feat(summarizer): move local fallback off koala to iguana/gemma4-26b

koala now carries other GPU loads, so the first fallback should not run there.
Change the default chain to koala/phi4-mini → iguana/gemma4-26b → berget/mistral-small:
the local fallback now runs on iguana (M2 Ultra headroom, different host = different
egress IP for the rare fallback fetch). gemma4-26b is the brain-validated homelab
general-purpose model (agentsquad H2/H3 executor) and returned valid summary JSON on
the real prompt in a smoke test (~37s incl. cold-load — fine for a fallback path).

Pure config default (TAPIR_FALLBACK_MODEL); chain mechanism (ADR-022) unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -827,10 +827,18 @@ The fix is resilience around it, not replacing it.
 **Decision.**
 1. **Ordered endpoint chain (`summarizer.NewChain`).** Endpoints are tried in order; the first to
    return a *parseable* summary wins. Default chain:
-   `koala/phi4-mini` (primary, local) → `koala/phi4-14b` (fallback, local) →
+   `koala/phi4-mini` (primary, local) → `iguana/gemma4-26b` (fallback, local on a
-   `berget/mistral-small` (worst-case, external). All three are reached through the **one** LiteLLM
+   *different host*) → `berget/mistral-small` (worst-case, external). All three are reached through
-   gateway by alias — the gateway already fronts both llama-swap and berget — so a fallback is a
+   the **one** LiteLLM gateway by alias — the gateway already fronts both llama-swap and berget — so
-   different alias, not a second client config.
+   a fallback is a different alias, not a second client config.
+
+   **Update 2026-06-11:** the local fallback moved from `koala/phi4-14b` to `iguana/gemma4-26b`.
+   koala now carries other GPU loads, so keeping the fallback on koala competed with them; iguana
+   (M2 Ultra) has the headroom, and a different host is also a different egress IP for the rare
+   fallback fetch. `gemma4-26b` is the brain-validated homelab general-purpose model (agentsquad
+   H2/H3 executor) and returned valid summary JSON on the real prompt in a smoke test
+   (~37s incl. cold-load — fine for a path hit only when the fast primary fails). Pure config:
+   `TAPIR_FALLBACK_MODEL`.
 2. **A parse failure advances the chain, same as a transport error.** "Reliably summarized" means
    *parseable summary returned*, not *HTTP 200*. This is the behaviour the old Primary→Fallback
    shape missed.
@@ -923,6 +931,71 @@ summaries.
 
 ---
 
+## ADR-025 — Honest, state-aware foreground summarization status
+
+**Status:** Accepted (2026-06-10). **Pillar B of the manual-mode UX work** (Pillar A, foreground
+fetch priority, is a separate follow-up). Builds on ADR-014 (the rate limit the UX must make
+legible).
+
+**Context.** Clicking "Summarize" spawned a background goroutine and polled `/status`, which
+returned only two states: the spinner (in-flight) or the normal card (done). But the web
+`ProcessVideo` only recorded an outcome on *success* — a 429'd or caption-less click left
+`transcript_status` unset, so the next poll silently reverted to the "Summarize" button. The
+user saw either an endless spinner or a button that did nothing useful when clicked again. The
+binding constraint (YouTube's caption rate limit) was completely invisible.
+
+**Decision.**
+1. **Record every outcome on the web path**, mirroring the runner: `ProcessVideo` stamps
+   `rate_limited` / `none` / `fetched`. A rate-limited video keeps its requested flag so the
+   background sweep retries it; `none` and `fetched` are terminal.
+2. **`/status` is state-aware**: summarized → summary card; in-flight → working spinner;
+   `rate_limited` → a calm "waiting, will retry" card that keeps polling (every 30s) so the
+   summary appears on its own when the retry lands — the user never clicks again;
+   `none` → a terminal "no captions" card with no poll and no dead-end button.
+3. **Charm status text** (Claude-Code / Crush inspired): the working spinner cycles playful,
+   tapir-themed gerunds ("Chewing the cud…", "Munching leaves…", "Distilling the gist…") via
+   CSS only — no JS, keeping the HTMX/no-JS ethos. Decorative (aria-hidden) with a stable
+   `role=status` line for assistive tech.
+
+**Principle.** When the system cannot be fast (throttled IP), it is at least honest, and it
+self-resolves without making the user retry. Honesty is the load-bearing half — Pillar A's
+priority lane only improves the odds of a fast slot; it cannot beat an already-hot IP.
+
+**Reversibility.** Pure transport-layer + view change over the unchanged engine/ports. No
+schema change (reuses `transcript_status` from migration 007).
+
+---
+
+## ADR-026 — Foreground caption fetches take priority; the credentials probe is dead
+
+**Status:** Accepted (2026-06-10). **Pillar A of the manual-mode UX work** (Pillar B was
+ADR-025). Builds on ADR-014 (the shared per-IP gate).
+
+**Context.** Every caption fetch — the background sweep and the web click-path — shared one
+process-wide rate gate equally. So a user waiting on a "Summarize" click competed with the
+firehose for both pacing and the scarce pre-429 window; on a busy IP the click was slow or
+429'd while the background churned.
+
+**Decision.** A context-marked priority lane. The web path
+(`engineProcessor.ProcessVideo`) wraps its context with `ForegroundContext`; the gate gives
+foreground fetches a token immediately, while **background fetches yield** — they wait until no
+foreground fetch is pending before taking a token. Threaded via a context value (not new
+signatures) and a process-wide `foregroundPending` counter. Clicks are rare and bursty, so the
+background barely loses throughput; the waiting human gets the next (and cleanest) slot.
+
+**Credentials probe — rejected, not built.** The idea was to fetch captions with the user's
+auth in manual mode to dodge 429s. It is a dead end, already settled by ADR-010 and the code:
+the caption path is *deliberately anonymous* because the InnerTube/timedtext endpoints **reject
+or break on authenticated requests** (`captions.go`: "no OAuth token — it can break the
+timedtext endpoint"). The user's OAuth (a Data API credential) does not authenticate InnerTube
+at all, and the official `captions.download` is owner-only (403 on third-party). So auth cannot
+help here and can actively hurt. No probe needed — building one would only re-confirm the ADR.
+
+**Reversibility.** Context-marker + a yield loop in the gate; removing the marker collapses to
+the prior equal-share behaviour. No schema or API change.
+
+---
+
 ## Rejected alternatives
 
 Approaches considered during the 2026-06-02 planning + grill session and **deliberately not

cmd/tapir/processor.go

@@ -113,6 +113,11 @@ type engineProcessor struct {
 }
 
 func (p *engineProcessor) ProcessVideo(ctx context.Context, userID, videoID string) error {
+	// This is the user-initiated (foreground) path — a click on "Summarize",
+	// "Try now", or a pasted URL. Mark the context so the caption gate gives it
+	// priority over the background sweep (ADR-026, Pillar A).
+	ctx = youtube.ForegroundContext(ctx)
+
 	row, err := p.store.GetVideoRow(ctx, userID, videoID)
 	if err != nil {
 		return fmt.Errorf("load video %q: %w", videoID, err)
@@ -132,7 +137,28 @@ func (p *engineProcessor) ProcessVideo(ctx context.Context, userID, videoID stri
 	if err != nil {
 		return fmt.Errorf("process video %q: %w", videoID, err)
 	}
-	if res.Summary != nil {
+
+	// Record the outcome so the status endpoint can show honest state (ADR-025):
+	// a 429'd or caption-less click used to leave transcript_status unset, so the
+	// poll silently reverted to the "Summarize" button. Mirror the runner: stamp
+	// rate_limited / none / fetched. A rate-limited video keeps its requested flag
+	// so the background sweep retries it; none and fetched are terminal here.
+	switch {
+	case res.Skipped && res.TranscriptSource == string(domain.SourceRateLimited):
+		if err := p.store.SetTranscriptStatus(ctx, userID, videoID, "rate_limited"); err != nil {
+			return fmt.Errorf("set rate_limited status %q: %w", videoID, err)
+		}
+	case res.Skipped:
+		if err := p.store.SetTranscriptStatus(ctx, userID, videoID, "none"); err != nil {
+			return fmt.Errorf("set none status %q: %w", videoID, err)
+		}
+		if err := p.store.ClearSummarizeRequested(ctx, userID, videoID); err != nil {
+			return fmt.Errorf("clear summarize flag %q: %w", videoID, err)
+		}
+	case res.Summary != nil:
+		if err := p.store.SetTranscriptStatus(ctx, userID, videoID, "fetched"); err != nil {
+			return fmt.Errorf("set fetched status %q: %w", videoID, err)
+		}
 		if err := p.store.ClearSummarizeRequested(ctx, userID, videoID); err != nil {
 			return fmt.Errorf("clear summarize flag %q: %w", videoID, err)
 		}

cmd/tapir/scheduler.go

@@ -143,8 +143,18 @@ func runScheduler(
 		return // disabled
 	}
 
-	pass := 0
+	// Derive the rotation offset from wall-clock, NOT an in-memory counter. A
-	runDiscoveryPass(ctx, pass, lister, runUser, log)
+	// counter reset to 0 on every pod restart always hands the lead to the
+	// first-listed user — so frequent deploys re-starve whoever is last (exactly
+	// what happened to the first pilot user during a deploy-heavy session). A
+	// time-based offset advances with real time and is identical across restarts,
+	// so the lead rotates fairly regardless of how often the pod bounces.
+	runPass := func() {
+		pass := int(time.Now().Unix() / int64(interval/time.Second))
+		runDiscoveryPass(ctx, pass, lister, runUser, log)
+	}
+
+	runPass()
 
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
@@ -153,8 +163,7 @@ func runScheduler(
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			pass++
+			runPass()
-			runDiscoveryPass(ctx, pass, lister, runUser, log)
 		}
 	}
 }

docs/homelab-integration.md

@@ -30,7 +30,9 @@ it** — endpoints and aliases drift, and this file is a snapshot (2026-06-06),
 - **Summarizer fallback chain (ADR-022).** The primary alias is the *first* of an ordered chain;
   on failure or unparseable output the summarizer advances to the next model. All reached through
   the same gateway by alias.
-  - `TAPIR_FALLBACK_MODEL` — local fallback. **Default `koala/phi4-14b`.** Empty disables it.
+  - `TAPIR_FALLBACK_MODEL` — local fallback. **Default `iguana/gemma4-26b`** — on iguana, NOT
+    koala, so the fallback does not compete with koala's other GPU loads (and runs from a different
+    egress IP). Empty disables it.
   - `TAPIR_CLOUD_FALLBACK_MODEL` — worst-case EXTERNAL fallback. **Default `berget/mistral-small`.**
     **Set this empty (`""`) for any client/NDA deployment** so content never leaves the local
     stack — the chain then contains only local endpoints.

internal/adapters/store/store_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"path/filepath"
 	"testing"
 
 	embeddedpostgres "github.com/fergusstrange/embedded-postgres"
@@ -24,11 +25,22 @@ var _ ports.Sink = (*store.Store)(nil)
 var dsn string
 
 func TestMain(m *testing.M) {
-	const port = 54329
+	// Port + runtime/data dirs are per-process (PID-derived) so two concurrent
+	// `go test` invocations — e.g. a push-run and a tag-run firing together in CI —
+	// don't collide on a fixed port or a shared data dir (which silently failed
+	// both runs). CachePath is shared so the PG archive is downloaded once, not
+	// per process. Base 54000 keeps this package's range distinct from web's.
+	port := uint32(54000 + os.Getpid()%1000)
 	dsn = fmt.Sprintf("postgres://postgres:postgres@localhost:%d/postgres?sslmode=disable", port)
 
+	rt := filepath.Join(os.TempDir(), fmt.Sprintf("tapir-epg-store-%d", os.Getpid()))
 	pg := embeddedpostgres.NewDatabase(
-		embeddedpostgres.DefaultConfig().Port(port),
+		embeddedpostgres.DefaultConfig().
+			Port(port).
+			RuntimePath(rt).
+			DataPath(filepath.Join(rt, "data")).
+			BinariesPath(filepath.Join(rt, "bin")).
+			CachePath(filepath.Join(os.TempDir(), "tapir-epg-cache")),
 	)
 	if err := pg.Start(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres start: %v\n", err)
@@ -40,6 +52,7 @@ func TestMain(m *testing.M) {
 	if err := pg.Stop(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres stop: %v\n", err)
 	}
+	_ = os.RemoveAll(rt)
 	os.Exit(code)
 }
 

internal/adapters/youtube/gate.go

@@ -2,6 +2,7 @@ package youtube
 
 import (
 	"context"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/time/rate"
@@ -29,9 +30,55 @@ func SetFetchRate(interval time.Duration) {
 	globalFetchGate = rate.NewLimiter(rate.Every(interval), 1)
 }
 
+// foregroundPending counts in-flight foreground (user-initiated) caption fetches.
+// The background sweep yields the gate while this is non-zero so a human waiting
+// on a click gets the next slot — and, on a near-throttled IP, the pre-429 window
+// — instead of competing equally with the firehose (ADR-026, Pillar A). Clicks are
+// rare and bursty, so background barely notices; the win to the click is large.
+var foregroundPending atomic.Int64
+
+// fgCtxKey marks a context as foreground (user-initiated). Unexported; set via
+// ForegroundContext and read via isForeground so only this package owns the key.
+type fgCtxKey struct{}
+
+// ForegroundContext marks ctx as a user-initiated (foreground) fetch so the gate
+// gives it priority. The web "Summarize"/paste/retry path wraps its context with
+// this; the background scheduler leaves it unset.
+func ForegroundContext(ctx context.Context) context.Context {
+	return context.WithValue(ctx, fgCtxKey{}, true)
+}
+
+func isForeground(ctx context.Context) bool {
+	v, _ := ctx.Value(fgCtxKey{}).(bool)
+	return v
+}
+
+// fgYieldPoll is how often a background waiter re-checks whether a foreground
+// fetch is still pending. Short enough to feel immediate, long enough not to spin.
+const fgYieldPoll = 200 * time.Millisecond
+
 // WaitFetchGate blocks until the process-wide gate allows one timedtext fetch,
 // respecting ctx cancellation. Called from httpDo before every live outbound
 // caption fetch so the scheduler and the click-path share the same egress budget.
+//
+// Foreground (user-initiated) fetches take priority: they register as pending and
+// acquire a token immediately. Background fetches first yield — they wait until no
+// foreground fetch is pending — so a live click is never stuck behind the
+// background sweep and gets the cleaner slot against the per-IP limit (ADR-026).
 func WaitFetchGate(ctx context.Context) error {
+	if isForeground(ctx) {
+		foregroundPending.Add(1)
+		defer foregroundPending.Add(-1)
+		return globalFetchGate.Wait(ctx)
+	}
+
+	// Background: defer to any pending foreground fetch before taking a token.
+	for foregroundPending.Load() > 0 {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(fgYieldPoll):
+		}
+	}
 	return globalFetchGate.Wait(ctx)
 }

internal/adapters/youtube/gate_test.go

@@ -82,3 +82,37 @@ func TestSetFetchRateZeroIsUnlimited(t *testing.T) {
 		require.NoError(t, WaitFetchGate(context.Background()))
 	}
 }
+
+func TestForegroundContextMarker(t *testing.T) {
+	require.False(t, isForeground(context.Background()), "plain context is background")
+	require.True(t, isForeground(ForegroundContext(context.Background())), "marked context is foreground")
+}
+
+// TestWaitFetchGateForegroundProceedsImmediately: a foreground fetch acquires a
+// token without yielding, even when background callers exist.
+func TestWaitFetchGateForegroundProceedsImmediately(t *testing.T) {
+	SetFetchRate(0) // unlimited limiter — isolate the yield logic from pacing
+	foregroundPending.Store(0)
+	t.Cleanup(func() { foregroundPending.Store(0) })
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	require.NoError(t, WaitFetchGate(ForegroundContext(ctx)), "foreground proceeds immediately")
+}
+
+// TestWaitFetchGateBackgroundYieldsToForeground: while a foreground fetch is
+// pending, a background fetch yields (does not take a token) until the foreground
+// clears — proven by a background wait timing out against its own deadline, then
+// succeeding once the foreground is done.
+func TestWaitFetchGateBackgroundYieldsToForeground(t *testing.T) {
+	SetFetchRate(0)
+	foregroundPending.Store(1) // simulate a foreground fetch in flight
+	t.Cleanup(func() { foregroundPending.Store(0) })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 250*time.Millisecond)
+	defer cancel()
+	require.Error(t, WaitFetchGate(ctx), "background yields (blocks) while foreground is pending")
+
+	foregroundPending.Store(0) // foreground done
+	require.NoError(t, WaitFetchGate(context.Background()), "background proceeds once foreground clears")
+}

internal/config/config.go

@@ -33,7 +33,10 @@ type Config struct {
 	SummarizerModel string
 	// FallbackModel is the LOCAL fallback alias tried when the primary fails or
 	// returns unparseable output (ADR-022). Kept local so content stays on the
-	// homelab stack. Empty disables it. Default a bigger-context local model.
+	// homelab stack. Default is an IGUANA model (not koala) so the fallback runs
+	// on a different host than the koala primary — koala carries other loads, and
+	// a different host also means a different egress IP for the (rare) fallback.
+	// Empty disables it.
 	FallbackModel string
 	// CloudFallbackModel is the worst-case EXTERNAL fallback alias, tried only
 	// after every local endpoint has failed (ADR-022). For client deployments set
@@ -148,7 +151,7 @@ func (c Config) DexConfigured() bool { return strings.TrimSpace(c.OIDCIssuer) !=
 const (
 	defaultGatewayURL            = "http://koala:30401/v1"
 	defaultSummarizerModel       = "koala/phi4-mini"
-	defaultFallbackModel         = "koala/phi4-14b"
+	defaultFallbackModel         = "iguana/gemma4-26b"
 	defaultCloudFallbackModel    = "berget/mistral-small"
 	defaultSummaryMaxTokens      = 1500
 	defaultMaxTranscriptChars    = 18000

internal/web/handlers.go

@@ -495,11 +495,22 @@ func (a *App) handleStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if row.Summarized || !a.Processing.Has(processingKey(userID, videoID)) {
+	// Honest, state-aware status (ADR-025). Order matters: a finished summary wins;
+	// an in-flight goroutine shows the working spinner; a recorded rate-limit shows
+	// the calm "waiting, will retry" card that keeps polling; a recorded "none" is
+	// terminal; anything else falls back to the normal card.
+	switch {
+	case row.Summarized:
+		a.render(w, r, VideoCard(*row))
+	case a.Processing.Has(processingKey(userID, videoID)):
+		a.render(w, r, processingCard(*row))
+	case row.TranscriptStatus == "rate_limited":
+		a.render(w, r, waitingCard(*row))
+	case row.TranscriptStatus == "none":
+		a.render(w, r, noCaptionsCard(*row))
+	default:
 		a.render(w, r, VideoCard(*row))
-		return
 	}
-	a.render(w, r, processingCard(*row))
 }
 
 // handleSummarizeMode toggles the user's auto/manual summarization mode. The form

internal/web/handlers_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -26,10 +27,22 @@ import (
 var dsn string
 
 func TestMain(m *testing.M) {
-	const port = 54330 // distinct from the store package's embedded PG (54329)
+	// Per-process port + dirs so concurrent `go test` runs (e.g. a push-run and a
+	// tag-run in CI) never collide on a fixed port or shared data dir. Base 55000
+	// keeps web's range distinct from the store package (54000). Shared CachePath
+	// downloads the PG archive once.
+	port := uint32(55000 + os.Getpid()%1000)
 	dsn = fmt.Sprintf("postgres://postgres:postgres@localhost:%d/postgres?sslmode=disable", port)
 
-	pg := embeddedpostgres.NewDatabase(embeddedpostgres.DefaultConfig().Port(port))
+	rt := filepath.Join(os.TempDir(), fmt.Sprintf("tapir-epg-web-%d", os.Getpid()))
+	pg := embeddedpostgres.NewDatabase(
+		embeddedpostgres.DefaultConfig().
+			Port(port).
+			RuntimePath(rt).
+			DataPath(filepath.Join(rt, "data")).
+			BinariesPath(filepath.Join(rt, "bin")).
+			CachePath(filepath.Join(os.TempDir(), "tapir-epg-cache")),
+	)
 	if err := pg.Start(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres start: %v\n", err)
 		os.Exit(1)
@@ -38,6 +51,7 @@ func TestMain(m *testing.M) {
 	if err := pg.Stop(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres stop: %v\n", err)
 	}
+	_ = os.RemoveAll(rt)
 	os.Exit(code)
 }
 

internal/web/processing_handler_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/stretchr/testify/require"
 
 	"gitea.d-ma.be/mathias/tapir/internal/web"
@@ -129,3 +130,42 @@ func getStatus(t *testing.T, app *web.App, videoID string) *httptest.ResponseRec
 	app.Router().ServeHTTP(rec, req)
 	return rec
 }
+
+// setTranscriptStatus stamps videos.transcript_status directly (bypassing RLS via
+// the super pool) so a test can drive the status endpoint into a given state.
+func setTranscriptStatus(t *testing.T, p *pgxpool.Pool, videoID, status string) {
+	t.Helper()
+	_, err := p.Exec(context.Background(),
+		`UPDATE videos SET transcript_status = $2 WHERE id = $1`, videoID, status)
+	require.NoError(t, err)
+}
+
+// TestStatusRateLimitedShowsWaitingCard: a click that hit YouTube's rate limit
+// must surface the honest "waiting, will retry" card that keeps polling — not a
+// silent revert to the Summarize button.
+func TestStatusRateLimitedShowsWaitingCard(t *testing.T) {
+	app := newApp(t)
+	p := rawPool(t)
+	resetDB(t, p)
+	seedVideo(t, p, videoX, "Throttled Title", "https://x", time.Time{})
+	setTranscriptStatus(t, p, videoX, "rate_limited")
+
+	html := body(t, getStatus(t, app, videoX))
+	require.Contains(t, html, "Waiting on YouTube rate limits", "honest rate-limit copy")
+	require.Contains(t, html, `hx-trigger="every 30s"`, "waiting card keeps polling so it self-resolves")
+	require.NotContains(t, html, "Summarize this video", "must not revert to the Summarize button")
+}
+
+// TestStatusNoCaptionsTerminal: a no-captions outcome is terminal — an honest
+// message, no poll, no button to click back into the same dead end.
+func TestStatusNoCaptionsTerminal(t *testing.T) {
+	app := newApp(t)
+	p := rawPool(t)
+	resetDB(t, p)
+	seedVideo(t, p, videoX, "Silent Title", "https://x", time.Time{})
+	setTranscriptStatus(t, p, videoX, "none")
+
+	html := body(t, getStatus(t, app, videoX))
+	require.Contains(t, html, "No captions available", "honest terminal copy")
+	require.NotContains(t, html, "hx-trigger", "terminal card must stop polling")
+}

internal/web/view.go

@@ -658,11 +658,30 @@ a.btn, a.btn:visited { color: var(--accent-fg); }
 .tapir-bar-fill { animation: tapir-fill 8s linear infinite; text-shadow: 0 0 6px rgba(14, 249, 182, .7); }
 @keyframes tapir-fill { 0% { clip-path: inset(0 100% 0 0); } 100% { clip-path: inset(0 0 0 0); } }
 .tapir-label { color: var(--muted); font-size: .9rem; margin: 0; }
+/* Cycling status verbs (Claude-Code / Crush style): five gerunds stacked, each
+   visible 1/5 of a 6s loop, cross-faded. The container reserves one line height
+   so the layout does not jump as verbs swap. */
+.tapir-verbs { position: relative; height: 1.3em; margin: .2em 0 0; color: var(--muted); font-size: .9rem; }
+.tapir-verbs span { position: absolute; left: 0; top: 0; white-space: nowrap; opacity: 0; animation: tapir-verb 6s steps(1, end) infinite; }
+.tapir-verbs .tv1 { animation-delay: 0s; }
+.tapir-verbs .tv2 { animation-delay: 1.2s; }
+.tapir-verbs .tv3 { animation-delay: 2.4s; }
+.tapir-verbs .tv4 { animation-delay: 3.6s; }
+.tapir-verbs .tv5 { animation-delay: 4.8s; }
+@keyframes tapir-verb { 0%, 19.99% { opacity: 1; } 20%, 100% { opacity: 0; } }
+/* Resting tapir for the rate-limit waiting state: the panel, one still frame, no
+   animation — calm, not busy, signalling "parked, not stuck". */
+.tapir-resting pre { position: relative; opacity: 1; animation: none; }
+.card-waiting { border-style: dashed; opacity: .92; }
+.card-no-captions .card-state { font-style: italic; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0; }
 @media (prefers-reduced-motion: reduce) {
   .tapir-charm pre { animation: none; }
   .tapir-charm .tapir-f2, .tapir-charm .tapir-f3 { display: none; }
   .tapir-charm .tapir-f1 { opacity: 1; }
   .tapir-bar-fill { animation: none; clip-path: inset(0 35% 0 0); }
+  .tapir-verbs span { animation: none; }
+  .tapir-verbs .tv1 { opacity: 1; }
 }
 
 /* summarization mode toggle on the account page */

internal/web/views.templ

@@ -339,7 +339,17 @@ templ TapirSpinner() {
 		<pre class="tapir-f3">@templ.Raw(tapirFrameHTML3)</pre>
 		<div class="tapir-bar"><span class="tapir-bar-fill" style={ "color:" + CharmMint }>{ tapirBarFill }</span></div>
 	</div>
-	<p class="tapir-label" role="status" aria-live="polite"><em>Summarizing…</em></p>
+	// Claude-Code / Crush-style status: playful gerunds cycle in place (CSS only,
+	// no JS). Decorative — aria-hidden — with one stable status line below for
+	// assistive tech.
+	<p class="tapir-verbs" aria-hidden="true">
+		<span class="tv1"><em>Fetching captions…</em></span>
+		<span class="tv2"><em>Chewing the cud…</em></span>
+		<span class="tv3"><em>Munching leaves…</em></span>
+		<span class="tv4"><em>Distilling the gist…</em></span>
+		<span class="tv5"><em>Summarizing…</em></span>
+	</p>
+	<p class="sr-only" role="status" aria-live="polite">Summarizing…</p>
 }
 
 // processingCard is the in-flight summarization card. It replaces the Summarize
@@ -363,6 +373,43 @@ templ processingCard(r store.SummaryRow) {
 	</li>
 }
 
+// waitingCard is the honest rate-limited state: the click landed but YouTube is
+// throttling the caption fetch, so the tapir rests and the card keeps polling
+// (gently, every 30s) until the background retry lands the summary — the user
+// never has to click again. Replaces the old silent revert to a Summarize button.
+templ waitingCard(r store.SummaryRow) {
+	<li
+		class="card card-waiting"
+		id={ "video-" + r.VideoID }
+		hx-get={ string(statusURL(r.VideoID)) }
+		hx-trigger="every 30s"
+		hx-swap="outerHTML"
+	>
+		<div class="card-title">{ displayTitle(r) }</div>
+		if cardMeta(r) != "" {
+			<div class="card-meta">{ cardMeta(r) }</div>
+		}
+		<div class="tapir-charm tapir-resting" aria-hidden="true">
+			<pre class="tapir-f1">@templ.Raw(tapirFrameHTML2)</pre>
+		</div>
+		<p class="tapir-label" role="status" aria-live="polite">
+			Waiting on YouTube rate limits. Tapir keeps trying, slowly and politely, and the summary will appear here on its own.
+		</p>
+	</li>
+}
+
+// noCaptionsCard is the terminal no-captions state: nothing to summarize, so the
+// card stops (no poll, no button to click again into the same dead end).
+templ noCaptionsCard(r store.SummaryRow) {
+	<li class="card card-no-captions" id={ "video-" + r.VideoID }>
+		<div class="card-title">{ displayTitle(r) }</div>
+		if cardMeta(r) != "" {
+			<div class="card-meta">{ cardMeta(r) }</div>
+		}
+		<p class="card-state muted">No captions available, so Tapir cannot summarize this one.</p>
+	</li>
+}
+
 // DetailPage is the full summary view: text, highlights, takeaways, metadata,
 // and the action button group.
 templ DetailPage(r store.SummaryRow) {