing.T) {
 	r := newEnsemble("base text", "alt text", nil, errors.New("engine down"), false, &verdictAdj{})
 	_, err := r.e.Transcribe(autoCtx(), "/a.wav")
 	require.Error(t, err)
 	assert.Equal(t, []string{"iguana/kb-whisper"}, *r.calls)
 }
 func TestEnsemble_ACancelledAutoLanguageJobDoesNotReachTheFallback(t *testing.T) {
 	r := newEnsemble("base text", "alt text", nil, errors.New("engine down"), true, &verdictAdj{})
 	ctx, cancel := context.WithCancel(autoCtx())
 	cancel()
 	_, err := r.e.Transcribe(ctx, "/a.wav")
 	require.Error(t, err)
 	assert.NotContains(t, *r.calls, "berget/kb-whisper", "a stopped job must not ship its audio to a cloud endpoint")
 }
@@ -71,20 +71,9 @@ func (g *Gateway) Transcribe(ctx context.Context, path string) (domain.Transcrip
 		return domain.Transcription{}, fmt.Errorf("transcribe: stat audio: %w", err)
 	}
 	// The language is one request field and a closed set: sv is sent, auto sends nothing so
 	// the engine detects it, and anything else never leaves this process (tapir#61).
 	fields := [][2]string{{"model", g.model}, {"response_format", "verbose_json"}}
 	switch lang := domain.LanguageFrom(ctx); lang {
 	case domain.LangSwedish:
 		fields = append(fields, [2]string{"language", string(lang)})
 	case domain.LangAuto:
 	default:
 		return domain.Transcription{}, fmt.Errorf("transcribe: language %q is not one tapir sends", lang)
 	}
 	var prefix bytes.Buffer
 	mw := multipart.NewWriter(&prefix)
-	for _, kv := range fields {
+	for _, kv := range [][2]string{{"model", g.model}, {"response_format", "verbose_json"}, {"language", "sv"}} {
 		if err := mw.WriteField(kv[0], kv[1]); err != nil {
 			return domain.Transcription{}, fmt.Errorf("transcribe: build request: %w", err)
 		}
@@ -255,48 +255,3 @@ func TestGateway_AnErrorBodyIsBoundedToTwoHundredBytesInTheStatusError(t *testin
 	require.ErrorAs(t, err, &se)
 	assert.LessOrEqual(t, len(se.Snippet), 200, "a gateway's whole body must not become part of an error")
 }
 // The language travels on the context (tapir#61); the request field is the only place it
 // takes effect, so these observe the request the gateway fake received.
 func TestGateway_SendsLanguageSvWhenTheContextCarriesNoneAndForSwedish(t *testing.T) {
 	for name, ctx := range map[string]context.Context{
 		"no language in the context": context.Background(),
 		"swedish":                    domain.WithLanguage(context.Background(), domain.LangSwedish),
 	} {
 		t.Run(name, func(t *testing.T) {
 			var got seen
 			srv := serve(t, 200, verboseJSON, &got)
 			g := transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client())
 			_, err := g.Transcribe(ctx, wavFile(t, "RIFF-synthetic-pcm"))
 			require.NoError(t, err)
 			assert.Equal(t, "sv", got.fields["language"])
 		})
 	}
 }
 func TestGateway_OmitsTheLanguageFieldForAnAutoContextSoTheEngineDetectsIt(t *testing.T) {
 	var got seen
 	srv := serve(t, 200, verboseJSON, &got)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client())
 	_, err := g.Transcribe(domain.WithLanguage(context.Background(), domain.LangAuto), wavFile(t, "RIFF-synthetic-pcm"))
 	require.NoError(t, err)
 	_, present := got.fields["language"]
 	assert.False(t, present, "an auto upload must not be forced to Swedish")
 	assert.Equal(t, "iguana/kb-whisper", got.fields["model"], "the rest of the request is unchanged")
 }
 func TestGateway_ALanguageOutsideTheClosedSetIsRefusedBeforeAnythingIsSent(t *testing.T) {
 	var got seen
 	srv := serve(t, 200, verboseJSON, &got)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client())
 	_, err := g.Transcribe(domain.WithLanguage(context.Background(), domain.Language("en")), wavFile(t, "RIFF-synthetic-pcm"))
 	require.Error(t, err)
 	assert.Empty(t, got.method, "no request may reach the engine with a language the closed set does not hold")
 }
@@ -102,45 +102,3 @@ func TestEnsemble_AHungEngineIsASoftFailureAndTheOtherEnginesTextIsUsed(t *testi
 	assert.Contains(t, got.Reconciliation.Reason, "timeout")
 	assert.False(t, errors.Is(err, context.DeadlineExceeded))
 }
 // WithTimeout sits in front of both local engines in production (cmd/tapir/uploads.go). It
 // must hand the engine the job's context, not a fresh one: the language and the
 // cancellation both travel on it (tapir#61).
 func TestWithTimeout_TheEngineStillReceivesTheLanguageOfTheJob(t *testing.T) {
 	for name, tt := range map[string]struct {
 		ctx       context.Context
 		wantField bool
 	}{
 		"auto leaves the field out": {domain.WithLanguage(context.Background(), domain.LangAuto), false},
 		"swedish sends sv":          {domain.WithLanguage(context.Background(), domain.LangSwedish), true},
 	} {
 		t.Run(name, func(t *testing.T) {
 			var got seen
 			srv := serve(t, 200, verboseJSON, &got)
 			b := transcribe.WithTimeout(transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client()), time.Minute)
 			_, err := b.Transcribe(tt.ctx, wavFile(t, "RIFF-synthetic-pcm"))
 			require.NoError(t, err)
 			lang, present := got.fields["language"]
 			assert.Equal(t, tt.wantField, present)
 			if tt.wantField {
 				assert.Equal(t, "sv", lang)
 			}
 		})
 	}
 }
 func TestWithTimeout_ACancelledJobIsNotRestartedByTheWrapper(t *testing.T) {
 	var got seen
 	srv := serve(t, 200, verboseJSON, &got)
 	b := transcribe.WithTimeout(transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client()), time.Minute)
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	_, err := b.Transcribe(ctx, wavFile(t, "RIFF-synthetic-pcm"))
 	require.Error(t, err)
 	assert.Empty(t, got.method, "a cancelled job must not send its audio anywhere through the wrapper")
 }
@@ -243,12 +243,9 @@ const (
 // never stored in, or merged with, the shared public-caption Transcript (ADR-021).
 // Content and Segments are empty until Status is UploadDone.
 type UploadedTranscript struct {
-	ID     string
+	ID           string
-	UserID string
+	UserID       string
-	Title  string
+	Title        string
 	// Language is what the upload was (or will be) transcribed as: sv, or auto for
 	// "Other" (tapir#61).
 	Language     Language
 	Status       UploadStatus
 	Content      string
 	Segments     []Segment
@@ -1,47 +0,0 @@
 package domain
 import "context"
 // Language is the spoken language an upload is transcribed as. It is chosen by the user on
 // the upload form and reaches the engines as one request field, so it is a closed set,
 // never free text (tapir#61).
 type Language string
 const (
 	// LangSwedish sends language=sv: the Swedish engines' own language, and what every
 	// upload was transcribed as before the choice existed.
 	LangSwedish Language = "sv"
 	// LangAuto sends no language, so the engine detects it. It is what "Other" on the form
 	// means: the Swedish-only engines are not used for it.
 	LangAuto Language = "auto"
 )
 // ParseLanguage reads a form value. An empty value is Swedish (a client that predates the
 // field); anything that is not exactly a known value is refused rather than normalised.
 func ParseLanguage(s string) (Language, bool) {
 	switch Language(s) {
 	case "", LangSwedish:
 		return LangSwedish, true
 	case LangAuto:
 		return LangAuto, true
 	}
 	return "", false
 }
 type languageKey struct{}
 // WithLanguage returns a context that carries the language of the job it serves. The
 // Transcriber interface does not change: engines read it with LanguageFrom, the same way
 // they read the progress Reporter (ADR-035).
 func WithLanguage(ctx context.Context, l Language) context.Context {
 	return context.WithValue(ctx, languageKey{}, l)
 }
 // LanguageFrom returns the language carried by ctx, or Swedish when it carries none, so a
 // caller that sets nothing behaves as it always did.
 func LanguageFrom(ctx context.Context) Language {
 	if l, ok := ctx.Value(languageKey{}).(Language); ok && l != "" {
 		return l
 	}
 	return LangSwedish
 }
@@ -1,41 +0,0 @@
 package domain_test
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 func TestParseLanguage_KnownValuesAndEmptyAreAcceptedEverythingElseIsNot(t *testing.T) {
 	tests := []struct {
 		in     string
 		want   domain.Language
 		wantOK bool
 	}{
 		{"sv", domain.LangSwedish, true},
 		{"auto", domain.LangAuto, true},
 		{"", domain.LangSwedish, true}, // a client that sends no field keeps today's behaviour
 		{"SV", "", false},              // exact match: the value reaches a request field
 		{" sv", "", false},
 		{"sv\n", "", false},
 		{"en", "", false}, // a specific other language is not offered yet
 		{"sv,en", "", false},
 		{"../sv", "", false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.in, func(t *testing.T) {
 			got, ok := domain.ParseLanguage(tt.in)
 			assert.Equal(t, tt.wantOK, ok)
 			assert.Equal(t, tt.want, got)
 		})
 	}
 }
 func TestLanguageFrom_IsSwedishWhenTheContextCarriesNoneAndOtherwiseWhatWasSet(t *testing.T) {
 	assert.Equal(t, domain.LangSwedish, domain.LanguageFrom(context.Background()))
 	ctx := domain.WithLanguage(context.Background(), domain.LangAuto)
 	assert.Equal(t, domain.LangAuto, domain.LanguageFrom(ctx))
 }
@@ -37,13 +37,12 @@ type Reporter interface {
 // is for people, so a failed write is logged and never stops the job.
 type Sink interface {
 	SaveProgress(ctx context.Context, steps []domain.ProgressStep, at time.Time) error
-	Beat(ctx context.Context, at time.Time) error
+	Beat(ctx context.Context) error
 }
 const (
-	defaultMinSave     = 2 * time.Second
+	defaultMinSave = 2 * time.Second
-	defaultSaveTimeout = 5 * time.Second
+	logAdvanceEach = time.Minute
 	logAdvanceEach     = time.Minute
 )
 // Option tunes a Tracker.
@@ -56,14 +55,6 @@ func WithClock(now func() time.Time) Option { return func(t *Tracker) { t.now =
 // Done, Fail and Finish always save.
 func WithMinSave(d time.Duration) Option { return func(t *Tracker) { t.minSave = d } }
 // WithSaveTimeout bounds one save or heartbeat write. Progress is cosmetic, so a database
 // that stops answering costs a dropped write rather than an unbounded stall. It is still a
 // delay: saves run under the tracker's lock, which Begin and Advance (called by the engines)
 // need, so each transition can wait up to this long, and a hung database slows a job by
 // that much per call, out of the job's own time budget (#51). A dropped final save is not
 // retried; the row keeps its last saved step.
 func WithSaveTimeout(d time.Duration) Option { return func(t *Tracker) { t.saveTimeout = d } }
 // Tracker implements Reporter for one job.
 type Tracker struct {
 	ctx     context.Context
@@ -72,8 +63,6 @@ type Tracker struct {
 	now     func() time.Time
 	minSave time.Duration
 	saveTimeout time.Duration
 	mu              sync.Mutex
 	steps           []domain.ProgressStep
 	lastAdvanceSave time.Time
@@ -83,7 +72,7 @@ type Tracker struct {
 // NewTracker plans a job's phases. ctx is used for the saves, so it should outlive the
 // job's own timeout: a job that timed out still gets its failure recorded.
 func NewTracker(ctx context.Context, sink Sink, log *slog.Logger, plan []Planned, opts ...Option) *Tracker {
-	t := &Tracker{ctx: ctx, sink: sink, log: log, now: time.Now, minSave: defaultMinSave, saveTimeout: defaultSaveTimeout}
+	t := &Tracker{ctx: ctx, sink: sink, log: log, now: time.Now, minSave: defaultMinSave}
 	for _, o := range opts {
 		o(t)
 	}
@@ -223,10 +212,7 @@ func (t *Tracker) Heartbeat(ctx context.Context, beatEvery, stillEvery time.Dura
 		case <-ctx.Done():
 			return
 		case <-beat.C:
-			beatCtx, cancel := context.WithTimeout(ctx, t.saveTimeout)
+			if err := t.sink.Beat(ctx); err != nil && ctx.Err() == nil {
 			err := t.sink.Beat(beatCtx, t.now())
 			cancel()
 			if err != nil && ctx.Err() == nil {
 				t.log.Warn("progress: heartbeat not saved", "err", err)
 			}
 		case <-still.C:
@@ -268,9 +254,7 @@ func (t *Tracker) find(key string) *domain.ProgressStep {
 // dropped: progress is cosmetic and must never fail the job it describes.
 func (t *Tracker) save() {
 	snapshot := append([]domain.ProgressStep(nil), t.steps...)
-	ctx, cancel := context.WithTimeout(t.ctx, t.saveTimeout)
+	if err := t.sink.SaveProgress(t.ctx, snapshot, t.now()); err != nil && t.ctx.Err() == nil {
 	defer cancel()
 	if err := t.sink.SaveProgress(ctx, snapshot, t.now()); err != nil && t.ctx.Err() == nil {
 		t.log.Warn("progress: not saved", "err", err)
 	}
 }
@@ -1,154 +0,0 @@
 package progress_test
 // Observes what a database that stops answering does to the job it reports on (#51):
 // progress is cosmetic, so a save that never returns must not stall the engine calls that
 // report through the tracker, nor the heartbeat that says the process is alive.
 import (
 	"bytes"
 	"context"
 	"log/slog"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/progress"
 )
 // stallSink never answers until its context ends, like a database connection that hung.
 type stallSink struct{ beats atomic.Int32 }
 func (s *stallSink) SaveProgress(ctx context.Context, _ []domain.ProgressStep, _ time.Time) error {
 	<-ctx.Done()
 	return ctx.Err()
 }
 func (s *stallSink) Beat(ctx context.Context, _ time.Time) error {
 	s.beats.Add(1)
 	<-ctx.Done()
 	return ctx.Err()
 }
 type lockedBuf struct {
 	mu sync.Mutex
 	b  bytes.Buffer
 }
 func (l *lockedBuf) Write(p []byte) (int, error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	return l.b.Write(p)
 }
 func (l *lockedBuf) String() string {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	return l.b.String()
 }
 func stallTracker(sink progress.Sink, buf *lockedBuf) *progress.Tracker {
 	log := slog.New(slog.NewTextHandler(buf, nil))
 	return progress.NewTracker(context.Background(), sink, log,
 		[]progress.Planned{{Key: "a", Label: "A"}}, progress.WithSaveTimeout(50*time.Millisecond))
 }
 func TestTracker_AHungSaveDoesNotBlockTheReporterPastItsTimeout(t *testing.T) {
 	buf := &lockedBuf{}
 	tr := stallTracker(&stallSink{}, buf)
 	done := make(chan struct{})
 	go func() { tr.Begin("a", 0); tr.Advance("a", 1); tr.Done("a"); close(done) }()
 	select {
 	case <-done:
 	case <-time.After(3 * time.Second):
 		t.Fatal("the reporter was blocked by a save that never returned")
 	}
 	require.Contains(t, buf.String(), "progress: not saved", "a dropped save is logged")
 }
 func TestTracker_AHungBeatDoesNotStopTheHeartbeat(t *testing.T) {
 	sink := &stallSink{}
 	tr := stallTracker(sink, &lockedBuf{})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go tr.Heartbeat(ctx, 5*time.Millisecond, time.Hour)
 	require.Eventually(t, func() bool { return sink.beats.Load() >= 3 }, 3*time.Second, 5*time.Millisecond,
 		"each beat is abandoned at its timeout and the next one is tried")
 }
 func TestTracker_TheStillRunningLineIsNotHeldUpBehindAHungSave(t *testing.T) {
 	buf := &lockedBuf{}
 	tr := stallTracker(&stallSink{}, buf)
 	go tr.Begin("a", 0) // holds the tracker's lock inside a save that hangs until its timeout
 	time.Sleep(10 * time.Millisecond)
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go tr.Heartbeat(ctx, time.Hour, 5*time.Millisecond)
 	require.Eventually(t, func() bool { return strings.Contains(buf.String(), "still running") }, 3*time.Second, 5*time.Millisecond)
 }
 // deadlineSink records how long each write was given, and answers at once.
 type deadlineSink struct {
 	mu     sync.Mutex
 	saves  []time.Duration
 	beats  []time.Duration
 	noDLOK bool
 }
 func (d *deadlineSink) record(ctx context.Context, into *[]time.Duration) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	dl, ok := ctx.Deadline()
 	if !ok {
 		d.noDLOK = true
 		return
 	}
 	*into = append(*into, time.Until(dl))
 }
 func (d *deadlineSink) SaveProgress(ctx context.Context, _ []domain.ProgressStep, _ time.Time) error {
 	d.record(ctx, &d.saves)
 	return nil
 }
 func (d *deadlineSink) Beat(ctx context.Context, _ time.Time) error {
 	d.record(ctx, &d.beats)
 	return nil
 }
 // The production value is the one the worker gets: it builds a Tracker without options.
 // A zero or tiny default would drop every write, a huge one would bound nothing.
 func TestTracker_TheDefaultSaveAndBeatDeadlineIsAFewSecondsAway(t *testing.T) {
 	sink := &deadlineSink{}
 	tr := progress.NewTracker(context.Background(), sink, slog.New(slog.NewTextHandler(&lockedBuf{}, nil)),
 		[]progress.Planned{{Key: "a", Label: "A"}})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go tr.Heartbeat(ctx, 5*time.Millisecond, time.Hour)
 	tr.Begin("a", 0)
 	require.Eventually(t, func() bool {
 		sink.mu.Lock()
 		defer sink.mu.Unlock()
 		return len(sink.beats) > 0
 	}, 3*time.Second, 5*time.Millisecond)
 	sink.mu.Lock()
 	defer sink.mu.Unlock()
 	require.False(t, sink.noDLOK, "a write was given no deadline at all")
 	require.NotEmpty(t, sink.saves)
 	for _, d := range append(append([]time.Duration{}, sink.saves...), sink.beats...) {
 		require.Greater(t, d, time.Second, "the deadline is already (nearly) spent when the write starts")
 		require.LessOrEqual(t, d, 5*time.Second, "the default bound is 5 s")
 	}
 }
@@ -17,12 +17,11 @@ import (
 // fakeSink records every saved snapshot and every heartbeat.
 type fakeSink struct {
-	mu     sync.Mutex
+	mu    sync.Mutex
-	saves  [][]domain.ProgressStep
+	saves [][]domain.ProgressStep
-	at     []time.Time
+	at    []time.Time
-	beats  int
+	beats int
-	beatAt []time.Time
+	err   error
 	err    error
 }
 func (f *fakeSink) SaveProgress(_ context.Context, steps []domain.ProgressStep, at time.Time) error {
@@ -33,11 +32,10 @@ func (f *fakeSink) SaveProgress(_ context.Context, steps []domain.ProgressStep,
 	return f.err
 }
-func (f *fakeSink) Beat(_ context.Context, at time.Time) error {
+func (f *fakeSink) Beat(context.Context) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.beats++
 	f.beatAt = append(f.beatAt, at)
 	return f.err
 }
@@ -299,7 +297,7 @@ func (r *retainingSink) SaveProgress(_ context.Context, steps []domain.ProgressS
 	r.got = append(r.got, steps)
 	return nil
 }
-func (r *retainingSink) Beat(context.Context, time.Time) error { return nil }
+func (r *retainingSink) Beat(context.Context) error { return nil }
 func TestTracker_ASnapshotHandedToTheSinkIsNotChangedByLaterTransitions(t *testing.T) {
 	sink := &retainingSink{}
@@ -402,20 +400,3 @@ func TestTracker_AnnotateAttachesANoteToAStepAndSavesItAtOnce(t *testing.T) {
 	require.Equal(t, "20 min of the 79 the file claimed", sink.last(t)[0].Note)
 	require.NotPanics(t, func() { tr.Annotate("no-such-step", "x") })
 }
 func TestTracker_BeatIsStampedWithTheTrackersClock(t *testing.T) {
 	// alive_at used the database's NOW() while the page compared it with the application
 	// clock; a skewed database clock showed a healthy job as lost (#51).
 	tr, sink, clk, _ := newTracker(t)
 	clk.tick(42 * time.Second)
 	want := clk.now()
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go tr.Heartbeat(ctx, 5*time.Millisecond, time.Hour)
 	require.Eventually(t, func() bool { return sink.beatCount() >= 1 }, 2*time.Second, 5*time.Millisecond)
 	sink.mu.Lock()
 	defer sink.mu.Unlock()
 	require.True(t, sink.beatAt[0].Equal(want), "beat stamped %v, the tracker's clock says %v", sink.beatAt[0], want)
 }
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"os"
 	"sync"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
@@ -25,7 +24,7 @@ type Prober interface {
 // Store is the slice of the private transcript store the intake needs.
 type Store interface {
-	CreateUpload(ctx context.Context, userID, title string, lang domain.Language, hadVideo bool) (string, error)
+	CreateUpload(ctx context.Context, userID, title string, hadVideo bool) (string, error)
 	FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error
 }
@@ -35,9 +34,6 @@ type Job struct {
 	UserID   string
 	UploadID string
 	Path     string
 	// Language is what the user chose for this recording; empty means Swedish (a job
 	// queued before the choice existed).
 	Language domain.Language
 	// Duration is what the file CLAIMED when probed. The worker compares it with what
 	// was really converted; zero means unknown (ADR-035 review).
 	Duration time.Duration
@@ -55,53 +51,6 @@ type Intake struct {
 	sub    Submitter
 	limits Limits
 	tmpDir string
 	// MaxReceives and MaxReceivesPerUser bound how many request bodies Accept reads at
 	// once; zero means the defaults. Without them N parallel POSTs each spool up to
 	// MaxBytes while the queue still looks empty, and the spool volume fills (#47).
 	MaxReceives        int
 	MaxReceivesPerUser int
 	mu       sync.Mutex
 	receives int
 	byUser   map[string]int
 }
 const (
 	defaultMaxReceives        = 4
 	defaultMaxReceivesPerUser = 2
 )
 // acquireReceive reserves a receive slot for userID, or reports there is none. Every
 // successful call must be paired with releaseReceive.
 func (in *Intake) acquireReceive(userID string) bool {
 	maxAll, maxUser := in.MaxReceives, in.MaxReceivesPerUser
 	if maxAll <= 0 {
 		maxAll = defaultMaxReceives
 	}
 	if maxUser <= 0 {
 		maxUser = defaultMaxReceivesPerUser
 	}
 	in.mu.Lock()
 	defer in.mu.Unlock()
 	if in.receives >= maxAll || in.byUser[userID] >= maxUser {
 		return false
 	}
 	if in.byUser == nil {
 		in.byUser = map[string]int{}
 	}
 	in.receives++
 	in.byUser[userID]++
 	return true
 }
 func (in *Intake) releaseReceive(userID string) {
 	in.mu.Lock()
 	defer in.mu.Unlock()
 	in.receives--
 	if in.byUser[userID]--; in.byUser[userID] <= 0 {
 		delete(in.byUser, userID)
 	}
 }
 // NewIntake wires an Intake. tmpDir is where uploads are spooled; it must exist.
@@ -138,18 +87,13 @@ const busyMessage = "Too many recordings are waiting to be transcribed. Please t
 // validation yields a *RejectError and creates NO row — rejection is synchronous
 // and leaves nothing behind. On success the temp file is handed to the job and the
 // worker deletes it; on every failure path Accept deletes it itself.
-func (in *Intake) Accept(ctx context.Context, userID, title string, lang domain.Language, src io.Reader) (string, error) {
+func (in *Intake) Accept(ctx context.Context, userID, title string, src io.Reader) (string, error) {
 	// Refuse before spooling when the queue has no room, if the submitter can say so: a full
 	// queue otherwise cost up to the upload cap on disk, an ffprobe run and a failed row for
 	// every refused attempt.
 	if rc, ok := in.sub.(interface{ HasRoom(userID string) bool }); ok && !rc.HasRoom(userID) {
 		return "", &RejectError{Reason: ReasonBusy, Message: busyMessage}
 	}
 	// HasRoom cannot see bodies still being received; bound those separately.
 	if !in.acquireReceive(userID) {
 		return "", &RejectError{Reason: ReasonBusy, Message: busyMessage}
 	}
 	defer in.releaseReceive(userID)
 	f, err := os.CreateTemp(in.tmpDir, "upload-*")
 	if err != nil {
 		return "", fmt.Errorf("uploads: spool: %w", err)
@@ -193,11 +137,11 @@ func (in *Intake) Accept(ctx context.Context, userID, title string, lang domain.
 		return "", err
 	}
-	id, err := in.store.CreateUpload(ctx, userID, title, lang, probe.HasVideo)
+	id, err := in.store.CreateUpload(ctx, userID, title, probe.HasVideo)
 	if err != nil {
 		return "", fmt.Errorf("uploads: create: %w", err)
 	}
-	if err := in.sub.Submit(Job{UserID: userID, UploadID: id, Path: path, Language: lang, Duration: probe.Duration}); err != nil {
+	if err := in.sub.Submit(Job{UserID: userID, UploadID: id, Path: path, Duration: probe.Duration}); err != nil {
 		if errors.Is(err, ErrQueueFull) {
 			// The user's to retry, not a server fault: refuse it as such, and do not leave
 			// the row queued -- that is the stuck spinner.
@@ -23,7 +23,7 @@ func TestAccept_AFullQueueIsABusyRejectionNotAServerErrorAndLeavesNothingBehind(
 	r := newRig(t)
 	r.sub.err = uploads.ErrQueueFull
-	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	var rej *uploads.RejectError
 	require.True(t, errors.As(err, &rej), "a full queue must be a rejection the web layer can answer with 429: %v", err)
@@ -48,7 +48,7 @@ func TestAccept_ANoRoomQueueIsRefusedBeforeAnythingIsSpooledProbedOrStored(t *te
 	full := &roomSubmitter{room: false}
 	in := uploads.NewIntake(r.st, r.pr, full, uploads.Limits{MaxBytes: 1024, MaxDuration: 90 * time.Minute}, r.tmp)
-	_, err := in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+	_, err := in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	var rej *uploads.RejectError
 	require.True(t, errors.As(err, &rej))
@@ -62,7 +62,7 @@ func TestAccept_ANoRoomQueueIsRefusedBeforeAnythingIsSpooledProbedOrStored(t *te
 func TestAccept_ASubmitterThatCannotSayStillWorksAsBefore(t *testing.T) {
 	r := newRig(t)
-	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	require.NoError(t, err, "a Submitter without HasRoom is accepted: the check at Submit remains")
 }
@@ -81,7 +81,7 @@ func (b *brokenBody) Read(p []byte) (int, error) {
 func TestAccept_AnErrorReadingTheClientsBodyIsMarkedAsTheClientsAndAWrappedSubmitErrorIsNot(t *testing.T) {
 	r := newRig(t)
-	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, &brokenBody{n: 1})
+	_, err := r.in.Accept(context.Background(), "user-1", "t", &brokenBody{n: 1})
 	require.Error(t, err)
 	assert.ErrorIs(t, err, uploads.ErrClientRead, "a dropped client body is the sender's to retry")
@@ -90,7 +90,7 @@ func TestAccept_AnErrorReadingTheClientsBodyIsMarkedAsTheClientsAndAWrappedSubmi
 	// A fault that is ours must NOT carry the marker, even if it wraps the same sentinel.
 	r2 := newRig(t)
 	r2.sub.err = fmt.Errorf("db: %w", io.ErrUnexpectedEOF)
-	_, err = r2.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+	_, err = r2.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	require.Error(t, err)
 	assert.NotErrorIs(t, err, uploads.ErrClientRead)
 }
@@ -1,132 +0,0 @@
 package uploads_test
 // Observes how many request bodies Accept will read at once (#47). HasRoom and the
 // per-user queue cap act before and after the receive; N parallel POSTs all pass
 // HasRoom while the queue is still empty, so the receive itself is bounded.
 import (
 	"context"
 	"errors"
 	"io"
 	"strings"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // slowReceive starts an Accept whose body stays open until the returned writer is closed,
 // and waits until it holds a spool file, which proves it is inside the receive.
 type slowReceive struct {
 	w        *io.PipeWriter
 	done     chan error
 	finished bool
 }
 func startSlowReceive(t *testing.T, r *rig, in *uploads.Intake, user string, wantFiles int) *slowReceive {
 	t.Helper()
 	pr, pw := io.Pipe()
 	s := &slowReceive{w: pw, done: make(chan error, 1)}
 	go func() {
 		_, err := in.Accept(context.Background(), user, "t", domain.LangSwedish, pr)
 		s.done <- err
 	}()
 	require.Eventually(t, func() bool { return len(r.tmpFiles(t)) == wantFiles }, 2*time.Second, 5*time.Millisecond,
 		"the receive for %s should have started", user)
 	// An abandoned receive ends in a read error, so it never reaches the rig's fakes, which
 	// are not safe for concurrent use. A receive that finish() already ended is a no-op.
 	t.Cleanup(func() {
 		if s.finished {
 			return
 		}
 		_ = pw.CloseWithError(errors.New("test over"))
 		select {
 		case <-s.done:
 		case <-time.After(2 * time.Second):
 		}
 	})
 	return s
 }
 func (s *slowReceive) finish(t *testing.T) error {
 	t.Helper()
 	_, _ = s.w.Write([]byte("data"))
 	require.NoError(t, s.w.Close())
 	s.finished = true
 	select {
 	case err := <-s.done:
 		return err
 	case <-time.After(2 * time.Second):
 		t.Fatal("Accept did not return after its body ended")
 		return nil
 	}
 }
 func requireBusy(t *testing.T, err error) {
 	t.Helper()
 	var rej *uploads.RejectError
 	require.True(t, errors.As(err, &rej), "want a busy rejection, got %v", err)
 	assert.Equal(t, uploads.ReasonBusy, rej.Reason)
 }
 func TestAccept_APerUserLimitOnConcurrentReceivesRefusesTheNextBodyBeforeSpoolingIt(t *testing.T) {
 	r := newRig(t)
 	in := uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: time.Hour}, r.tmp)
 	in.MaxReceivesPerUser = 2
 	in.MaxReceives = 10
 	startSlowReceive(t, r, in, "user-1", 1)
 	startSlowReceive(t, r, in, "user-1", 2)
 	_, err := in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
 	requireBusy(t, err)
 	assert.Len(t, r.tmpFiles(t), 2, "the refused body was never spooled")
 	// Another user is not blocked by user-1's two receives.
 	other := startSlowReceive(t, r, in, "user-2", 3)
 	require.NoError(t, other.finish(t))
 }
 func TestAccept_AnOverallLimitOnConcurrentReceivesRefusesTheNextUser(t *testing.T) {
 	r := newRig(t)
 	in := uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: time.Hour}, r.tmp)
 	in.MaxReceivesPerUser = 5
 	in.MaxReceives = 3
 	for i, u := range []string{"a", "b", "c"} {
 		startSlowReceive(t, r, in, u, i+1)
 	}
 	_, err := in.Accept(context.Background(), "d", "t", domain.LangSwedish, strings.NewReader("data"))
 	requireBusy(t, err)
 	assert.Len(t, r.tmpFiles(t), 3)
 }
 func TestAccept_AFinishedReceiveFreesItsSlot(t *testing.T) {
 	r := newRig(t)
 	in := uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: time.Hour}, r.tmp)
 	in.MaxReceivesPerUser = 1
 	in.MaxReceives = 5
 	first := startSlowReceive(t, r, in, "user-1", 1)
 	require.NoError(t, first.finish(t))
 	_, err := in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
 	require.NoError(t, err, "the slot is released when Accept returns")
 }
 func TestAccept_AFailedReceiveFreesItsSlot(t *testing.T) {
 	r := newRig(t)
 	in := uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: time.Hour}, r.tmp)
 	in.MaxReceivesPerUser = 1
 	in.MaxReceives = 5
 	_, err := in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, &brokenBody{n: 1})
 	require.ErrorIs(t, err, uploads.ErrClientRead)
 	_, err = in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
 	require.NoError(t, err, "a dropped client must not leak a slot")
 }
@@ -1,32 +0,0 @@
 package uploads_test
 // The limits production runs on are the DEFAULTS: nothing outside tests sets
 // MaxReceives or MaxReceivesPerUser. Pinned here with the literal numbers, so changing a
 // default is a visible decision (#47 review). With 4 receives, 20 queued and 1 running at
 // the 200 MiB cap, the spool needs ~5 GiB of the 6 Gi emptyDir (infra); raising any of
 // them or TAPIR_UPLOAD_MAX_BYTES must revisit that arithmetic.
 import (
 	"context"
 	"strings"
 	"testing"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 func TestNewIntake_DefaultsAllowTwoReceivesPerUserAndFourOverall(t *testing.T) {
 	r := newRig(t)
 	in := uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: time.Hour}, r.tmp)
 	startSlowReceive(t, r, in, "a", 1)
 	startSlowReceive(t, r, in, "a", 2)
 	_, err := in.Accept(context.Background(), "a", "t", domain.LangSwedish, strings.NewReader("x"))
 	requireBusy(t, err) // a third body from one user
 	startSlowReceive(t, r, in, "b", 3)
 	startSlowReceive(t, r, in, "b", 4)
 	_, err = in.Accept(context.Background(), "c", "t", domain.LangSwedish, strings.NewReader("x"))
 	requireBusy(t, err) // a fifth body overall
 }
@@ -21,15 +21,13 @@ import (
 type fakeStore struct {
 	created  []string // titles
 	langs    []domain.Language
 	hadVideo []bool
 	failed   map[string]domain.UploadErrorKind
 	nextID   string
 }
-func (f *fakeStore) CreateUpload(_ context.Context, _, title string, lang domain.Language, hadVideo bool) (string, error) {
+func (f *fakeStore) CreateUpload(_ context.Context, _, title string, hadVideo bool) (string, error) {
 	f.created = append(f.created, title)
 	f.langs = append(f.langs, lang)
 	f.hadVideo = append(f.hadVideo, hadVideo)
 	return f.nextID, nil
 }
@@ -100,7 +98,7 @@ func TestAccept_ValidAudioIsStoredProbedQueuedAndSubmitted(t *testing.T) {
 	r := newRig(t)
 	audio := bytes.Repeat([]byte("a"), 500)
-	id, err := r.in.Accept(context.Background(), "user-1", "Teams export", domain.LangSwedish, bytes.NewReader(audio))
+	id, err := r.in.Accept(context.Background(), "user-1", "Teams export", bytes.NewReader(audio))
 	require.NoError(t, err)
 	assert.Equal(t, "up-1", id)
@@ -108,7 +106,7 @@ func TestAccept_ValidAudioIsStoredProbedQueuedAndSubmitted(t *testing.T) {
 	assert.Equal(t, audio, r.pr.seen, "the prober must see the complete uploaded bytes, on disk")
 	require.Len(t, r.sub.jobs, 1)
 	job := r.sub.jobs[0]
-	assert.Equal(t, uploads.Job{UserID: "user-1", UploadID: "up-1", Path: job.Path, Duration: 10 * time.Minute, Language: domain.LangSwedish}, job,
+	assert.Equal(t, uploads.Job{UserID: "user-1", UploadID: "up-1", Path: job.Path, Duration: 10 * time.Minute}, job,
 		"the job carries what the file CLAIMED, so the worker can compare it with what was converted")
 	assert.Equal(t, filepath.Dir(job.Path), r.tmp, "the temp file lives in the configured directory")
 	got, err := os.ReadFile(job.Path)
@@ -119,7 +117,7 @@ func TestAccept_ValidAudioIsStoredProbedQueuedAndSubmitted(t *testing.T) {
 func TestAccept_OversizeBodyIsRejectedAndLeavesNothingBehind(t *testing.T) {
 	r := newRig(t)
-	_, err := r.in.Accept(context.Background(), "user-1", "big", domain.LangSwedish, strings.NewReader(strings.Repeat("a", 1025)))
+	_, err := r.in.Accept(context.Background(), "user-1", "big", strings.NewReader(strings.Repeat("a", 1025)))
 	var rej *uploads.RejectError
 	require.True(t, errors.As(err, &rej))
@@ -134,7 +132,7 @@ func TestAccept_OversizeBodyIsRejectedAndLeavesNothingBehind(t *testing.T) {
 func TestAccept_BodyExactlyAtTheLimitIsAccepted(t *testing.T) {
 	r := newRig(t)
-	_, err := r.in.Accept(context.Background(), "user-1", "edge", domain.LangSwedish, strings.NewReader(strings.Repeat("a", 1024)))
+	_, err := r.in.Accept(context.Background(), "user-1", "edge", strings.NewReader(strings.Repeat("a", 1024)))
 	require.NoError(t, err)
 }
@@ -154,7 +152,7 @@ func TestAccept_ProbeVerdictRejectsWithoutRowAndRemovesTheFile(t *testing.T) {
 			r := newRig(t)
 			r.pr.probe = tt.probe
-			_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+			_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 			var rej *uploads.RejectError
 			require.True(t, errors.As(err, &rej))
@@ -171,7 +169,7 @@ func TestAccept_UnreadableFileIsARejectionButAProberFaultIsAnError(t *testing.T)
 		r := newRig(t)
 		r.pr.err = uploads.ErrUnreadable
-		_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("not media"))
+		_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("not media"))
 		var rej *uploads.RejectError
 		require.True(t, errors.As(err, &rej), "the user's file is the problem: tell them")
@@ -182,7 +180,7 @@ func TestAccept_UnreadableFileIsARejectionButAProberFaultIsAnError(t *testing.T)
 		r := newRig(t)
 		r.pr.err = errors.New("exec: ffprobe: executable file not found")
-		_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+		_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 		require.Error(t, err)
 		var rej *uploads.RejectError
@@ -196,7 +194,7 @@ func TestAccept_ClientDisconnectMidUploadLeavesNothingBehind(t *testing.T) {
 	r := newRig(t)
 	body := io.MultiReader(strings.NewReader("partial"), iotest.ErrReader(errors.New("client went away")))
-	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, body)
+	_, err := r.in.Accept(context.Background(), "user-1", "t", body)
 	require.Error(t, err)
 	assert.Empty(t, r.pr.paths)
@@ -208,7 +206,7 @@ func TestAccept_SubmitFailureFailsTheRowHonestlyAndRemovesTheFile(t *testing.T)
 	r := newRig(t)
 	r.sub.err = errors.New("worker stopped")
-	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	require.Error(t, err)
 	assert.Equal(t, domain.UploadErrInterrupted, r.st.failed["up-1"],
@@ -230,7 +228,7 @@ func TestAccept_AFileWithAVideoTrackIsAcceptedAndRecordsThatItHadOne(t *testing.
 			r := newRig(t)
 			r.pr.probe = tt.probe
-			id, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangSwedish, strings.NewReader("data"))
+			id, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 			require.NoError(t, err)
 			assert.Equal(t, "up-1", id)
@@ -240,14 +238,3 @@ func TestAccept_AFileWithAVideoTrackIsAcceptedAndRecordsThatItHadOne(t *testing.
 		})
 	}
 }
 func TestAccept_TheChosenLanguageIsStoredAndHandedToTheJob(t *testing.T) {
 	r := newRig(t)
 	_, err := r.in.Accept(context.Background(), "user-1", "t", domain.LangAuto, strings.NewReader("data"))
 	require.NoError(t, err)
 	assert.Equal(t, []domain.Language{domain.LangAuto}, r.st.langs, "the row records what the user chose")
 	require.Len(t, r.sub.jobs, 1)
 	assert.Equal(t, domain.LangAuto, r.sub.jobs[0].Language, "the worker is told, so the engines are")
 }
@@ -1,48 +0,0 @@
 package uploads
 // Observes what jobSink hands the store: the heartbeat's timestamp is the one the tracker
 // stamped (its application clock), not a second reading taken here (#51).
 import (
 	"context"
 	"testing"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 type atStore struct{ beatAt, saveAt time.Time }
 func (*atStore) StartTranscribing(context.Context, string, string) error { return nil }
 func (*atStore) CompleteUpload(context.Context, string, string, domain.Transcription) error {
 	return nil
 }
 func (*atStore) FailUpload(context.Context, string, string, domain.UploadErrorKind) error { return nil }
 func (s *atStore) SaveProgress(_ context.Context, _, _ string, _ []domain.ProgressStep, at time.Time) error {
 	s.saveAt = at
 	return nil
 }
 func (s *atStore) Heartbeat(_ context.Context, _, _ string, at time.Time) error {
 	s.beatAt = at
 	return nil
 }
 func TestJobSink_ForwardsTheTrackersTimestampToTheStoreUnchanged(t *testing.T) {
 	st := &atStore{}
 	sink := jobSink{st: st, userID: "u", id: "i"}
 	stamp := time.Date(2020, 1, 2, 3, 4, 5, 0, time.UTC)
 	if err := sink.Beat(context.Background(), stamp); err != nil {
 		t.Fatal(err)
 	}
 	if err := sink.SaveProgress(context.Background(), nil, stamp); err != nil {
 		t.Fatal(err)
 	}
 	if !st.beatAt.Equal(stamp) {
 		t.Errorf("heartbeat reached the store stamped %v, want the tracker's %v", st.beatAt, stamp)
 	}
 	if !st.saveAt.Equal(stamp) {
 		t.Errorf("progress save reached the store stamped %v, want the tracker's %v", st.saveAt, stamp)
 	}
 }
@@ -33,13 +33,6 @@ type Transcriber interface {
 	Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error)
 }
 // LanguagePlanner is a Planner whose phases depend on the language of the job: a recording
 // that is not Swedish skips the second engine and the reconcile, and the page should not list
 // them as coming (tapir#61). The worker prefers it over Planner.
 type LanguagePlanner interface {
 	PlanFor(lang domain.Language) []progress.Planned
 }
 // Planner is an optional extra on a Transcriber: it declares its own phases (for
 // example one per engine) so the page can show them. A Transcriber that does not
 // implement it gets a single "transcribing" phase from the worker. Whatever a Planner
@@ -54,7 +47,7 @@ type WorkerStore interface {
 	CompleteUpload(ctx context.Context, userID, id string, t domain.Transcription) error
 	FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error
 	SaveProgress(ctx context.Context, userID, id string, steps []domain.ProgressStep, at time.Time) error
-	Heartbeat(ctx context.Context, userID, id string, at time.Time) error
+	Heartbeat(ctx context.Context, userID, id string) error
 }
 // WorkerOption tunes a Worker.
@@ -98,9 +91,7 @@ func (s jobSink) SaveProgress(ctx context.Context, steps []domain.ProgressStep,
 	return s.st.SaveProgress(ctx, s.userID, s.id, steps, at)
 }
-func (s jobSink) Beat(ctx context.Context, at time.Time) error {
+func (s jobSink) Beat(ctx context.Context) error { return s.st.Heartbeat(ctx, s.userID, s.id) }
 	return s.st.Heartbeat(ctx, s.userID, s.id, at)
 }
 // Worker transcribes accepted uploads in-process, ONE AT A TIME (ADR-033). It is
 // not a second deployable: it shares the web process's lifetime, which is why it
@@ -185,10 +176,9 @@ func (w *Worker) Submit(j Job) error {
 }
 // Run processes queued jobs until ctx ends, then deletes the audio of anything
-// still queued and refuses new jobs. The job running at shutdown is recorded interrupted
+// still queued and refuses new jobs. The rows of those jobs stay queued or
-// by Process; the rows of jobs still queued stay queued and are failed as interrupted by
+// transcribing and are failed as interrupted by the start-up sweep
-// the start-up sweep (store.FailInterruptedUploads): the audio is not retained, so they
+// (store.FailInterruptedUploads): the audio is not retained, so they cannot resume.
 // cannot resume.
 func (w *Worker) Run(ctx context.Context) {
 	defer w.stop()
 	for {
@@ -237,7 +227,7 @@ func (w *Worker) stop() {
 // Process runs one job: row -> transcribing, convert, transcribe, store. The
 // uploaded file and the converted WAV are deleted on every path — the audio is
 // never retained (ADR-033). A failure is recorded with a TYPED kind; a shutdown
-// mid-job is recorded as interrupted at once (see fail).
+// mid-job is not a failure and leaves the row for the start-up sweep.
 //
 // Every phase is reported through one progress.Tracker, which saves it to the row for
 // the page and logs it, and a heartbeat stamps the row on its own while the job runs
@@ -258,14 +248,8 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	}
 	plan := []progress.Planned{{Key: "received", Label: "Received"}, {Key: "audio", Label: "Preparing the audio"}}
 	lang := job.Language
 	if lang == "" {
 		lang = domain.LangSwedish // queued before the choice existed
 	}
 	planner, planned := w.tr.(Planner)
-	if lp, ok := w.tr.(LanguagePlanner); ok {
+	if planned {
 		plan = append(plan, lp.PlanFor(lang)...)
 	} else if planned {
 		plan = append(plan, planner.Plan()...)
 	} else {
 		plan = append(plan, progress.Planned{Key: "transcribe", Label: "Transcribing"})
@@ -285,7 +269,7 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	defer func() { stopBeat(); <-hbDone }() // no heartbeat outlives its job
 	// abort records where the job stopped. A shutdown (the parent context ended) is not
-	// a failure of the step: it stays as it was, and fail records the row as interrupted.
+	// a failure: the row is left for the start-up sweep, so the step stays as it was.
 	abort := func(kind domain.UploadErrorKind) {
 		if ctx.Err() == nil {
 			tr.FailRunning()
@@ -326,7 +310,7 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 	if !planned {
 		tr.Begin("transcribe", 0)
 	}
-	t, err := w.tr.Transcribe(domain.WithLanguage(progress.With(jobCtx, tr), lang), wav)
+	t, err := w.tr.Transcribe(progress.With(jobCtx, tr), wav)
 	if err != nil {
 		log.Error("upload: transcribe", "kind", errkind.Of(err), "elapsed", time.Since(start).Round(time.Second))
 		abort(domain.UploadErrTranscriptionFailed)
@@ -348,19 +332,11 @@ func (w *Worker) Process(ctx context.Context, job Job) {
 		"segments", len(t.Segments), "elapsed", time.Since(start).Round(time.Second))
 }
-// interruptedWriteTimeout bounds the one write a dying process makes to record its job.
+// fail records a transcription failure — unless the PARENT context ended, which
-const interruptedWriteTimeout = 3 * time.Second
+// is a shutdown, not a failure: the row is left for the start-up sweep.
 // fail records a transcription failure. When the PARENT context ended the process is
 // shutting down: the job is recorded interrupted at once, on a short context of its own,
 // because the process may exit before any other pod's start-up sweep would do it (#50).
 // The sweep remains the backstop for a process that is killed outright.
 func (w *Worker) fail(ctx context.Context, job Job, log *slog.Logger, kind domain.UploadErrorKind) {
 	if ctx.Err() != nil {
-		kind = domain.UploadErrInterrupted
+		return
 		var cancel context.CancelFunc
 		ctx, cancel = context.WithTimeout(context.WithoutCancel(ctx), interruptedWriteTimeout)
 		defer cancel()
 	}
 	if err := w.store.FailUpload(ctx, job.UserID, job.UploadID, kind); err != nil {
 		log.Error("upload: record failure", "kind", errkind.Of(err))
@@ -213,47 +213,3 @@ func TestWorkerProgress_AStoreFailureLogsItsSQLStateNeverTheValueItQuotes(t *tes
 	assert.Contains(t, out, "upload: store transcript")
 	assert.Contains(t, out, "kind=sql_22P02")
 }
 // langPlannedTr plans per language, like the Ensemble: an auto job has no base engine.
 type langPlannedTr struct{ *fakeTranscriber }
 func (langPlannedTr) Plan() []progress.Planned { return plannedTr{}.Plan() }
 func (langPlannedTr) PlanFor(l domain.Language) []progress.Planned {
 	if l == domain.LangAuto {
 		return []progress.Planned{{Key: "engine_b", Label: "Transcribing with B"}}
 	}
 	return plannedTr{}.Plan()
 }
 func (p langPlannedTr) Transcribe(ctx context.Context, wav string) (domain.Transcription, error) {
 	r := progress.From(ctx)
 	if domain.LanguageFrom(ctx) != domain.LangAuto {
 		r.Begin("engine_a", 0)
 		r.Done("engine_a")
 	}
 	r.Begin("engine_b", 0)
 	r.Done("engine_b")
 	return p.fakeTranscriber.Transcribe(ctx, wav)
 }
 func TestWorkerProgress_AJobGetsThePlanOfItsLanguage(t *testing.T) {
 	for name, tt := range map[string]struct {
 		lang domain.Language
 		want []string
 	}{
 		"auto":    {domain.LangAuto, []string{"received:done", "audio:done", "engine_b:done", "save:done"}},
 		"swedish": {domain.LangSwedish, []string{"received:done", "audio:done", "engine_a:done", "engine_b:done", "save:done"}},
 		"no language (queued before the choice existed)": {"", []string{"received:done", "audio:done", "engine_a:done", "engine_b:done", "save:done"}},
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := newWRig(t, time.Minute)
 			w := newProgressWorker(t, r, langPlannedTr{r.tr})
 			job := r.spool(t, "a")
 			job.Language = tt.lang
 			w.Process(context.Background(), job)
 			assert.Equal(t, tt.want, keysAndStates(r.st.lastSteps()))
 		})
 	}
 }
@@ -53,10 +53,7 @@ func (s *wStore) CompleteUpload(_ context.Context, _, id string, t domain.Transc
 	return nil
 }
-func (s *wStore) FailUpload(ctx context.Context, _, id string, k domain.UploadErrorKind) error {
+func (s *wStore) FailUpload(_ context.Context, _, id string, k domain.UploadErrorKind) error {
 	if err := ctx.Err(); err != nil { // like the real store: a cancelled context cannot write
 		return err
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.failed[id] = k
@@ -70,7 +67,7 @@ func (s *wStore) SaveProgress(_ context.Context, _, _ string, steps []domain.Pro
 	return nil
 }
-func (s *wStore) Heartbeat(context.Context, string, string, time.Time) error {
+func (s *wStore) Heartbeat(context.Context, string, string) error {
 	time.Sleep(s.beatDelay)
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -126,7 +123,6 @@ type fakeTranscriber struct {
 	result domain.Transcription
 	err    error
 	paths  []string
 	langs  []domain.Language // what each call's context carried
 	// block, when non-nil, holds every call until it is closed or ctx ends.
 	block   chan struct{}
 	running atomic.Int32
@@ -135,7 +131,6 @@ type fakeTranscriber struct {
 func (f *fakeTranscriber) Transcribe(ctx context.Context, wav string) (domain.Transcription, error) {
 	f.paths = append(f.paths, wav)
 	f.langs = append(f.langs, domain.LanguageFrom(ctx))
 	n := f.running.Add(1)
 	defer f.running.Add(-1)
 	for {
@@ -247,9 +242,7 @@ func TestWorkerProcess_FailuresAreTypedAndStillDeleteTheAudio(t *testing.T) {
 	})
 }
-func TestWorkerProcess_ShutdownMidJobRecordsTheRowInterruptedAtOnce(t *testing.T) {
+func TestWorkerProcess_ShutdownMidJobLeavesTheRowForTheStartupSweep(t *testing.T) {
 	// SIGTERM on a deploy used to leave the row "transcribing" until the NEXT pod's
 	// start-up sweep; the process may exit before any sweep runs (#50).
 	r := newWRig(t, time.Minute)
 	r.tr.block = make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
@@ -262,8 +255,8 @@ func TestWorkerProcess_ShutdownMidJobRecordsTheRowInterruptedAtOnce(t *testing.T
 	<-done
 	_, f := r.st.snapshot()
-	assert.Equal(t, domain.UploadErrInterrupted, f["a"], "the row is recorded interrupted by the dying process, not left for a sweep")
+	assert.Empty(t, f, "a shutdown is not a transcription failure: the row stays for FailInterruptedUploads to mark interrupted")
-	assert.Empty(t, r.leftovers(t), "and the audio is still deleted")
+	assert.Empty(t, r.leftovers(t), "but the audio is still deleted")
 }
 func TestWorkerProcess_AJobThatOutlivesItsTimeoutIsFailedNotStuck(t *testing.T) {
@@ -339,24 +332,3 @@ func (dbErr) Error() string {
 	return `ERROR: invalid input syntax for type json: "zebrakaka secret words"`
 }
 func (dbErr) SQLState() string { return "22P02" }
 func TestWorker_TheTranscriberSeesTheLanguageOfTheJobOnItsContext(t *testing.T) {
 	for name, tt := range map[string]struct {
 		job  domain.Language
 		want domain.Language
 	}{
 		"auto":                   {domain.LangAuto, domain.LangAuto},
 		"swedish":                {domain.LangSwedish, domain.LangSwedish},
 		"a job with no language": {"", domain.LangSwedish}, // queued before the field existed
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := newWRig(t, time.Minute)
 			job := r.spool(t, "a")
 			job.Language = tt.job
 			r.w.Process(context.Background(), job)
 			assert.Equal(t, []domain.Language{tt.want}, r.tr.langs)
 		})
 	}
 }
@@ -1,151 +0,0 @@
 package web_test
 // Observes the cross-origin gate around Router (#48): SameSite=Lax does not stop a POST
 // from a sibling *.d-ma.be origin, so the router itself must refuse a non-safe request
 // whose Origin or Sec-Fetch-Site says it did not come from this site's own pages.
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // foreign is a header set a browser sends for a form post made by another page.
 var foreign = map[string]map[string]string{
 	"sibling subdomain, Sec-Fetch-Site": {"Origin": "https://evil.d-ma.be", "Sec-Fetch-Site": "same-site"},
 	"other site, Sec-Fetch-Site":        {"Origin": "https://evil.example", "Sec-Fetch-Site": "cross-site"},
 	"sibling subdomain, Origin only":    {"Origin": "https://evil.d-ma.be"},
 	"opaque origin":                     {"Origin": "null"},
 }
 // own is a header set for the app's own pages (or a non-browser client): must pass.
 var own = map[string]map[string]string{
 	"same-origin Sec-Fetch-Site": {"Sec-Fetch-Site": "same-origin", "Origin": "http://example.com"},
 	"matching Origin only":       {"Origin": "http://example.com"},
 	"no browser headers":         {},
 }
 func withHeaders(req *http.Request, h map[string]string) *http.Request {
 	for k, v := range h {
 		req.Header.Set(k, v)
 	}
 	return req
 }
 func userCount(t *testing.T) int {
 	t.Helper()
 	var n int
 	require.NoError(t, rawPool(t).QueryRow(context.Background(), `SELECT count(*) FROM users WHERE id = $1`, userID).Scan(&n))
 	return n
 }
 func TestCrossOrigin_ARefusedDeleteAccountPostLeavesTheAccountInPlace(t *testing.T) {
 	for name, h := range foreign {
 		t.Run(name, func(t *testing.T) {
 			app, _ := newAccountApp(t)
 			resetDB(t, rawPool(t))
 			seedConnection(t, app, "youtube", "ada@channel", "ref")
 			rec := do(t, app, withHeaders(httptest.NewRequest(http.MethodPost, "/account/delete", nil), h))
 			assert.Equal(t, http.StatusForbidden, rec.Code)
 			assert.Equal(t, 1, userCount(t), "the account must survive a refused post")
 		})
 	}
 }
 func TestCrossOrigin_ASameOriginOrHeaderlessDeleteAccountPostIsServed(t *testing.T) {
 	for name, h := range own {
 		t.Run(name, func(t *testing.T) {
 			app, _ := newAccountApp(t)
 			resetDB(t, rawPool(t))
 			seedConnection(t, app, "youtube", "ada@channel", "ref")
 			rec := do(t, app, withHeaders(httptest.NewRequest(http.MethodPost, "/account/delete", nil), h))
 			assert.Equal(t, http.StatusSeeOther, rec.Code)
 			assert.Equal(t, "/auth/logout", rec.Header().Get("Location"))
 		})
 	}
 }
 func TestCrossOrigin_ARefusedUploadPostSubmitsNoJob(t *testing.T) {
 	for name, h := range foreign {
 		t.Run(name, func(t *testing.T) {
 			app, sub := newUploadApp(t, audioOK, 200<<20)
 			rec := do(t, app, withHeaders(uploadReq(t, "m", "m.wav", []byte("RIFF....WAVE")), h))
 			assert.Equal(t, http.StatusForbidden, rec.Code)
 			assert.Empty(t, sub.jobs, "a refused post must not enqueue transcription")
 		})
 	}
 }
 func TestCrossOrigin_ARefusedUploadChatPostCallsNoModel(t *testing.T) {
 	for name, h := range foreign {
 		t.Run(name, func(t *testing.T) {
 			app, fc := newUploadChatApp(t)
 			id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
 			req := chatPost("/uploads/"+id+"/chat", url.Values{"message": {"hej"}})
 			rec := do(t, app, withHeaders(req, h))
 			assert.Equal(t, http.StatusForbidden, rec.Code)
 			assert.Zero(t, fc.callCount)
 		})
 	}
 }
 func TestCrossOrigin_AForeignPostIsRefusedOnEachListedStateChangingPath(t *testing.T) {
 	routes := []string{
 		"/account/disconnect/youtube",
 		"/account/summarize-mode",
 		"/register",
 		"/paste",
 		"/v/abc/action",
 		"/v/abc/summarize",
 		"/v/abc/retry-now",
 		"/v/abc/chat",
 	}
 	for _, path := range routes {
 		t.Run(path, func(t *testing.T) {
 			app := newApp(t)
 			req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(""))
 			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 			rec := do(t, app, withHeaders(req, foreign["sibling subdomain, Sec-Fetch-Site"]))
 			assert.Equal(t, http.StatusForbidden, rec.Code)
 		})
 	}
 }
 func TestCrossOrigin_ARefusedRecordingDeletePostLeavesTheRecordingInPlace(t *testing.T) {
 	for name, h := range foreign {
 		t.Run(name, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 			rec := do(t, app, withHeaders(httptest.NewRequest(http.MethodPost, "/uploads/"+id+"/delete", nil), h))
 			assert.Equal(t, http.StatusForbidden, rec.Code)
 			assert.True(t, uploadExists(t, id), "a refused post must not delete the recording")
 		})
 	}
 }
 // A login redirect comes back to /auth/callback as a cross-site GET navigation, and
 // health probes carry no headers: safe methods must never be refused on origin grounds.
 func TestCrossOrigin_ACrossSiteGETIsNotRefused(t *testing.T) {
 	app := newApp(t)
 	for _, path := range []string{"/healthz", "/welcome"} {
 		req := httptest.NewRequest(http.MethodGet, path, nil)
 		req.Header.Set("Sec-Fetch-Site", "cross-site")
 		assert.Equal(t, http.StatusOK, do(t, app, req).Code, path)
 	}
 }
@@ -59,9 +59,6 @@ type Store interface {
 	// non-owner's id is ErrUploadNotFound.
 	GetUpload(ctx context.Context, userID, id string) (*domain.UploadedTranscript, error)
 	ListUploads(ctx context.Context, userID string) ([]domain.UploadedTranscript, error)
 	// DeleteUpload removes a finished upload; ErrUploadInProgress while it is still being
 	// processed, ErrUploadNotFound for a non-owner.
 	DeleteUpload(ctx context.Context, userID, id string) error
 	// SetTranscriptStatus clears or updates a video's transcript backoff state.
 	// Used by handleRetryNow to clear rate_limited_at before immediate processing.
@@ -203,7 +200,6 @@ func (a *App) Router() http.Handler {
 		app.HandleFunc("POST /uploads", a.handleUploadPost)
 		app.HandleFunc("GET /uploads/{id}", a.handleUploadDetail)
 		app.HandleFunc("GET /uploads/{id}/status", a.handleUploadStatus)
 		app.HandleFunc("POST /uploads/{id}/delete", a.handleUploadDelete)
 		// Chat over the uploaded transcript reuses the ADR-027 Chatter; mounted only
 		// when one is wired.
 		if a.Chat != nil {
@@ -233,12 +229,7 @@ func (a *App) Router() http.Handler {
 	// resolved user_id. /register lives inside the auth guard but is exempt from
 	// the registration gate (you must be able to reach it before you have a user).
 	root.Handle("/", a.Auth.Middleware(a.registrationGate(app)))
-
+	return root
 	// The session cookie is SameSite=Lax, which still travels on a POST made from a
 	// sibling *.d-ma.be page (same site, different origin). Refuse any non-safe request
 	// whose Origin or Sec-Fetch-Site says it did not come from this origin (#48). It wraps
 	// everything, so a route added later is covered without remembering to ask.
 	return http.NewCrossOriginProtection().Handler(root)
 }
 // handleWelcome renders the public landing page (/welcome). It is mounted outside
@@ -313,7 +304,7 @@ func (a *App) handleList(w http.ResponseWriter, r *http.Request) {
 		a.render(w, r, summaryList(buckets, hasConnected, autoSummarize))
 		return
 	}
-	a.render(w, r, ListPage(buckets, f, stats, takeFlash(w, r), hasConnected, channels, autoSummarize, a.Uploads != nil))
+	a.render(w, r, ListPage(buckets, f, stats, takeFlash(w, r), hasConnected, channels, autoSummarize))
 }
 // handleDetail renders one summary in full (highlights, takeaways, action group).
@@ -66,7 +66,7 @@ func TestParseYouTubeVideoID(t *testing.T) {
 func TestListPageShowsPasteFormOnlyWhenConnected(t *testing.T) {
 	render := func(connected bool) string {
 		var buf bytes.Buffer
-		if err := ListPage(listBuckets{}, Filter{}, PipelineStats{}, "", connected, nil, true, false).Render(context.Background(), &buf); err != nil {
+		if err := ListPage(listBuckets{}, Filter{}, PipelineStats{}, "", connected, nil, true).Render(context.Background(), &buf); err != nil {
 			t.Fatalf("render: %v", err)
 		}
 		return buf.String()
@@ -18,7 +18,6 @@ import (
 	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/config"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/errkind"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
@@ -28,7 +27,7 @@ import (
 // *uploads.Intake satisfies it. It is the whole of what the handlers know about
 // validation, spooling and queueing.
 type Uploader interface {
-	Accept(ctx context.Context, userID, title string, lang domain.Language, src io.Reader) (id string, err error)
+	Accept(ctx context.Context, userID, title string, src io.Reader) (id string, err error)
 }
 const (
@@ -36,8 +35,6 @@ const (
 	// and the title field; the cap itself is enforced on the file part by Intake.
 	uploadOverhead = 1 << 20
 	maxTitleRunes  = 200
 	// maxLanguageBytes bounds what is read of the language field; a valid value is at most four bytes, so a longer one fails the parse.
 	maxLanguageBytes = 16
 	// uploadPollEvery is how often an unfinished upload re-asks for its status.
 	uploadPollEvery = "2s"
 	// serviceSilentAfter is how long a job may go without any signal (heartbeat or
@@ -91,7 +88,6 @@ func (a *App) handleUploadPost(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	title := ""
 	lang := domain.LangSwedish
 	for {
 		part, err := mr.NextPart()
 		if errors.Is(err, io.EOF) {
@@ -124,29 +120,11 @@ func (a *App) handleUploadPost(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			title = cleanTitle(string(b))
 		case "language":
 			// A closed set read before the file: anything else is refused before the file
 			// is spooled, so a crafted value never reaches an engine (tapir#61).
 			b, err := io.ReadAll(io.LimitReader(part, maxLanguageBytes+1))
 			if err != nil {
 				if a.abandoned(w, r) {
 					return
 				}
 				a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "That upload could not be read. Please try again.")
 				return
 			}
 			l, ok := domain.ParseLanguage(string(b))
 			if !ok {
 				a.logger().Info("upload rejected", "reason", "language")
 				a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "Choose a language from the list.")
 				return
 			}
 			lang = l
 		case "file":
 			if title == "" {
 				title = titleFromFilename(part.FileName())
 			}
-			id, err := a.Uploads.Accept(r.Context(), userID, title, lang, part)
+			id, err := a.Uploads.Accept(r.Context(), userID, title, part)
 			if err != nil {
 				a.uploadFailure(w, r, userID, err)
 				return
@@ -231,32 +209,6 @@ func (a *App) handleUploadStatus(w http.ResponseWriter, r *http.Request) {
 	a.render(w, r, uploadStatus(*u, a.Chat != nil, a.now()))
 }
 // handleUploadDelete removes one of the caller's finished recordings and returns to the
 // list. Another user's id is a 404 like every other upload route; a recording still being
 // transcribed is refused (409) rather than deleted under the worker (#37).
 func (a *App) handleUploadDelete(w http.ResponseWriter, r *http.Request) {
 	userID, ok := a.currentUserID(w, r)
 	if !ok {
 		return
 	}
 	id := r.PathValue("id")
 	if !uuidShape.MatchString(id) {
 		http.NotFound(w, r)
 		return
 	}
 	switch err := a.Store.DeleteUpload(r.Context(), userID, id); {
 	case err == nil:
 		http.Redirect(w, r, "/uploads", http.StatusSeeOther)
 	case errors.Is(err, store.ErrUploadNotFound):
 		http.NotFound(w, r)
 	case errors.Is(err, store.ErrUploadInProgress):
 		a.renderUploadsPage(w, r, userID, http.StatusConflict,
 			"This recording is still being transcribed. You can delete it once it has finished.")
 	default:
 		a.serverError(w, r, "delete upload", err)
 	}
 }
 func (a *App) loadOwnedUpload(w http.ResponseWriter, r *http.Request) (*domain.UploadedTranscript, bool) {
 	userID, ok := a.currentUserID(w, r)
 	if !ok {
@@ -291,44 +243,6 @@ func titleFromFilename(name string) string {
 	return t
 }
 // cloudProvider names the cloud service that produced a transcript, or false when it was
 // served locally (or by an unknown endpoint). "Local" is config.IsLocalModel: the same
 // definition the start-up validation uses, not a second string match here (#52).
 //
 // The endpoint is one alias, except for the two-engine path (ADR-034), which writes
 // "<base> + <alt>, reconciled by <model>" (ensemble.go). That shape is taken apart exactly
 // and each alias is judged whole, so a composite of local models is local, and anything
 // else (a cloud alias, one with no provider prefix, one with a space or a connector word in
 // it) is not. A string that is not that shape is one alias.
 func cloudProvider(endpoint string) (string, bool) {
 	endpoint = strings.TrimSpace(endpoint)
 	if endpoint == "" {
 		return "", false
 	}
 	aliases := []string{endpoint}
 	if engines, reconciler, ok := strings.Cut(endpoint, ", reconciled by "); ok {
 		aliases = append(strings.Split(engines, " + "), reconciler)
 	}
 	for _, a := range aliases {
 		if a = strings.TrimSpace(a); !config.IsLocalModel(a) {
 			provider, _, _ := strings.Cut(a, "/")
 			if provider = strings.TrimSpace(provider); provider == "" {
 				provider = a
 			}
 			return provider, true
 		}
 	}
 	return "", false
 }
 // languageLabel is how the page names the language a recording was transcribed as.
 func languageLabel(l domain.Language) string {
 	if l == domain.LangAuto {
 		return "Other (detected by the engine)"
 	}
 	return "Swedish"
 }
 // hasNote reports whether any phase carries a note. A note is the only warning for a
 // recording that is shorter than its file claimed, so a record that has one is shown open.
 func hasNote(steps []domain.ProgressStep) bool {
@@ -24,14 +24,6 @@ templ UploadsPage(v uploadsView) {
 			}
 			<form method="post" action="/uploads" enctype="multipart/form-data">
 				<p><label>Title (optional) <input type="text" name="title" maxlength="200"/></label></p>
 				<p>
 					<label>Language
 						<select name="language">
 							<option value="sv" selected>Swedish</option>
 							<option value="auto">Other (detected by the engine)</option>
 						</select>
 					</label>
 				</p>
 				<p><input type="file" name="file" accept="audio/*,.m4a,.mp3,.wav,.opus,.ogg,.mp4" required/></p>
 				<p><button type="submit">Upload and transcribe</button></p>
 			</form>
@@ -57,7 +49,6 @@ templ UploadPage(u domain.UploadedTranscript, chatEnabled bool, now time.Time) {
 	@Layout("Tapir — " + u.Title) {
 		<article class="account">
 			<h1>{ u.Title }</h1>
 			<p class="muted">Language: { languageLabel(u.Language) }</p>
 			@uploadStatus(u, chatEnabled, now)
 			<p><a href="/uploads">All recordings</a></p>
 		</article>
@@ -75,12 +66,6 @@ templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 					Transcribed { uploads.FormatDuration(time.Duration(u.AudioSeconds * float64(time.Second))) }
 					of audio by <span class="chip">{ u.Endpoint }</span>.
 				</p>
 				if provider, cloud := cloudProvider(u.Endpoint); cloud {
 					<p class="cloud-note">
 						This recording's audio left the homelab: it was transcribed by a cloud service ({ provider })
 						because the local engine could not.
 					</p>
 				}
 				@reconciliationNote(u.Reconciliation)
 				if len(u.Progress) > 0 {
 					<details class="what-was-done" if hasNote(u.Progress) { open }>
@@ -95,7 +80,6 @@ templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 					<summary>Transcript</summary>
 					<pre class="transcript">{ u.Content }</pre>
 				</details>
 				@deleteRecording(u.ID)
 			</div>
 		case domain.UploadFailed:
 			<div class="upload-status upload-failed flash flash-error" role="alert">
@@ -107,7 +91,6 @@ templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 						@progressSteps(u.Progress, now, false)
 					</details>
 				}
 				@deleteRecording(u.ID)
 			</div>
 		default:
 			<div
@@ -133,20 +116,6 @@ templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool, now time.Time)
 	}
 }
 // deleteRecording is the confirm-then-delete control, shown only once a recording has
 // finished (done or failed): deleting one that is still being processed is refused.
 templ deleteRecording(id string) {
 	<details class="confirm-delete">
 		<summary class="btn-danger">Delete this recording…</summary>
 		<div class="confirm-body">
 			<p>This permanently deletes the recording and its transcript. Are you sure?</p>
 			<form method="post" action={ templ.SafeURL("/uploads/" + id + "/delete") }>
 				<button type="submit" class="btn-danger">Yes, permanently delete it</button>
 			</form>
 		</div>
 	</details>
 }
 // UploadChatPage is the no-JS full page for chatting with an uploaded transcript:
 // the same chat panel as a video's (ADR-027), scoped to this recording.
 templ UploadChatPage(u domain.UploadedTranscript, v chatView) {
@@ -1,140 +0,0 @@
 package web_test
 // A transcript produced by the cloud fallback means this recording's audio left the
 // homelab, which the reader is told in plain words (#52). "Local" is config.IsLocalModel:
 // one definition, not a second string match in the view.
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func setEndpoint(t *testing.T, id, endpoint string) {
 	t.Helper()
 	_, err := rawPool(t).Exec(context.Background(), `UPDATE uploaded_transcripts SET endpoint = $2 WHERE id = $1`, id, endpoint)
 	require.NoError(t, err)
 }
 func TestUploadStatus_ACloudServedTranscriptSaysTheAudioLeftTheHomelab(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 	setEndpoint(t, id, "berget/kb-whisper")
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 	assert.Contains(t, b, "left the homelab")
 	assert.Contains(t, b, "cloud service (berget)")
 }
 func TestUploadStatus_ALocallyServedTranscriptCarriesNoCloudNote(t *testing.T) {
 	for _, endpoint := range []string{"iguana/kb-whisper", "koala/whisper", ""} {
 		t.Run(endpoint, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 			setEndpoint(t, id, endpoint)
 			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 			assert.NotContains(t, b, "left the homelab")
 		})
 	}
 }
 func TestUploadStatus_AnEndpointThatOnlyLooksLocalIsStillNamedAsCloud(t *testing.T) {
 	// The prefix alone must not decide it: IsLocalModel refuses path tricks.
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 	setEndpoint(t, id, "iguana/../berget/kb-whisper")
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 	assert.Contains(t, b, "left the homelab")
 }
 // The two-engine path (ADR-034) writes one composite endpoint string. Every name in it is
 // a local model, so the audio never left the homelab and the note must not say it did.
 func TestUploadStatus_AReconciledAllLocalEndpointCarriesNoCloudNote(t *testing.T) {
 	for _, endpoint := range []string{
 		"iguana/kb-whisper + koala/whisper, reconciled by iguana/gemma4-26b",
 		"iguana/kb-whisper + koala/whisper, reconciled by iguana/gemma4-26b\n",
 	} {
 		t.Run(endpoint, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 			setEndpoint(t, id, endpoint)
 			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 			assert.NotContains(t, b, "left the homelab")
 		})
 	}
 }
 func TestUploadStatus_AReconciledEndpointNamingACloudEngineStillNamesTheCloudProvider(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 	setEndpoint(t, id, "iguana/kb-whisper + berget/kb-whisper, reconciled by iguana/gemma4-26b")
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 	assert.Contains(t, b, "cloud service (berget)")
 }
 // An alias without a provider prefix is not a local model, wherever it sits in the
 // composite: it must never be dropped from the judgement (PR #58 re-review).
 func TestUploadStatus_AReconciledEndpointWithAnUnprefixedAliasIsNotCalledLocal(t *testing.T) {
 	for _, endpoint := range []string{
 		"iguana/kb-whisper + whisper-1, reconciled by iguana/gemma4-26b",
 		"iguana/kb-whisper + whisper 1, reconciled by iguana/gemma4-26b",
 		"iguana/kb-whisper + berget / x, reconciled by iguana/gemma4-26b",
 	} {
 		t.Run(endpoint, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 			setEndpoint(t, id, endpoint)
 			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 			assert.Contains(t, b, "left the homelab")
 			assert.NotContains(t, b, "cloud service ()", "the note names a provider")
 		})
 	}
 }
 // "by", "reconciled" and "+" are connectors only inside the composite format. As a whole
 // endpoint, or as an alias within the composite, they are model names and are judged.
 func TestUploadStatus_AConnectorWordUsedAsAModelNameIsStillJudged(t *testing.T) {
 	for _, endpoint := range []string{
 		"by",
 		"reconciled",
 		"+",
 		"iguana/kb-whisper + by, reconciled by iguana/gemma4-26b",
 		"iguana/kb-whisper + reconciled, reconciled by iguana/gemma4-26b",
 		"iguana/kb-whisper + +, reconciled by iguana/gemma4-26b",
 		"/x", // no provider at all: the note must still name something
 	} {
 		t.Run(endpoint, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 			setEndpoint(t, id, endpoint)
 			b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 			assert.Contains(t, b, "left the homelab")
 			assert.NotContains(t, b, "cloud service ()")
 		})
 	}
 }
 func TestUploadStatus_AReconcilerThatIsNotLocalNamesTheCloudProvider(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 	setEndpoint(t, id, "iguana/kb-whisper + koala/whisper, reconciled by berget/mistral-large")
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 	assert.Contains(t, b, "cloud service (berget)")
 }
@@ -1,85 +0,0 @@
 package web_test
 // Deleting one recording (#37). Owner-scoped like every other upload route: another user's
 // id is a 404 and the row survives; an upload still being processed is refused.
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func deleteReq(id string) *http.Request {
 	return httptest.NewRequest(http.MethodPost, "/uploads/"+id+"/delete", nil)
 }
 func uploadExists(t *testing.T, id string) bool {
 	t.Helper()
 	var n int
 	require.NoError(t, rawPool(t).QueryRow(context.Background(), `SELECT count(*) FROM uploaded_transcripts WHERE id = $1`, id).Scan(&n))
 	return n == 1
 }
 func TestUploadDelete_AnOwnerRemovesAFinishedOrFailedRecordingAndLandsOnTheList(t *testing.T) {
 	for _, status := range []string{"done", "failed"} {
 		t.Run(status, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "Roadmap sync", status, "transcription_failed")
 			rec := do(t, app, deleteReq(id))
 			assert.Equal(t, http.StatusSeeOther, rec.Code)
 			assert.Equal(t, "/uploads", rec.Header().Get("Location"))
 			assert.False(t, uploadExists(t, id))
 		})
 	}
 }
 func TestUploadDelete_AnotherUsersRecordingIs404AndSurvives(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	theirs := seedUpload(t, otherUserID, "Their private meeting", "done", meetingText)
 	rec := do(t, app, deleteReq(theirs))
 	assert.Equal(t, http.StatusNotFound, rec.Code)
 	assert.True(t, uploadExists(t, theirs), "a non-owner's delete must not remove the row")
 }
 func TestUploadDelete_ARecordingStillBeingTranscribedIsRefusedWith409AndKept(t *testing.T) {
 	for _, status := range []string{"queued", "transcribing"} {
 		t.Run(status, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", status, "")
 			rec := do(t, app, deleteReq(id))
 			assert.Equal(t, http.StatusConflict, rec.Code)
 			assert.Contains(t, body(t, rec), "still being transcribed")
 			assert.True(t, uploadExists(t, id))
 		})
 	}
 }
 func TestUploadDelete_ANonIDIsA404NotAServerError(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	assert.Equal(t, http.StatusNotFound, do(t, app, deleteReq("not-a-uuid")).Code)
 }
 func TestUploadPage_OffersDeleteOnlyForAFinishedOrFailedRecording(t *testing.T) {
 	for status, want := range map[string]bool{"done": true, "failed": true, "queued": false, "transcribing": false} {
 		t.Run(status, func(t *testing.T) {
 			app, _ := newUploadApp(t, audioOK, 200<<20)
 			id := seedUpload(t, userID, "m", status, "transcription_failed")
 			b := body(t, do(t, app, get("/uploads/"+id)))
 			assert.Equal(t, want, strings.Contains(b, `action="/uploads/`+id+`/delete"`))
 		})
 	}
 }
@@ -14,8 +14,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // A client that hangs up in the middle of an upload is routine, not a server fault. The
@@ -87,7 +85,7 @@ func TestUploadPost_AClientThatHangsUpAnywhereInTheBodyIsLoggedAtInfoAndNeverAsA
 // context is cancelled, then Accept fails the way a read from a dead connection does.
 type goneMidAccept struct{ cancel context.CancelFunc }
-func (g goneMidAccept) Accept(context.Context, string, string, domain.Language, io.Reader) (string, error) {
+func (g goneMidAccept) Accept(context.Context, string, string, io.Reader) (string, error) {
 	g.cancel()
 	return "", fmt.Errorf("receive: %w", io.ErrClosedPipe)
 }
@@ -16,7 +16,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
@@ -133,7 +132,7 @@ func TestUploadPost_AcceptedAudioQueuesARowAndRedirectsToIt(t *testing.T) {
 	assert.Equal(t, "Sprint review", title)
 	assert.Equal(t, "/uploads/"+id, rec.Header().Get("Location"))
 	require.Len(t, sub.jobs, 1)
-	assert.Equal(t, uploads.Job{UserID: userID, UploadID: id, Path: sub.jobs[0].Path, Language: domain.LangSwedish, Duration: audioOK.Duration}, sub.jobs[0])
+	assert.Equal(t, uploads.Job{UserID: userID, UploadID: id, Path: sub.jobs[0].Path, Duration: audioOK.Duration}, sub.jobs[0])
 	spooled, err := os.ReadFile(sub.jobs[0].Path)
 	require.NoError(t, err)
 	assert.Equal(t, "synthetic audio bytes", string(spooled))
@@ -1,151 +0,0 @@
 package web_test
 // The language of a recording is chosen on the upload form (tapir#61). These drive the real
 // Router, Intake and Postgres store; the submitter is the process boundary and records the
 // job the worker would receive.
 import (
 	"bytes"
 	"context"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // langReq builds an upload whose parts come in the order given: "title", "language" and
 // "file" (the file part always carries the same synthetic bytes).
 func langReq(t *testing.T, order []string, language string) *http.Request {
 	t.Helper()
 	var buf bytes.Buffer
 	mw := multipart.NewWriter(&buf)
 	for _, part := range order {
 		switch part {
 		case "title":
 			require.NoError(t, mw.WriteField("title", "m"))
 		case "language":
 			require.NoError(t, mw.WriteField("language", language))
 		case "file":
 			fw, err := mw.CreateFormFile("file", "m.wav")
 			require.NoError(t, err)
 			_, err = fw.Write([]byte("RIFF....WAVE"))
 			require.NoError(t, err)
 		}
 	}
 	require.NoError(t, mw.Close())
 	req := httptest.NewRequest(http.MethodPost, "/uploads", &buf)
 	req.Header.Set("Content-Type", mw.FormDataContentType())
 	return req
 }
 func rowLanguage(t *testing.T, location string) domain.Language {
 	t.Helper()
 	id := strings.TrimPrefix(location, "/uploads/")
 	got, err := newStore(t).GetUpload(context.Background(), userID, id)
 	require.NoError(t, err)
 	return got.Language
 }
 func TestUploadPost_TheLanguageFieldReachesTheJobAndTheRow(t *testing.T) {
 	for _, tt := range []struct {
 		name     string
 		language string
 		want     domain.Language
 	}{
 		{"other", "auto", domain.LangAuto},
 		{"swedish", "sv", domain.LangSwedish},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			app, sub := newUploadApp(t, audioOK, 200<<20)
 			rec := do(t, app, langReq(t, []string{"title", "language", "file"}, tt.language))
 			require.Equal(t, http.StatusSeeOther, rec.Code)
 			require.Len(t, sub.jobs, 1)
 			assert.Equal(t, tt.want, sub.jobs[0].Language)
 			assert.Equal(t, tt.want, rowLanguage(t, rec.Header().Get("Location")))
 		})
 	}
 }
 func TestUploadPost_NoLanguageFieldIsSwedishAsBefore(t *testing.T) {
 	app, sub := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, langReq(t, []string{"title", "file"}, ""))
 	require.Equal(t, http.StatusSeeOther, rec.Code)
 	require.Len(t, sub.jobs, 1)
 	assert.Equal(t, domain.LangSwedish, sub.jobs[0].Language)
 	assert.Equal(t, domain.LangSwedish, rowLanguage(t, rec.Header().Get("Location")))
 }
 // A part after the file is never read (the file part ends the stream), so a client that
 // orders its fields wrongly gets Swedish, the old behaviour, not a guess.
 func TestUploadPost_ALanguageFieldAfterTheFileIsNotReadAndTheUploadIsSwedish(t *testing.T) {
 	app, sub := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, langReq(t, []string{"title", "file", "language"}, "auto"))
 	require.Equal(t, http.StatusSeeOther, rec.Code)
 	require.Len(t, sub.jobs, 1)
 	assert.Equal(t, domain.LangSwedish, sub.jobs[0].Language)
 }
 func TestUploadPost_ALanguageOutsideTheClosedSetIsRefusedBeforeAnythingIsSpooledOrStored(t *testing.T) {
 	for _, bad := range []string{"en", "SV", " sv", "sv,auto", "../auto", strings.Repeat("a", 5000)} {
 		t.Run(bad[:min(len(bad), 12)], func(t *testing.T) {
 			app, sub := newUploadApp(t, audioOK, 200<<20)
 			rec := do(t, app, langReq(t, []string{"title", "language", "file"}, bad))
 			assert.Equal(t, http.StatusBadRequest, rec.Code)
 			assert.Empty(t, sub.jobs, "a refused post must not enqueue transcription")
 			rows, err := newStore(t).ListUploads(context.Background(), userID)
 			require.NoError(t, err)
 			assert.Empty(t, rows, "and must leave no row")
 			assert.Contains(t, body(t, rec), "Choose a language from the list.")
 		})
 	}
 }
 func TestUploadPage_TheFormOffersSwedishPreselectedAndOtherBeforeTheFilePart(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	b := body(t, do(t, app, get("/uploads")))
 	sel := strings.Index(b, `name="language"`)
 	file := strings.Index(b, `name="file"`)
 	require.True(t, sel >= 0, "the form has a language field")
 	assert.True(t, sel < file, "the field must come before the file part: the stream ends at the file")
 	assert.Regexp(t, `<option value="sv" selected`, b, "Swedish is preselected: today's behaviour")
 	assert.Contains(t, b, `<option value="auto"`)
 }
 func TestUploadPage_NamesTheLanguageInEveryState(t *testing.T) {
 	for _, status := range []string{"queued", "transcribing", "done", "failed"} {
 		for _, tt := range []struct {
 			language domain.Language
 			want     string
 		}{
 			{domain.LangSwedish, "Swedish"},
 			{domain.LangAuto, "Other (detected by the engine)"},
 		} {
 			t.Run(status+"/"+string(tt.language), func(t *testing.T) {
 				app, _ := newUploadApp(t, audioOK, 200<<20)
 				id := seedUpload(t, userID, "m", status, "Synthetic transcript text.")
 				_, err := rawPool(t).Exec(context.Background(), `UPDATE uploaded_transcripts SET language = $2 WHERE id = $1`, id, string(tt.language))
 				require.NoError(t, err)
 				b := body(t, do(t, app, get("/uploads/"+id)))
 				assert.Contains(t, b, "Language: "+tt.want)
 			})
 		}
 	}
 }
@@ -13,8 +13,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // Error paths of the upload routes log a kind, never the error's text, which can carry
@@ -39,7 +37,7 @@ func (l *lockedBuf) String() string {
 type failingUploader struct{ err error }
-func (f failingUploader) Accept(context.Context, string, string, domain.Language, io.Reader) (string, error) {
+func (f failingUploader) Accept(context.Context, string, string, io.Reader) (string, error) {
 	return "", f.err
 }
@@ -1,19 +0,0 @@
 package web_test
 // /uploads was mounted but nothing linked to it (#37). The shared Layout has no access to
 // the App, so the entry point is the home list, shown only when uploads are mounted.
 import (
 	"testing"
 	"github.com/stretchr/testify/assert"
 )
 func TestHomeList_LinksToRecordingsOnlyWhenUploadsAreMounted(t *testing.T) {
 	with, _ := newUploadApp(t, audioOK, 200<<20)
 	without := newApp(t)
 	assert.Contains(t, body(t, do(t, with, get("/"))), `href="/uploads"`)
 	assert.NotContains(t, body(t, do(t, without, get("/"))), `href="/uploads"`,
 		"a link to a route that is not mounted would be a dead end")
 }
@@ -107,12 +107,9 @@ templ flashBanner(code string) {
 // #summary-list region; a non-HTMX request renders the whole page. flash carries
 // a one-shot notification (e.g. "connected", "registered") surfaced on arrival
 // after a POST→redirect.
-templ ListPage(b listBuckets, f Filter, stats PipelineStats, flash string, hasConnected bool, channels []string, autoSummarize bool, uploadsEnabled bool) {
+templ ListPage(b listBuckets, f Filter, stats PipelineStats, flash string, hasConnected bool, channels []string, autoSummarize bool) {
 	@Layout("Tapir — Summaries") {
 		@flashBanner(flash)
 		if uploadsEnabled {
 			<p class="muted"><a href="/uploads">Recordings</a>: upload audio and get a private transcript.</p>
 		}
 		if hasConnected {
 			@pasteForm()
 		}
@@ -122,16 +122,6 @@ var scenarioCoverage = map[string]string{
 	"I can ask about my recording and get a grounded answer":                    "TestUploadChatPost_SendsTheOwnersTranscriptWithTheUploadBudget",
 	"A long recording is not cut to its first third":                            "TestAnswerMaxCharsOverridesTheServiceCap",
 	"A transcript made by the cloud fallback says the audio left the homelab": "TestUploadStatus_ACloudServedTranscriptSaysTheAudioLeftTheHomelab",
 	"I choose the language of a recording":                                    "TestUploadPost_TheLanguageFieldReachesTheJobAndTheRow",
 	"Swedish stays the default":                                               "TestUploadPost_NoLanguageFieldIsSwedishAsBefore",
 	"A language outside the list is refused":                                  "TestUploadPost_ALanguageOutsideTheClosedSetIsRefusedBeforeAnythingIsSpooledOrStored",
 	"A recording in another language never reaches the Swedish-only engine":   "TestEnsemble_AnAutoLanguageUploadNeverReachesTheBaseEngineAndIsNotReconciled",
 	"I can delete a finished recording":                        "TestUploadDelete_AnOwnerRemovesAFinishedOrFailedRecordingAndLandsOnTheList",
 	"A recording still being transcribed cannot be deleted":    "TestUploadDelete_ARecordingStillBeingTranscribedIsRefusedWith409AndKept",
 	"The home list links to my recordings when uploads are on": "TestHomeList_LinksToRecordingsOnlyWhenUploadsAreMounted",
 	// audio_upload.feature, ADR-034
 	"Two engines transcribe the audio and their disagreements are reconciled": "TestEnsemble_BothEnginesRunInOrderAndTheirDisagreementIsReconciled",
 	"Trivial disagreements never reach the model":                             "TestReconcile_TrivialDisputesAreResolvedWithoutAskingTheModel",
@@ -1,143 +0,0 @@
 package lintgate
 // Observes the exit status of `task lint` (the lint step of `task check`), not the lint
 // rules themselves. It runs the repo's real Taskfile in a scratch module so a change to the
 // lint command that stops it failing on findings (#41) turns this red.
 import (
 	"bytes"
 	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 )
 const scratchWithFinding = `package main
 import "os"
 func main() { os.Remove("x") }
 `
 func scratchModule(t *testing.T) string {
 	t.Helper()
 	taskfile, err := os.ReadFile(filepath.Join("..", "..", "Taskfile.yml"))
 	if err != nil {
 		t.Fatalf("read Taskfile.yml: %v", err)
 	}
 	dir := t.TempDir()
 	for name, body := range map[string]string{
 		"Taskfile.yml": string(taskfile),
 		"go.mod":       "module scratch\n\ngo 1.21\n",
 		"main.go":      scratchWithFinding,
 	} {
 		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o644); err != nil {
 			t.Fatalf("write %s: %v", name, err)
 		}
 	}
 	return dir
 }
 // ansi matches the colour escape sequences task prints when it thinks it has a terminal.
 var ansi = regexp.MustCompile("\x1b\\[[0-9;]*m")
 // hasSkipNotice reports whether the skip notice was printed as output. Task echoes the command
 // line first, and that line contains the same words, so a substring match would be vacuous.
 func hasSkipNotice(out string) bool {
 	for _, line := range strings.Split(ansi.ReplaceAllString(out, ""), "\n") {
 		if strings.HasPrefix(line, "golangci-lint not installed") {
 			return true
 		}
 	}
 	return false
 }
 // runLint runs `task lint` in dir with the given PATH and returns its combined output and exit code.
 func runLint(t *testing.T, dir, path string) (string, int) {
 	t.Helper()
 	return runTask(t, dir, path, "lint")
 }
 func runTask(t *testing.T, dir, path string, args ...string) (string, int) {
 	t.Helper()
 	taskBin, err := exec.LookPath("task")
 	if err != nil {
 		t.Skip("task not installed")
 	}
 	cmd := exec.Command(taskBin, args...)
 	cmd.Dir = dir
 	cmd.Env = append(os.Environ(), "PATH="+path)
 	var out bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &out, &out
 	err = cmd.Run()
 	var exitErr *exec.ExitError
 	switch {
 	case err == nil:
 		return out.String(), 0
 	case errors.As(err, &exitErr):
 		return out.String(), exitErr.ExitCode()
 	default:
 		t.Fatalf("run task lint: %v", err)
 		return "", -1
 	}
 }
 func TestTaskLint_ExitsNonZeroWhenGolangciLintReportsAFinding(t *testing.T) {
 	if _, err := exec.LookPath("golangci-lint"); err != nil {
 		t.Skip("golangci-lint not installed")
 	}
 	out, code := runLint(t, scratchModule(t), os.Getenv("PATH"))
 	if code == 0 {
 		t.Fatalf("task lint exited 0 on a module with an unchecked error; output:\n%s", out)
 	}
 	if hasSkipNotice(out) {
 		t.Fatalf("task lint blamed a missing binary for a lint failure; output:\n%s", out)
 	}
 	if !strings.Contains(out, "errcheck") {
 		t.Fatalf("a non-zero exit without the finding means the linter crashed, not that it found something; output:\n%s", out)
 	}
 }
 // The lint step only gates anything if `task check` runs it.
 func TestTaskCheck_RunsTheLintStep(t *testing.T) {
 	out, code := runTask(t, scratchModule(t), os.Getenv("PATH"), "--dry", "check")
 	if code != 0 {
 		t.Fatalf("task --dry check exited %d; output:\n%s", code, out)
 	}
 	if !strings.Contains(out, "task: [lint]") {
 		t.Fatalf("task check no longer runs the lint step; output:\n%s", out)
 	}
 }
 func TestTaskLint_SkipsWithANoticeWhenGolangciLintIsAbsent(t *testing.T) {
 	taskBin, err := exec.LookPath("task")
 	if err != nil {
 		t.Skip("task not installed")
 	}
 	bin := t.TempDir() // a PATH holding task and nothing else
 	if err := os.Symlink(taskBin, filepath.Join(bin, "task")); err != nil {
 		t.Fatalf("symlink task: %v", err)
 	}
 	out, code := runLint(t, scratchModule(t), bin)
 	if code != 0 {
 		t.Fatalf("task lint exited %d without golangci-lint on PATH; output:\n%s", code, out)
 	}
 	if !hasSkipNotice(out) {
 		t.Fatalf("expected the skip notice; output:\n%s", out)
 	}
 }
 // CI runs task with colour on, so the notice line starts with an escape sequence; a bare
 // prefix match missed it there while passing on a terminal-less local run.
 func TestHasSkipNotice_SeesTheNoticeBehindColourCodes(t *testing.T) {
 	out := "\x1b[32mtask: [lint] ...\n\x1b[0mgolangci-lint not installed — skipping (CI installs it)\n"
 	if !hasSkipNotice(out) {
 		t.Fatalf("notice not found in coloured output: %q", out)
 	}
 	if hasSkipNotice("\x1b[32mtask: [lint] if command -v golangci-lint ...; echo \"golangci-lint not installed\"\n") {
 		t.Fatal("the echoed command line must not count as the notice")
 	}
 }
		`@@ -1,2 +0,0 @@`
			`ALTER TABLE uploaded_transcripts`
			`DROP COLUMN language;`