docs(adr): ADR-034 transcribe with two engines, reconcile with a local model

Proposed, decider pending. Two local engines on one WAV; word-level diff with pianissimo as the base (readability and timing, NOT accuracy -- that was a tie); trivial disputes resolved without a model; the rest adjudicated by a LOCAL model (alias must start koala/ or iguana/) whose only freedom is choosing between the two readings. Reconciliation never fails a job; the page says what was done and lists the uncertain spots. Off by default. Validation: re-upload the real recording and keep the feature only if the reconciled reading is right >= 85% of the time and no worse than the better single engine. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
docs(research): can a local model adjudicate two ASR transcripts?
2026-10-01 23:15:12 +02:00 · 2026-10-01 23:14:27 +02:00 · 2026-10-01 19:45:56 +02:00 · 2026-10-01 19:35:14 +02:00 · 2026-10-01 19:34:54 +02:00 · 2026-10-01 19:28:10 +02:00
52 changed files with 6330 additions and 309 deletions
@@ -50,8 +50,11 @@ These caused real mistakes that were caught and corrected; the corrections are l
 - **No global cross-tenant *video* table** — videos stay per-user (data-model). Transcripts ARE
  shared since ADR-021 (public caption content, keyed by `(provider, provider_video_id)`, non-RLS)
  so re-analysis never re-fetches; the *videos* half of cross-tenant dedup stays a Future C concern.
- **No audio-download + speech-to-text in the core path** — captions-first (ADR-007). STT is a
+- **No YouTube audio-download + speech-to-text in the core path** — captions-first (ADR-007).
-  deferred, bounded optional component.
+  That rejection stands. ADR-033 superseded the STT deferral **for user-supplied audio only**:
  an authenticated user may upload a recording and get a *private* transcript (own RLS table,
  never the shared `transcripts`). It is off by default (`TAPIR_UPLOADS_ENABLED`) and does not
  open the door to scraping audio.
 - **No public SaaS / sign-up / billing / Google OAuth verification at scale** — Future C,
  deferred behind the Stage 0 gate (ADR-008).
@@ -97,7 +100,7 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
 - Adapters present under `internal/adapters/`: `youtube` (captions-first `VideoSource`,
  timedtext/InnerTube acquisition per ADR-010), `summarizer` + `llm` (the copied AI router,
  now a resilient endpoint chain — local primary → local fallback → external worst-case,
-  parse-failure-aware, ADR-004 + ADR-022), `store` (Postgres, golang-migrate migrations 001–015),
+  parse-failure-aware, ADR-004 + ADR-022), `store` (Postgres, golang-migrate migrations 001–017),
  `secrets` (file-backed `SecretStore`). The brain HTTP sink (ADR-005) is the remaining
  optional sink.
 - Stage 1 is open (ADR-012): multi-user with **DB-enforced** isolation — Postgres RLS `FORCE`d
@@ -109,6 +112,12 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
  (`TestTranscriptsTableIsSharedNotRLS`). The engine reads stored transcripts before any caption
  fetch (`usecase.resolveTranscript`), so re-analysis — re-summarize, paste-a-URL, onboarding
  burst — never re-touches YouTube. Per-user summaries/videos stay RLS-scoped.
 - Audio upload (ADR-033, migration 017): `internal/uploads` (validation by **probing**, intake,
  one-at-a-time in-process worker), `internal/adapters/audio` (ffprobe/ffmpeg), and
  `internal/adapters/transcribe` (gateway client + iguana→berget chain). Transcripts are private
  in `uploaded_transcripts`; the audio is never retained; chat reuses `chat.Service`. The
  isolation test pins the **exact set** of non-RLS tables (`TestRowSecurityOffTablesAreExactlyTheKnownSet`).
  The runtime image does not yet contain ffmpeg — that is a pending decision recorded in ADR-033.
 - `cmd/tapir` subcommands: `list`, `show`, `auth` (interactive host-side OAuth), `run` (batch
  watch→summarize), `serve` (the HTMX+Templ web reader/writer under `internal/web`, a new
  transport over the unchanged engine/ports — ADR-003). `tapir env` prints config.
@@ -123,7 +123,9 @@ secret surface (see VISION Stage 2); it gets the existing, vetted secret path.
 ## ADR-007 — Captions-first; audio-download + speech-to-text deferred
 **Status:** Accepted (2026-06-02). Acquisition mechanism superseded by ADR-010 (Data API
-`captions.download` → player/timedtext baseUrl); captions-first stance and STT deferral stand.
+`captions.download` → player/timedtext baseUrl); captions-first stance and STT deferral stand
 **for YouTube**. STT deferral superseded **for user-supplied audio only** by ADR-033; the
 YouTube audio-download rejection is unchanged.
 **Context.** YouTube's Data API does not expose transcripts. Options: official captions
 (clean, limited coverage) vs. audio download + local Whisper (broad coverage, ToS-grey,
@@ -1314,6 +1316,330 @@ roll back. No schema, no structural change.
 ---
 ## ADR-033 — Upload audio, get a private Swedish transcript, discuss it (user-supplied STT)
 **Status:** Proposed (2026-10-01). **Decider: Mathias — pending.** Issue #33 (audio-only subset of
 #28). **Supersedes ADR-007's speech-to-text deferral for user-supplied audio only.** The
 YouTube audio-download rejection in ADR-007 **stands untouched**. Builds on ADR-012 (isolation),
 ADR-018 (single replica), ADR-021 (**the constraint**), ADR-022 (endpoint chain), ADR-025
 (honest status), ADR-027 (chat). ADR-014 item 4 ("Whisper reconsideration is a future ADR,
 gated on caption data") is a different question — whether to transcribe YouTube videos with no
 captions — and this ADR does not answer it. Measurements: `docs/research/audio-length-ceiling-2026-10-01.md`.
 **Context.** The maintainer has a concrete need: a Swedish Teams voice-only export, 30–90
 minutes, to upload and then *discuss* (what was decided, what is open, who owes what). Every
 piece exists — a Whisper endpoint on the gateway (infra#274), chat-with-transcript (ADR-027) —
 and nothing connects them.
 ADR-007 deferred STT for three reasons: yt-dlp fragility, ToS-grey scraping, and GPU contention
 with the JEPA PoC. Upload-STT shares **none** of them: the user owns the file, nothing is
 scraped, there is no caption rate gate, and the contention moved from koala to iguana. What it
 does share is landing Whisper in the codebase, which ADR-007 deferred — so a new ADR is required,
 and ADR-017's process note records the one time a guardrail-reversing change shipped without one.
 **The constraint that shapes everything.** ADR-021 made `transcripts` a shared, **non-RLS**
 table on the explicit grounds that it holds only public caption content and nothing
 user-identifying. A recorded internal meeting is the opposite: private third-party content owned
 by one user. The existing isolation test asserts `transcripts` *is* non-RLS, so a naive reuse
 would leak across tenants **and pass CI green**.
 **What was measured, not argued** (research doc above):
 - **No transcription ceiling up to 90 minutes.** One 174 MB request through the LiteLLM NodePort
  took 440 s (~12× realtime). The first failure is the public ingress `llm-api.d-ma.be`
  returning `413` above roughly 8–10 MB (~5 min of WAV) — not whisper, and not a Metal OOM.
  The 8:20 failure recorded in #33 is consistent with that cap.
 - **`response_format=srt` survives LiteLLM, wrapped** in a JSON envelope (`{"text": "<srt>"}`).
 - **The two backends differ.** `iguana/kb-whisper` returns whole-second segments;
  `berget/kb-whisper` returns sub-second times and a different `language` token.
 - **The existing chat path truncates at 18,000 chars (~22 min of speech), keeping the head.**
  #33 assumed chat "retrieves rather than generates" and so has no length ceiling. It does
  not retrieve; it stuffs the transcript into the prompt and cuts the tail. Measured against
  the offered models: `phi4-mini` 400s at ~13k tokens; `gemma4-26b` is right to 90,000 chars and
  silently drops the head at 120,000.
 **Unknowns, stated.** Real-speech accuracy; compressed-input behaviour; concurrent long jobs on
 iguana; and the Metal OOM, deliberately not provoked. (Whether the offered chat models can hold
 an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
 **Decision.**
 1. **Audio is what is used; the transcript is the only thing kept.** An authenticated user
   uploads a recording; Tapir transcribes its audio and stores the transcript. The audio itself
   is deleted after transcription (temp file, removed in a `defer`, swept at start-up) — no
   custody problem to solve, and nothing to hand to #31. **A file that also carries a video
   track is accepted: its audio is extracted, the video is discarded, and the user is told so**
   (see 4). *Amended 2026-10-01, the same day this ADR was drafted: the first draft rejected
   video and named #28. The maintainer's first real recording — a Teams meeting with the camera
   off — is still an `.mp4` with a video track, so rejecting video rejected the primary use
   case.* This keeps no video and analyses none: playback, keyframes and what-is-shown analysis
   remain #28. YouTube audio-download stays rejected. No public/anonymous upload (ADR-008).
 2. **Private store: a separate RLS-scoped table, `uploaded_transcripts`** (resolves #28's
   decision 1). `user_id NOT NULL REFERENCES users ON DELETE CASCADE`, `ENABLE` + `FORCE ROW LEVEL
   SECURITY`, the same `tapir.current_user_id` policy as every other user-owned table. It carries
   the transcript text and its timestamped segments (re-transcribing 90 minutes costs ~7
   minutes; discarding the timestamps is irreversible), `status`, the `endpoint` that served
   it, `audio_seconds`, and a typed `error_kind`. **Not** a `user_id` column on `transcripts`
   with a partial policy, even though that would reuse more code: ADR-021's exception is
   precisely that *that table holds no private row*, the isolation test asserts it has no
   `user_id`, and a partial policy would turn "single exception" into "single exception, with a
   private lane inside it" — the shape under which a future query drops the policy clause and
   leaks. Two tables keep both boundaries independently assertable.
 3. **The isolation test asserts both boundaries and the set.** (a) User A cannot read, update or
   delete user B's uploaded transcript; no GUC set → deny-all. (b) `transcripts` is still
   non-RLS with no `user_id`. (c) **The set of public-schema tables with row security off is
   asserted exactly** — so a new table added without RLS fails CI instead of passing it. (c) is
   new; the existing test only checks the named tables.
 4. **Validate by probing, reject clearly, and say what was ignored.** Format, duration and
   what a file contains cannot be read from a filename or MIME type — a Teams recording is an
   `.mp4` whether or not the camera was on. The upload is probed (`ffprobe`): **accept any
   container with an audio stream, whether or not it also has a video stream** (an mp3's cover
   art counts as neither). Whether a real video track was present is recorded on the row
   (`had_video`) and the transcript page says so plainly — *this file contained a video track;
   only its audio was used and the video was discarded* — so the user is never left to wonder
   what happened to the picture. Reject a file with **no** audio stream (including a screen
   recording with no microphone) and an unreadable one. Limits, all configurable, all rejected
   synchronously with a specific message rather than by timeout: **200 MB** upload and
   **90 minutes** duration. 90 minutes is *the longest length measured*, not a ceiling that was
   found; raising it is a measurement, not an edit. The size cap now matters more: a video file
   is much larger than its audio and is spooled whole before the audio is extracted, so a long
   recording with screen sharing can exceed 200 MB while its audio is a few tens of MB.
 5. **Transcode server-side, always, to 16 kHz mono PCM WAV** — even when the input already is,
   rather than assuming. whisper-server's `--convert` is rejected (its `--tmp-dir` is created at
   process start and rots under macOS periodic cleanup). The transcoder sits behind a port; the
   tests use a fake. **This puts `ffmpeg` and `ffprobe` in the runtime image**, which is
   distroless-static today. **Provisional: copy static ffmpeg/ffprobe binaries into the existing
   distroless image** (no shell, no package manager retained). This is a heavy new dependency
   and is **the maintainer's call** — see Open items.
 6. **Transcription adapter via the gateway, never the public hostname.** A `Transcriber` port;
   the implementation calls `POST {TAPIR_GATEWAY_URL}/audio/transcriptions` where the gateway
   URL is the in-cluster NodePort (`koala:30401/v1`). Primary `iguana/kb-whisper`, fallback
   `berget/kb-whisper` (immune to iguana contention, which can wedge permanently — infra#273).
   - **Fallback triggers on any primary failure** (transport error, timeout, non-2xx). It never
     branches on the body: `{"error":"failed to process audio"}` has had at least five distinct
     causes.
   - **`response_format=verbose_json`**, normalised to one segment shape: times clamped to the
     audio duration (the final segment can end past it), one language token. Not `srt`: the
     envelope adds a parse step and iguana's segment timing is the same either way.
   - **No chunking in v1.** Nothing failed to 90 minutes (measured). Chunk-and-stitch is the
     answer *if* the cap is raised or smaller requests become necessary — see triggers.
   - **The serving endpoint is recorded per row**, and surfaced, because the two backends
     differ in timestamp granularity: which one served a transcript is a quality fact.
   - **Berget is a cloud endpoint.** On fallback the audio of a private meeting leaves the
     homelab. #33 asks for this fallback; it is configurable (`TAPIR_TRANSCRIBE_FALLBACK_MODEL`,
     empty disables), recorded per row, and called out in Open items rather than defaulted
     silently.
   - Swedish only (`language=sv`). Language detection and routing (#28 decision 2) are not
     touched.
   - `-H 'Expect:'`, multipart field `file` — encoded in the adapter and its tests, not rediscovered.
 7. **Jobs run in-process, one at a time (ADR-018 stands).** Transcription is minutes (~7.5 min
   for 90) but a single goroutine behind a one-slot semaphore: two simultaneous 90-minute jobs on
   iguana were not measured, so concurrency is 1 until they are. No worker, no new deployable,
   no second replica. Honest status per ADR-025: `queued → transcribing → done | failed`, polled
   by the same `/status` pattern, every terminal state a rendered card, never a stuck spinner.
   Audio is not retained, so a restart mid-job **cannot resume**: at start-up any
   `queued`/`transcribing` row is marked `failed` with `error_kind = interrupted`, and the user
   re-uploads. The single-replica assumption gains a second dependent (the semaphore is
   process-local) and is recorded here.
 8. **Chat reuses `chat.Service`; it is not forked.** The uploaded-transcript chat handlers
   look the row up through the RLS-scoped store, so a non-owner gets 404 by the same mechanism
   as ADR-027's summary gate, **before any model is called**. ADR-027's decisions (ephemeral,
   switchable models, trust-the-model) carry over unchanged. **Two things must differ, and both
   were measured** (`docs/research/chat-context-over-long-transcripts-2026-10-01.md`):
   - **The transcript budget.** The 18,000-char caption default cuts a one-hour meeting to its
     first third. Uploaded transcripts take their own `TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS`,
     default **90,000** — the measured ceiling of the best offered model (`iguana/gemma4-26b`),
     which answers correctly there but **silently loses the head of a 120,000-char transcript**
     with no error and no truncation flag. (An earlier draft of this ADR proposed 120,000 as a
     guess; the measurement refuted it.) The mechanism is a per-request `chat.Request.MaxChars`.
   - **The opening model.** The offered list leads with the summarizer default `koala/phi4-mini`,
     whose 8,192-token context returns HTTP 400 on an hour of speech (~13,000 tokens). Chat over
     an upload opens on `TAPIR_UPLOAD_CHAT_MODEL` (default `iguana/gemma4-26b`); the switcher
     still lists every model, and picking `phi4-mini` on a long recording fails loudly and
     inline. A per-model budget is not built.
   Past ~90,000 chars (≈100 minutes) no offered model can answer by stuffing; see triggers.
 9. **Not decided here.** Rich `AVSNITT`/`ALTERNATIV` analysis (gated on #30 — `analyze_srt.py`
   hardcodes `max_tokens: 6000`); video, keyframes, synced playback (#28); language detection;
   per-transcript deletion UX (account deletion cascades; see Open items); retention of audio.
 **On the sequencing question #28 asks of itself** — *is this the thing that best serves the
 Stage-0 gate, or the most interesting thing to build?* Recorded answer: it proceeds **ahead of
 #32** (the demand test) as the maintainer's explicit, knowing call (#28, comment of 2026-10-01),
 on a concrete need rather than speculation. It is not a return-nudge (ADR-020/027): it adds
 nothing that prompts a user to come back, so it does not contaminate the unprompted-return signal
 ADR-016 measures. The honest risk is the one ADR-016 names: it is larger than anything ADR-020
 deferred. The scope cut — chat first, no rich analysis, no video — is what keeps it bounded.
 **Consequences.**
 - **Positive.** The user's request is met end to end with existing parts. ADR-021's exception stays
  singular and now provably so. The measured ceiling removes chunking from v1. No audio is stored.
 - **Negative / watch.**
  - Tapir's runtime image gains `ffmpeg`: a larger image and a new CVE surface to patch.
  - iguana becomes load-bearing for a user-facing feature (#28 decision 3; infra#273 is still the
    dependency that matters) — a Metal OOM now means *every upload fails over to berget*, i.e.
    private audio leaving the homelab, silently unless the per-row endpoint is surfaced.
  - A 90-minute job holds the single slot for ~7.5 minutes; a second user's upload queues behind it.
  - Chat over a long transcript is bounded by model context, not by anything in Tapir, and the
    failure at the edge is *silent* for gemma (the head is dropped, no error). The 90,000 default
    sits just inside the measured limit and is only as good as that single measurement.
  - **The default chat model for uploads is a large ollama model on iguana — the same host as
    `iguana/kb-whisper`.** infra#273 is exactly that a large resident ollama model can Metal-OOM
    whisper-server permanently. Chatting with a transcript can therefore load the model that
    wedges the transcriber. Not solved here; the berget fallback limits the blast radius.
  - Tapir's own ingress body limit for a 200 MB upload is **unverified** (it lives in `infra`).
  - Accepting video means large files are spooled before their audio is extracted, and ffmpeg
    demuxes (but, with `-vn`, does not decode) video it then throws away. A client-side audio
    extraction would avoid the upload cost; it is not built.
 **Validation / resolution triggers** (each observable by someone other than the author):
 - *Chunking*: build it when the duration cap is raised above 90 min, or when a measured
  request at the current cap fails with whisper-side (not ingress) errors.
 - *Berget-first*: if more than a quarter of uploads in any week are served by the fallback,
  swap the primary/fallback order and revisit infra#273.
 - *Retrieval chat*: build chunked retrieval when a recording's transcript exceeds the measured
  90,000-char ceiling (≈100 minutes) — i.e. the moment the duration cap is raised above that, or a
  real recording turns out denser than the fixture — or when the offered model list changes and
  the ceiling is re-measured lower.
 - *Worker*: if a transcription job ever degrades the reading UI, or Tapir runs more than one
  replica, ADR-018 is revisited.
 - *The decision itself*: if the maintainer has not used the feature unprompted within the
  ADR-016 window, it was the interesting thing, not the useful one — remove it.
 **Open items this ADR creates.**
 - **DECISION NEEDED — ffmpeg in the runtime image.** *Options:* (A) static ffmpeg/ffprobe copied
  into distroless **(recommended — the only option that satisfies "accept m4a/mp3/opus/mp4,
  validate duration, reject video"; pure-Go decoders cover wav/mp3 only)**; (B) accept WAV
  only, convert client-side (fails "I just want to upload it"); (C) a transcode sidecar
  (second deployable, ADR-018's reasoning against). *Blocks:* the Dockerfile slice, not the
  tests, which use the port.
 - **DECISION NEEDED — berget fallback for private audio.** *Options:* (A) enabled by default as
  #33 specifies, with the serving endpoint shown **(recommended, matches the issue)**; (B)
  disabled by default, a failed iguana job fails honestly and the user retries. *Blocks:*
  the production default only; the adapter ships either way.
 - Verify Tapir's ingress `proxy-body-size` against the 200 MB cap (`infra`).
 - Per-transcript deletion is not built; account deletion cascades. A private-content store
  without a delete button is a gap worth a ticket, not a silent omission.
 **Reversibility.** Additive: one table (down-migration drops it), one adapter, one upload
 surface, one image change. Removing the upload route removes the feature; `transcripts`, `videos`
 and ADR-021 are untouched.
 ---
 ## ADR-034 — Transcribe with two engines and let a local model reconcile their disagreements
 **Status:** Proposed (2026-10-01). **Decider: Mathias — pending.** Issue #40 (decision B) and #33.
 Builds on ADR-033 (private upload transcripts), ADR-022 (endpoint chain, a pattern reused), ADR-018
 (single replica), ADR-025 (honest status). Evidence:
 `docs/research/asr-kb-whisper-vs-pianissimo-2026-10-01.md` and
 `docs/research/local-model-adjudicator-sweep-2026-10-01.md`.
 **Context.** On the first real one-hour recording `iguana/kb-whisper` and `iguana/pianissimo` were
 a near tie on accuracy (the speaker's blind verdicts on the 30 meaning-changing disagreements:
 pianissimo 17, kb-whisper 13) and they **err in different places**: pianissimo is better on terms and
 numbers, kb-whisper on ordinary words; kb-whisper's errors garble, pianissimo's read as plausible.
 Pianissimo is ~6x faster (40 s vs 4m08s for 63.7 min) and runs through the same adapter. Two engines
 that disagree in ~380 places per hour, with a ~92% word agreement, is information a single-engine
 pipeline throws away. Separately, eleven local models were scored on adjudicating those disagreements
 against the speaker's answers: **`gemma4-31b` 97% and `gemma4-26b` 92%** passed the pre-set bar
 (>= 80% accuracy, >= 85% order-swap consistency, <= 10% unparseable), nothing else did.
 **Unknowns, stated.** The adjudicator evidence is 30 items from one speaker and one domain, chosen by
 Opus as decidable; the other ~350 disagreements (fillers, compounds, small words) have no ground
 truth. Whether a *merged* transcript is better than the better single engine has not been measured.
 Reconcile time per hour is estimated, not measured. `gemma4-31b`'s slowness is unexplained (Low Power
 Mode on iguana is the unproven suspect).
 **Decision.**
 1. **Two engines, one WAV, both local, one after the other.** Each upload is transcribed by
   `iguana/pianissimo` and `iguana/kb-whisper` from the same converted WAV, sequentially (concurrency
   stays 1, ADR-033). Each engine fails independently; the berget fallback (ADR-033) applies only when
   **both** fail. Off by default: with no second engine configured nothing changes.
 2. **Align by word, with pianissimo as the base text.** Both texts are tokenised (lower case, letters
   and digits only) and diffed word by word (Myers); neighbouring differences separated by a single
   equal word are merged into one **dispute**. The base is pianissimo: sentence-level prose with
   punctuation and millisecond timestamps, where kb-whisper's output is wrapped fragments. **This
   choice is about readability and timing, not accuracy — accuracy was a tie — so it is the cheaper
   mistake, not a measured winner.** A replaced span takes the alternative's own words.
 3. **Resolve the trivial ones without a model.** A dispute that is identical once spaces are removed
   (a compound split or joined) keeps the base; so does a dispute that is only a short filler word
   on one side. Everything else is adjudicated. (Opus's classification of 380 disputes found ~46
   compound and ~26 punctuation-only residue, ~65 filler.)
 4. **A local model adjudicates the rest, bounded.** Each dispute goes to a local chat model (default
   `iguana/gemma4-26b`; `gemma4-31b` is configurable and scored higher but is ~5x slower) with ~100
   words of context either side and the two readings, in the wording that was measured. The reading
   order alternates by dispute so position bias averages out. The verdict is *base*, *alternative* or
   *unsure*; **unsure keeps the base and is flagged**. An optional order-check mode asks twice with the
   order swapped and treats disagreement as unsure; it is **off by default** because it doubles the time
   and the measured consistency of the passing models is 93%.
   - **The model must be local.** Its alias must begin `koala/` or `iguana/`; a cloud alias is a
     start-up configuration error. Private meeting content never goes to a cloud model for this step.
   - **Bounded impact.** The reconciler can only choose between two readings the engines already
     produced; it cannot write new text. Speech that says "answer 2" can at worst flip one dispute.
 5. **Reconciliation never fails a job.** One engine fails → its text is used, recorded as
   single-engine. The adjudicator is down (three consecutive errors) → the base text is used
   unreconciled, recorded as skipped with the reason, and the remaining disputes are not retried one
   timeout at a time. Both engines fail → ADR-033's fallback path.
 6. **What is stored and shown.** `content` is the merged text. `segments` stay the base engine's timed
   segments, untouched: `content` is authoritative for chat, `segments` only for time. `endpoint`
   lists every contributor and the reconciler. A new `reconciliation` column (migration 019, same
   RLS-scoped table) records the status, counts, and the **uncertain and changed spots with a minute
   mark and both readings**, so the user can check them against the audio. The transcript page says in
   plain words what was done — "reconciled from two transcripts: N differences, K uncertain" — and
   lists the uncertain spots. A reconciled transcript is never presented as simply "the" transcript.
 7. **Configuration.** `TAPIR_TRANSCRIBE_SECOND_MODEL` (empty = off), `TAPIR_RECONCILE_MODEL`
   (required when a second engine is set), `TAPIR_RECONCILE_CHECK_ORDER` (off). The default job
   timeout rises from 30 to 60 minutes: ~4 min of kb-whisper and ~40 s of pianissimo per hour of audio,
   plus the adjudication.
 8. **Not decided here.** A cloud adjudicator (rejected: private content); tuning the prompt; making
   `gemma4-31b` the default; a "reconciling" progress state (the page says "transcribing" for the whole
   job); feeding the uncertain spots to chat; whether pianissimo should also be a middle tier in the
   fallback chain (#40, option A).
 **Consequences.**
 - **Positive.** Uses the finding that the engines err differently; stays local end to end; degrades
  to today's behaviour at every failure; and is honest on the page about what it did.
 - **Negative / watch.**
  - Job time grows: roughly 300 adjudicated disputes x ~2 s on `gemma4-26b` ~ 10 minutes per hour of
    audio — an estimate, not a measurement; double with order-check on, ~5x with `gemma4-31b`.
  - Two gemma-class calls sit on iguana beside whisper. During the sweep a 17-20 GB model was resident
    beside whisper-server without wedging it, far below the 52 GB that did (infra#273); the hazard is
    reduced, not removed.
  - A merged transcript can be wrong where both engines are wrong, and where the adjudicator picks
    the wrong one (it was right 92% on a hand-picked set, ~97% for 31b).
  - Reading the page takes more words: the reconciliation summary is new surface to keep honest.
 **Validation / resolution triggers.**
 - **The test that decides it:** re-upload the same real recording after merge; the speaker judges, blind,
  ~30 disputes where the reconciled text differs from pianissimo alone. Keep the feature only if the
  reconciled reading is right at least 85% of the time **and** no worse than the better single engine.
  If not, switch it off (config) and keep the single-engine path.
 - Reconcile time above 25 minutes per hour of audio: drop to a smaller adjudicator or skip more
  disputes automatically.
 - A different recording or speaker in which the engines agree far less (or far more): re-measure before
  trusting the 92%/97% figures.
 **Reversibility.** Off by default and additive: the second engine, the reconciler and the column are
 unused when the settings are empty; the down-migration drops the column; the single-engine path is
 unchanged.
 ---
 ## Rejected alternatives
 Approaches considered during the 2026-06-02 planning + grill session and **deliberately not
@@ -1338,6 +1664,11 @@ maps to the ADR that settles it.
 | Reverse the Dex-write invite flow (Google OIDC only) | Some intended Future-B users won't use Google; OIDC-only leaves them with no onboarding path — invite flow is load-bearing | ADR-017 |
 | k8s CronJob for scheduled discovery (vs in-process) | At Future-B scale the in-process scheduler is simpler to deploy; CronJob's failure-isolation benefit was weighed and traded away knowingly (revisit if >1 replica or load grows) | ADR-018 |
 | Cached-transcript-first onboarding burst (instant, zero-fetch picks) | Live pilot DB: ~3% cross-user video overlap, 0 cached-and-unsummarized, a new user's newest-20 are 20/20 uncached — newest-first and cached-first are structurally incompatible. Empty lever at pilot scale | ADR-028 |
 | Uploaded transcripts as a `user_id` column + partial RLS policy on `transcripts` | Turns ADR-021's single exception into an exception with a private lane inside it; the isolation test asserts `transcripts` has no `user_id`. A separate RLS table keeps both boundaries independently assertable | ADR-033 |
 | whisper-server `--convert` for server-side transcode | Its `--tmp-dir` is created at process start and rots under macOS periodic cleanup | ADR-033 |
 | Calling the public `llm-api.d-ma.be` from in-cluster Tapir | Its ingress returns 413 above ~8–10 MB (~5 min of WAV); the NodePort has no such cap | ADR-033 |
 | A cloud model (e.g. Opus) as the adjudicator | It scored 30/30 but would send private meeting content to a cloud API; local gemma4-26b/31b passed the same bar | ADR-034 |
 | Pick one engine globally (pianissimo only, or kb-whisper only) | A near tie on accuracy with different error profiles; choosing one discards the information in their disagreement | ADR-034 |
 If a future case genuinely reopens one of these, that's a new ADR superseding the relevant one —
 not a silent reversal.
@@ -0,0 +1,176 @@
 package main
 import (
 	"context"
 	"fmt"
 	"io"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 	embeddedpostgres "github.com/fergusstrange/embedded-postgres"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/config"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
 // TestE2E_UploadTranscribeAndChat is the end-to-end check for tapir#33: upload a
 // real audio file, watch it become a transcript through the REAL ffprobe, ffmpeg
 // and gateway, then ask a question and get a grounded answer from a REAL model.
 // It is opt-in — it needs real binaries and the live gateway — and skipped unless
 // TAPIR_E2E_AUDIO is set:
 //
 //	TAPIR_E2E_AUDIO=/path/meeting.m4a TAPIR_E2E_FFMPEG=/path/ffmpeg \
 //	TAPIR_E2E_FFPROBE=/path/ffprobe TAPIR_E2E_QUESTION='Vem ansvarar för virket?' \
 //	TAPIR_E2E_EXPECT=anders op run --env-file ~/.op-env -- \
 //	  go test ./cmd/tapir -run E2E_Upload -v -count=1
 //
 // Use SYNTHETIC audio only: this repo is public, and a fallback to berget sends
 // the audio to a cloud endpoint (#33).
 func TestE2E_UploadTranscribeAndChat(t *testing.T) {
 	audioPath := os.Getenv("TAPIR_E2E_AUDIO")
 	if audioPath == "" {
 		t.Skip("set TAPIR_E2E_AUDIO (and friends) to run the live end-to-end check")
 	}
 	key := os.Getenv("LITELLM_MASTER_KEY")
 	require.NotEmpty(t, key, "LITELLM_MASTER_KEY must be set (via op run)")
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 	// A private embedded Postgres: nothing here may touch a real database.
 	port := uint32(55000 + os.Getpid()%1000)
 	rt := filepath.Join(os.TempDir(), fmt.Sprintf("tapir-epg-e2e-%d", os.Getpid()))
 	pg := embeddedpostgres.NewDatabase(embeddedpostgres.DefaultConfig().Port(port).
 		RuntimePath(rt).DataPath(filepath.Join(rt, "data")).BinariesPath(filepath.Join(rt, "bin")).
 		CachePath(filepath.Join(os.TempDir(), "tapir-epg-cache")))
 	require.NoError(t, pg.Start())
 	t.Cleanup(func() { _ = pg.Stop(); _ = os.RemoveAll(rt) })
 	dsn := fmt.Sprintf("postgres://postgres:postgres@localhost:%d/postgres?sslmode=disable", port)
 	st, err := store.New(ctx, dsn)
 	require.NoError(t, err)
 	t.Cleanup(st.Close)
 	raw, err := pgxpool.New(ctx, dsn)
 	require.NoError(t, err)
 	t.Cleanup(raw.Close)
 	const uid = "11111111-1111-1111-1111-111111111111"
 	_, err = raw.Exec(ctx, `INSERT INTO users (id) VALUES ($1)`, uid)
 	require.NoError(t, err)
 	_, err = raw.Exec(ctx, `INSERT INTO user_identities (dex_subject, user_id) VALUES ('e2e', $1)`, uid)
 	require.NoError(t, err)
 	cfg, err := config.Load()
 	require.NoError(t, err)
 	cfg.GatewayKey = key
 	cfg.UploadsEnabled = true
 	cfg.UploadTmpDir = filepath.Join(t.TempDir(), "spool")
 	cfg.FFmpegBin = envOrDefault("TAPIR_E2E_FFMPEG", "ffmpeg")
 	cfg.FFprobeBin = envOrDefault("TAPIR_E2E_FFPROBE", "ffprobe")
 	intake, worker, err := buildUploads(ctx, cfg, st, quietLog())
 	require.NoError(t, err)
 	go worker.Run(ctx)
 	app := &web.App{
 		Store: st, Identity: st, Auth: web.StubAuth{U: web.User{Subject: "e2e"}},
 		Chat: buildChat(cfg),
 	}
 	wireUploads(app, cfg, intake) // the same wiring cmdServe uses
 	srv := httptest.NewServer(app.Router())
 	t.Cleanup(srv.Close)
 	noRedirect := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
 	// 1. Upload.
 	f, err := os.Open(audioPath)
 	require.NoError(t, err)
 	defer f.Close()
 	pr, pw := io.Pipe()
 	mw := multipart.NewWriter(pw)
 	go func() {
 		_ = mw.WriteField("title", "E2E recording")
 		fw, _ := mw.CreateFormFile("file", filepath.Base(audioPath))
 		_, _ = io.Copy(fw, f)
 		_ = mw.Close()
 		_ = pw.Close()
 	}()
 	req, err := http.NewRequest(http.MethodPost, srv.URL+"/uploads", pr)
 	require.NoError(t, err)
 	req.Header.Set("Content-Type", mw.FormDataContentType())
 	resp, err := noRedirect.Do(req)
 	require.NoError(t, err)
 	_ = resp.Body.Close()
 	require.Equal(t, http.StatusSeeOther, resp.StatusCode, "an accepted upload redirects to its page")
 	loc := resp.Header.Get("Location")
 	require.True(t, strings.HasPrefix(loc, "/uploads/"), loc)
 	t.Logf("accepted -> %s", loc)
 	// 2. Wait for the transcript: unfinished states poll, terminal states do not.
 	var page string
 	require.Eventually(t, func() bool {
 		r, err := http.Get(srv.URL + loc + "/status")
 		if err != nil {
 			return false
 		}
 		b, _ := io.ReadAll(r.Body)
 		_ = r.Body.Close()
 		page = string(b)
 		return !strings.Contains(page, "hx-trigger")
 	}, 12*time.Minute, 3*time.Second, "the upload never reached a terminal state")
 	require.Contains(t, page, "Transcribed", "terminal state was not 'done': %.300s", page)
 	var status, endpoint, content string
 	var secs float64
 	var hadVideo bool
 	require.NoError(t, raw.QueryRow(ctx,
 		`SELECT status, endpoint, content, audio_seconds, had_video FROM uploaded_transcripts WHERE user_id = $1`, uid).
 		Scan(&status, &endpoint, &content, &secs, &hadVideo))
 	t.Logf("done: endpoint=%s audio_s=%.1f transcript_chars=%d had_video=%v", endpoint, secs, len(content), hadVideo)
 	if os.Getenv("TAPIR_E2E_HAD_VIDEO") == "1" {
 		// A Teams meeting with the camera off: a video file whose audio is what matters.
 		assert.True(t, hadVideo, "the file had a video track and the row must say so")
 		assert.Contains(t, page, "Only its audio was used", "and the user must be told")
 	}
 	assert.Equal(t, "done", status)
 	assert.NotEmpty(t, endpoint)
 	assert.NotEmpty(t, content)
 	entries, err := os.ReadDir(cfg.UploadTmpDir)
 	require.NoError(t, err)
 	assert.Empty(t, entries, "the audio must be deleted once transcribed")
 	// 3. Ask a question; the answer must come from the transcript.
 	q := envOrDefault("TAPIR_E2E_QUESTION", "Who is responsible for the timber order?")
 	chatResp, err := http.PostForm(srv.URL+loc+"/chat", url.Values{"question": {q}})
 	require.NoError(t, err)
 	answerPage, _ := io.ReadAll(chatResp.Body)
 	_ = chatResp.Body.Close()
 	require.Equal(t, http.StatusOK, chatResp.StatusCode)
 	t.Logf("question: %s", q)
 	if want := os.Getenv("TAPIR_E2E_EXPECT"); want != "" {
 		assert.Contains(t, strings.ToLower(string(answerPage)), strings.ToLower(want),
 			"the answer should be grounded in the transcript")
 	}
 	t.Logf("answer page excerpt: %.600s", afterMarker(string(answerPage), `class="chat-turn chat-a"`))
 }
 func envOrDefault(k, d string) string {
 	if v := os.Getenv(k); v != "" {
 		return v
 	}
 	return d
 }
 func afterMarker(s, m string) string {
 	if i := strings.Index(s, m); i >= 0 {
 		return s[i:]
 	}
 	return "(no answer turn found)"
 }
@@ -207,6 +207,26 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 		log.Info("web chat enabled (stored-transcript only)", "models", chatModels(cfg))
 	}
 	// Audio upload -> private transcript (ADR-033). Off unless TAPIR_UPLOADS_ENABLED:
 	// the image must carry ffmpeg first. The worker is IN-PROCESS and one job at a
 	// time, so it inherits the single-replica assumption below (its queue is
 	// process-local); it stops with the same ctx as the server.
 	intake, worker, err := buildUploads(ctx, cfg, st, log)
 	if err != nil {
 		return err
 	}
 	wireUploads(app, cfg, intake)
 	if intake != nil {
 		go worker.Run(ctx)
 		log.Info("audio upload enabled", "model", cfg.TranscribeModel, "fallback", cfg.TranscribeFallbackModel,
 			"max_mb", cfg.UploadMaxBytes>>20, "max_minutes", int(cfg.UploadMaxDuration.Minutes()))
 		log.Warn("audio upload assumes a SINGLE replica: the transcription queue is process-local (ADR-033, ADR-018)")
 		if cfg.TranscribeFallbackModel != "" {
 			log.Warn("audio upload fallback is a CLOUD endpoint: if the primary fails, private audio leaves the homelab",
 				"fallback", cfg.TranscribeFallbackModel)
 		}
 	}
 	// User onboarding is handled by the IdP (Authentik invite flow), not Tapir —
 	// the Dex local-password provisioning path was removed (ADR-019). An
 	// authenticated subject with no Tapir user is routed to /register.
@@ -0,0 +1,100 @@
 package main
 import (
 	"context"
 	"fmt"
 	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
 	"git.d-ma.be/mathias/tapir/internal/adapters/audio"
 	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
 	"git.d-ma.be/mathias/tapir/internal/config"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
 // uploadsStore is the store surface the upload wiring needs. *store.Store
 // satisfies it.
 type uploadsStore interface {
 	uploads.Store
 	uploads.WorkerStore
 	FailInterruptedUploads(ctx context.Context) (int, error)
 }
 // buildUploads wires audio upload and private transcription (ADR-033). It returns
 // nils when uploads are disabled — never a typed-nil Intake, which would mount the
 // /uploads routes over nothing. When enabled it, in order: prepares a private spool
 // directory, deletes any audio a crashed run left in it, fails the rows such a run
 // left queued or transcribing (the audio is not retained, so they can never
 // resume), and only then builds the intake and the worker. The caller runs the
 // worker. The fallback endpoint is a cloud service; an empty
 // TAPIR_TRANSCRIBE_FALLBACK_MODEL keeps private audio on the homelab.
 func buildUploads(ctx context.Context, cfg config.Config, st uploadsStore, log *slog.Logger) (*uploads.Intake, *uploads.Worker, error) {
 	if !cfg.UploadsEnabled {
 		return nil, nil, nil
 	}
 	if cfg.GatewayURL == "" {
 		return nil, nil, fmt.Errorf("uploads: TAPIR_UPLOADS_ENABLED is set but there is no TAPIR_GATEWAY_URL to transcribe through")
 	}
 	if err := os.MkdirAll(cfg.UploadTmpDir, 0o700); err != nil {
 		return nil, nil, fmt.Errorf("uploads: spool dir: %w", err)
 	}
 	removeSpooledAudio(cfg.UploadTmpDir, log)
 	n, err := st.FailInterruptedUploads(ctx)
 	if err != nil {
 		return nil, nil, fmt.Errorf("uploads: fail interrupted rows: %w", err)
 	}
 	if n > 0 {
 		log.Warn("uploads: marked interrupted by a restart (audio is not retained; they must be re-uploaded)", "count", n)
 	}
 	// No overall client timeout: a 90 minute recording takes minutes. The deadline
 	// is the worker's per-job context.
 	client := &http.Client{}
 	primary := transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, cfg.TranscribeModel, client)
 	var fallback transcribe.Backend
 	if cfg.TranscribeFallbackModel != "" && cfg.TranscribeFallbackModel != cfg.TranscribeModel {
 		fallback = transcribe.NewGateway(cfg.GatewayURL, cfg.GatewayKey, cfg.TranscribeFallbackModel, client)
 	}
 	worker := uploads.NewWorker(st, &audio.FFmpeg{Bin: cfg.FFmpegBin}, transcribe.NewChain(primary, fallback),
 		cfg.UploadTmpDir, cfg.TranscribeTimeout)
 	intake := uploads.NewIntake(st, &audio.FFprobe{Bin: cfg.FFprobeBin}, worker,
 		uploadLimits(cfg), cfg.UploadTmpDir)
 	return intake, worker, nil
 }
 func uploadLimits(cfg config.Config) uploads.Limits {
 	return uploads.Limits{MaxBytes: cfg.UploadMaxBytes, MaxDuration: cfg.UploadMaxDuration}
 }
 // removeSpooledAudio deletes the spool files this process family creates
 // (upload-*, wav-*) and nothing else.
 func removeSpooledAudio(dir string, log *slog.Logger) {
 	for _, pat := range []string{"upload-*", "wav-*"} {
 		matches, _ := filepath.Glob(filepath.Join(dir, pat))
 		for _, m := range matches {
 			if err := os.Remove(m); err != nil {
 				log.Warn("uploads: remove leftover audio", "path", m, "err", err)
 			}
 		}
 	}
 }
 // wireUploads connects a built Intake to the web App: the routes, the limits the
 // form states, and the chat settings for an uploaded recording. A nil intake
 // leaves the App untouched — assigning a nil *Intake to the Uploader interface
 // would produce a non-nil interface and mount the routes over nothing.
 func wireUploads(app *web.App, cfg config.Config, in *uploads.Intake) {
 	if in == nil {
 		return
 	}
 	app.Uploads = in
 	app.UploadLimits = uploadLimits(cfg)
 	app.UploadChatMaxChars = cfg.MaxUploadedTranscriptChars
 	app.UploadChatModel = cfg.UploadChatModel
 }
@@ -0,0 +1,156 @@
 package main
 import (
 	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/config"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
 // fakeUploadsStore satisfies the store surface buildUploads needs, and counts the
 // start-up sweep.
 type fakeUploadsStore struct {
 	sweeps   int
 	sweepErr error
 }
 func (f *fakeUploadsStore) CreateUpload(context.Context, string, string, bool) (string, error) {
 	return "id", nil
 }
 func (f *fakeUploadsStore) FailUpload(context.Context, string, string, domain.UploadErrorKind) error {
 	return nil
 }
 func (f *fakeUploadsStore) StartTranscribing(context.Context, string, string) error { return nil }
 func (f *fakeUploadsStore) CompleteUpload(context.Context, string, string, domain.Transcription) error {
 	return nil
 }
 func (f *fakeUploadsStore) FailInterruptedUploads(context.Context) (int, error) {
 	f.sweeps++
 	return 2, f.sweepErr
 }
 func uploadCfg(t *testing.T, enabled bool) config.Config {
 	t.Helper()
 	var cfg config.Config
 	cfg.GatewayURL = "http://gateway.invalid/v1"
 	cfg.UploadsEnabled = enabled
 	cfg.UploadMaxBytes = 200 << 20
 	cfg.UploadTmpDir = filepath.Join(t.TempDir(), "spool")
 	cfg.TranscribeModel = "iguana/kb-whisper"
 	cfg.TranscribeFallbackModel = "berget/kb-whisper"
 	return cfg
 }
 func TestBuildUploads_DisabledMountsNothingAndSweepsNothing(t *testing.T) {
 	st := &fakeUploadsStore{}
 	in, w, err := buildUploads(context.Background(), uploadCfg(t, false), st, quietLog())
 	require.NoError(t, err)
 	assert.Nil(t, in, "a typed-nil Intake must never reach web.App.Uploads: it would mount the routes over nothing")
 	assert.Nil(t, w)
 	assert.Zero(t, st.sweeps)
 }
 func TestBuildUploads_EnabledFailsInterruptedRowsBeforeAnythingElseStarts(t *testing.T) {
 	st := &fakeUploadsStore{}
 	in, w, err := buildUploads(context.Background(), uploadCfg(t, true), st, quietLog())
 	require.NoError(t, err)
 	require.NotNil(t, in)
 	require.NotNil(t, w)
 	assert.Equal(t, 1, st.sweeps,
 		"audio is not retained, so rows left queued/transcribing by a restart can never resume: fail them at start-up, not never")
 }
 func TestBuildUploads_SweepFailureStopsStartup(t *testing.T) {
 	st := &fakeUploadsStore{sweepErr: errors.New("db down")}
 	_, _, err := buildUploads(context.Background(), uploadCfg(t, true), st, quietLog())
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "db down")
 }
 func TestBuildUploads_CreatesTheSpoolDirectoryPrivately(t *testing.T) {
 	cfg := uploadCfg(t, true)
 	_, _, err := buildUploads(context.Background(), cfg, &fakeUploadsStore{}, quietLog())
 	require.NoError(t, err)
 	info, err := os.Stat(cfg.UploadTmpDir)
 	require.NoError(t, err)
 	assert.True(t, info.IsDir())
 	assert.Equal(t, os.FileMode(0o700), info.Mode().Perm(), "spooled audio is private third-party content")
 }
 func TestBuildUploads_EnabledWithoutAGatewayIsAnError(t *testing.T) {
 	cfg := uploadCfg(t, true)
 	cfg.GatewayURL = ""
 	_, _, err := buildUploads(context.Background(), cfg, &fakeUploadsStore{}, quietLog())
 	assert.Error(t, err, "uploads on with nowhere to transcribe must fail loudly at start-up, not at the first upload")
 }
 func TestBuildUploads_RemovesAudioLeftBehindByACrash(t *testing.T) {
 	cfg := uploadCfg(t, true)
 	require.NoError(t, os.MkdirAll(cfg.UploadTmpDir, 0o700))
 	leftovers := []string{"upload-123", "wav-456"}
 	for _, n := range leftovers {
 		require.NoError(t, os.WriteFile(filepath.Join(cfg.UploadTmpDir, n), []byte("audio"), 0o600))
 	}
 	unrelated := filepath.Join(cfg.UploadTmpDir, "someone-elses-file")
 	require.NoError(t, os.WriteFile(unrelated, []byte("keep"), 0o600))
 	_, _, err := buildUploads(context.Background(), cfg, &fakeUploadsStore{}, quietLog())
 	require.NoError(t, err)
 	for _, n := range leftovers {
 		_, err := os.Stat(filepath.Join(cfg.UploadTmpDir, n))
 		assert.True(t, os.IsNotExist(err), "%s: audio is never retained, so a spooled file from a crashed run must not survive start-up", n)
 	}
 	_, err = os.Stat(unrelated)
 	assert.NoError(t, err, "only our own spool files are removed")
 }
 func TestWireUploads_SetsEverythingTheWebAppNeedsForUploadsAndChat(t *testing.T) {
 	cfg := uploadCfg(t, true)
 	cfg.UploadMaxDuration = 90 * 60 * 1e9
 	cfg.MaxUploadedTranscriptChars = 90000
 	cfg.UploadChatModel = "iguana/gemma4-26b"
 	in, _, err := buildUploads(context.Background(), cfg, &fakeUploadsStore{}, quietLog())
 	require.NoError(t, err)
 	app := &web.App{}
 	wireUploads(app, cfg, in)
 	assert.NotNil(t, app.Uploads)
 	assert.Equal(t, cfg.UploadMaxBytes, app.UploadLimits.MaxBytes, "the form states the limits Intake enforces")
 	assert.Equal(t, cfg.UploadMaxDuration, app.UploadLimits.MaxDuration)
 	assert.Equal(t, 90000, app.UploadChatMaxChars,
 		"without this the chat would use the 18,000-char caption default and cut an hour to its first third")
 	assert.Equal(t, "iguana/gemma4-26b", app.UploadChatModel)
 }
 func TestWireUploads_NilIntakeLeavesTheAppUntouched(t *testing.T) {
 	app := &web.App{}
 	wireUploads(app, uploadCfg(t, false), nil)
 	assert.Nil(t, app.Uploads, "a nil *Intake must not become a non-nil interface that mounts the routes")
 	assert.Zero(t, app.UploadChatMaxChars)
 }
@@ -18,7 +18,12 @@ only opaque references to them; the secret material lives in ESO/1Password (ADR-
  not LLM re-summarization but a rate-gated, reputation-risky caption fetch (ADR-010/014), which
  is paid per re-fetch regardless of user count — so persisting public caption content once and
  sharing it strictly beats the coupling it removes. Everything else each user owns is
-  self-contained; `rls_test.go` proves transcripts is the single exception.
+  self-contained; `rls_test.go` proves transcripts is the single exception for *content*.
  **Uploaded-audio transcripts are the opposite of public caption content** (private, owned by
  one user) and therefore live in their own RLS-scoped `uploaded_transcripts` table, never in
  `transcripts` (ADR-033). The isolation test now also pins the **exact set** of tables with row
  security off (`transcripts`, `user_identities`, `invitations`, `schema_migrations`), so a new
  table added without RLS fails CI.
 - **Secrets by reference only.** Tables hold a `secret_ref` (opaque string/UUID resolved via
  the `SecretStore` port), never tokens or keys.
 - **The brain sink is just a delivery target.** No brain-specific tables. Whether a summary
@@ -41,6 +46,7 @@ erDiagram
    VIDEO ||--o| SUMMARY : "has at most one"
    SUMMARY ||--o{ SINK_DELIVERY : "delivered via"
    USER ||--o{ CHANNEL_ERROR : "reports unavailable channels"
    USER ||--o{ UPLOADED_TRANSCRIPT : "uploads (private, ADR-033)"
    USER {
        uuid id PK
@@ -136,12 +142,28 @@ erDiagram
        timestamptz first_seen
        timestamptz last_seen
    }
    UPLOADED_TRANSCRIPT {
        uuid id PK
        uuid user_id FK "-> USER, ON DELETE CASCADE, NOT NULL; RLS ENABLE+FORCE (migration 017)"
        text title
        text status "queued | transcribing | done | failed"
        text content "nullable until done; the transcript text"
        jsonb segments "nullable until done; [{start,end,text}] in seconds"
        text endpoint "which backend served it: iguana/... | berget/... (berget = audio left the homelab)"
        float audio_seconds
        text error_kind "typed: interrupted | transcription_failed — never a provider string"
        bool had_video "the file carried a video track; only its audio was used (migration 018)"
        timestamptz created_at
        timestamptz finished_at
    }
 ```
 `SUMMARY_ACTION` has `UNIQUE (user_id, video_id, action)`; `VIDEO_CONNECTION` has
 `UNIQUE (user_id, provider)` (one connection per provider — reconnect upserts in place).
 RLS (`ENABLE` + `FORCE`) is on **every solid user-owned table above** — `users`, `videos`,
-`transcripts`, `summaries`, `summary_actions`, `video_connections`, `channel_errors`.
+`summaries`, `summary_actions`, `video_connections`, `channel_errors`, `uploaded_transcripts`.
 (`transcripts` is deliberately **not** in this list: since ADR-021 it is shared public caption
 content with no `user_id`.)
 `sink_deliveries` is RLS'd via an `EXISTS` on its parent summary; `user_identities` is
 intentionally **not** RLS'd (auth plumbing). See the *Isolation invariant* section for the
 mechanism.
@@ -197,6 +219,14 @@ mechanism.
  the most recent discovery pass. Upserted per scheduler pass (`last_seen` refreshed each run);
  surfaced on the account page as a warning. Cascades on user deletion. Primary key is
  `(user_id, channel_id)`. FORCE RLS'd.
 - **UPLOADED_TRANSCRIPTS** (migration 017, ADR-033) — the **private** transcript of audio a user
  uploaded. Deliberately a separate table from the shared `transcripts`: that one is non-RLS on the
  grounds that it holds only public caption content, and a recorded meeting is the opposite.
  `user_id NOT NULL ... ON DELETE CASCADE`, FORCE RLS'd. `status` runs `queued → transcribing →
  done | failed`; `done` requires `content`, `failed` requires a typed `error_kind` (CHECK
  constraints). `had_video` (migration 018) records that the file carried a video track — a Teams meeting with the camera off is still a video file — so the page can say only its audio was used and the video was discarded. `endpoint` records which backend served it — `berget/...` means the audio left the
  homelab. The audio itself is never stored. `segments` keeps the timestamps (re-transcribing 90
  minutes costs ~7). Unlike `summary_actions`/`login_events` it **does** cascade on user deletion.
 - **LOGIN_EVENTS** (migration 010) — throttled one-row-per-(user, date) login stamp. Used by the
  Stage-0 gate query (VISION §Stage 0: "returned and used in ≥2 distinct weeks").
@@ -209,7 +239,10 @@ enforcement dormant); **ADR-012 opened Stage 1 and turned enforcement on in the
 Enforcement is **Postgres Row-Level Security** (migration `003_rls.up.sql`):
 - RLS is `ENABLE`d **and** `FORCE`d on every user-owned table — `users`, `videos`,
-  `transcripts`, `summaries`, `summary_actions`, `video_connections`, `channel_errors`.
+  `summaries`, `summary_actions`, `video_connections`, `channel_errors`, and (migration 017)
  `uploaded_transcripts`. `transcripts` is **not** one of them: ADR-021 made it shared public
  content, and migration 003's original per-user `transcripts` policy was dropped with that
  table in migration 015.
  `FORCE` is load-bearing: the app connects as the table **owner** (`tapir` role), and owners
  bypass RLS unless forced.
 - Each policy keys off the per-request GUC `tapir.current_user_id`, set transaction-locally by
@@ -12,6 +12,22 @@ it** — endpoints and aliases drift, and this file is a snapshot (2026-06-06),
  - **Off-cluster (host / NodePort):** `http://koala:30401/v1/` — service `litellm-nodeport` (`4000:30401`).
  - NOTE: the earlier `31234` was **wrong** — `31234` is the `llama-swap` NodePort (`8080:31234`),
    not LiteLLM. Use `30401` for off-cluster LiteLLM. `confirm` resolved.
 - **Speech-to-text (ADR-033):** the same gateway serves `POST /v1/audio/transcriptions` for
  `iguana/kb-whisper` (primary, local) and `berget/kb-whisper` (fallback, EU cloud — private audio
  leaves the homelab if it is used). **Call it via the NodePort / in-cluster address above, NOT
  `https://llm-api.d-ma.be`:** that public ingress (openresty) returns `413` for bodies over
  roughly 8–10 MB (~5 minutes of 16 kHz WAV), while the NodePort took 174 MB (90 minutes) in one
  request (measured 2026-10-01, `docs/research/audio-length-ceiling-2026-10-01.md`). Send multipart
  field `file`, `response_format=verbose_json`, no `Expect: 100-continue`. iguana's whisper-server
  can wedge permanently after a Metal OOM (infra#273); never branch on its
  `{"error":"failed to process audio"}` string — it has had at least five causes. Tapir's knobs:
  `TAPIR_UPLOADS_ENABLED` (off by default), `TAPIR_UPLOAD_MAX_MB` (200), `TAPIR_UPLOAD_MAX_MINUTES`
  (90), `TAPIR_TRANSCRIBE_MODEL`, `TAPIR_TRANSCRIBE_FALLBACK_MODEL` (empty disables the cloud
  fallback), `TAPIR_TRANSCRIBE_TIMEOUT` (30m), `TAPIR_UPLOAD_TMP_DIR`, `TAPIR_FFMPEG_BIN`,
  `TAPIR_FFPROBE_BIN`, `TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS` (90000 — the measured ceiling of
  `iguana/gemma4-26b`, which silently drops the head above it), `TAPIR_UPLOAD_CHAT_MODEL`
  (`iguana/gemma4-26b`; `koala/phi4-mini`'s 8,192-token context 400s on an hour of speech). Needs `ffmpeg` + `ffprobe`
  in the runtime image; Tapir's own ingress body limit for a 200 MB upload is unverified (infra).
 - **Auth key:** treat as a secret via the SecretStore port; do not hardcode in committed code.
  NOTE: the documented `sk-local-123` returned `401` on `30401/v1/models` (2026-06-02) — it is
  stale or the gateway now enforces the `LITELLM_MASTER_KEY` (1Password `op://HomeLab/LITELLM_MASTER_KEY`).
@@ -0,0 +1,81 @@
 # kb-whisper vs pianissimo on one real hour of Swedish speech (tapir#33, 2026-10-01)
 One recording, one speaker: a 63.7-minute Teams session of the maintainer dictating project
 notes (domain-heavy, English loanwords and product names mixed into Swedish). **No transcript
 text and no domain terms are recorded here**: this repo is public and the content is private.
 Only aggregate numbers.
 Backends, both through the LiteLLM gateway and Tapir's own adapter, unchanged:
 `iguana/kb-whisper` (whisper.cpp, KB's Swedish fine-tune) and `iguana/pianissimo` (KlangAI
 Swedish Parakeet/FastConformer-TDT, MLX 8-bit, served by a small FastAPI shell on iguana:8102).
 ## Result: a near tie on accuracy, a large difference in speed
 | | kb-whisper | pianissimo |
 |---|---|---|
 | Wall time for 63.7 min | 4m08s (~15x realtime) | **40 s (~95x realtime)** |
 | Segments | 1,302 (timed pieces, wrapped at ~60 chars) | 434 (sentences) |
 | Words (normalised) | 6,606 | 6,510 |
 | Punctuation | light, every segment ends in a full stop | heavier (138 vs 82 commas) |
 | Repetition loops | none | none |
 Word-level agreement between them: **92.4%** as first computed, **93.1%** after the segment
 rejoin fix below. 380 aligned disagreement spans, median one word each.
 **Blind A/B by the speaker** (the only ground truth available), on the 30 spans a model
 (Claude Opus 5.5) had picked as changing meaning, shuffled and unlabelled: **pianissimo 17,
 kb-whisper 13**, no "neither", no "can't tell".
 | Category of the 30 | pianissimo | kb-whisper |
 |---|---|---|
 | Technical term / English loanword | 8 | 4 |
 | Number / date / unit | 4 | 1 |
 | Name / proper noun | 3 | 3 |
 | Function word / small word | 1 | 2 |
 | Other (everyday words) | 1 | 3 |
 The reading: pianissimo is better on terminology and numbers, kb-whisper on ordinary Swedish
 words; names are even. Their errors differ in kind: kb-whisper's tend to be garbled words, a
 couple were wrong numbers; pianissimo's tend to be fluent substitutions that read as plausible
 (a wrong institution, an invented person, a dropped sign), which a reader or an LLM is less
 likely to catch.
 Opus's own lean agreed with the speaker's blind answer on **30 of 30**. That is not a measure
 of Opus over all 380 spans: it chose spans it could decide, and every one of the 30 carried a
 lean. Its full classification of the 380 (counts only): function/small word 81, filler or
 false start 65, technical term 58, compound split/join 46, other 39, name 28, casing or
 punctuation residue 26, inflection 23, number/date/unit 10, content omission or insertion
 (>= 3 words) 4.
 ## A bug this comparison found in Tapir (fixed)
 kb-whisper's output is wrapped at ~60 characters and **a wrap can fall inside a word**; the
 continuation segment has no leading space, the response's `text` field joins segments with
 newlines, and a segment can be a lone `.`. Tapir stored that joined text, so chat received
 broken words. Measured on real gateway output: 7% of segments (96/1,332) in a synthetic hour,
 42/1,302 lines in the real one. berget's segments are whole sentences with no leading space, so
 the two need different joins. `transcribe.joinSegments` now rebuilds the text from the segments.
 Checked against the real transcript with pianissimo's vocabulary as an independent yardstick:
 36 spans changed, 31 now entirely known words, words unknown to pianissimo 224 -> 177.
 Five rejoined spans still contain an unknown word (a name or an unlucky glue): small residual
 risk. Earlier tests used short sentences and could not see this.
 ## What this does not show
 - **One recording, one speaker, one domain.** No claim about other voices, accents, crosstalk,
  or room noise. 17 vs 13 is not a significant difference.
 - **The other ~350 spans** were not judged by the speaker. They are mostly spelling, compounds,
  fillers and small words; Opus's counts there are a model's judgement, not ground truth.
 - Errors **both** models share in text they agree on are invisible to this method.
 - Speed was measured once each, on an otherwise idle iguana; pianissimo's 40 s includes the
  gateway hop and a 122 MB WAV upload.
 - Whether pianissimo survives the infra#273 Metal-OOM contention the way whisper does not was
  not tested; both run on iguana.
 ## What it suggests for Tapir (not decided, filed as an issue)
 Pianissimo is a **second local backend on the same host, through the same adapter**. That
 makes it a natural middle tier ahead of the cloud fallback (kb-whisper -> pianissimo ->
 berget), so a wedged whisper no longer sends private audio off the homelab. At 40 s an hour it
 is also cheap enough to run **both** on every upload and give chat both texts, or flag where
 they disagree; the maintainer's blind answers show they err in different places.
@@ -0,0 +1,110 @@
 # Audio length ceiling — measured before designing chunking (tapir#33, 2026-10-01)
 Question (#33, "the main technical risk"): at what recording length does Swedish
 transcription through the LiteLLM gateway first fail, and with what failure mode?
 Measured **before** any chunking design, with iguana not holding a large ollama model,
 so the result is the ceiling and not the Metal OOM of infra#273.
 ## Answer
 **No transcription ceiling was found at or below 90 minutes.** A single request carrying
 90 minutes of 16 kHz mono PCM (174 MB) transcribed in one pass in 440 s. The first thing
 that actually fails is **not whisper**: it is the public gateway ingress, which rejects the
 upload with `413` at roughly 5.5 minutes of WAV.
 | Route | First failure | Failure mode |
 |---|---|---|
 | `https://llm-api.d-ma.be` (openresty ingress) | between 8.0 MB and 10.5 MB body (~4–5.5 min of WAV) | `413 Request Entity Too Large`, HTML body from `openresty`, returned instantly |
 | `http://koala:30401` (LiteLLM NodePort) → `iguana/kb-whisper` | **none up to 90 min / 174 MB** | — |
 | `http://koala:30401` → `berget/kb-whisper` | **none up to 22 min / 42 MB** (largest tried) | — |
 The ingress limit is the reason the 8:20 / 15 MB recording in #33 "failed repeatedly" and a
 30-second slice succeeded. That failure was attributed to a Metal OOM; at least in the
 size-dependent form described, a body-size cap explains it without one. (The OOM
 mechanism in infra#273 is separately real; this run did not provoke it.)
 The exact ingress cap was bracketed (8.0 MB passed, 10.5 MB failed), not read from the
 ingress configuration, which lives in `infra`. "About 10 MB" is an inference.
 ## Method
 - **Audio.** No known-good Swedish recording is available that is safe to use: the only real
  one (`IMG_1233.wav`) is the private `/bygge` recording (#31 custody still open) and was
  deliberately not touched. Instead: macOS `say -v Alva` (Swedish) on iguana, a 1,171-char
  five-paragraph meeting script → 82.5 s of 16 kHz mono PCM WAV (`ffmpeg -ar 16000 -ac 1`).
  Concatenated ×4, ×8, ×16, ×32, ×44, ×66 with Python `wave` (the issue's own recipe).
  Nothing here is a real transcript; none of it is committed.
 - **Request.** `POST /v1/audio/transcriptions`, multipart `file=`, `model=iguana/kb-whisper`,
  `response_format=verbose_json`, `-H 'Expect:'` (per #33's traps), master key supplied only
  through `op run` and never on argv.
 - **Confound control.** `ollama /api/ps` on iguana was read before every step. Resident:
  nothing, or `nomic-embed-text` (0.37 GB). Never a large model.
 ## Results (`iguana/kb-whisper`, NodePort)
 | Audio | WAV size | HTTP | Wall | Realtime factor | Segments | Chars |
 |---|---|---|---|---|---|---|
 | 0:30 | 0.96 MB | 200 | 2.8 s | 11× | — | — |
 | 2:30 / 3:20 / 4:10 | 4.8 / 6.4 / 8.0 MB | 200 (ingress) | 12.9 / 16.0 / 19.9 s | 12× | — | — |
 | 5:30 (×4) | 10.5 MB | **413 ingress**, 200 NodePort in 27 s | 27 s | 12× | 121 | 4,557 |
 | 11:00 (×8) | 21.1 MB | 200 | 53 s | 12× | 241 | 9,094 |
 | 22:00 (×16) | 42.3 MB | 200 | 105 s | 13× | 482 | 18,201 |
 | 44:01 (×32) | 84.5 MB | 200 | 209 s | 13× | 966 | 36,438 |
 | 60:32 (×44) | 116.2 MB | 200 | 291 s | 12× | 1,332 | 50,145 |
 | 90:48 (×66) | 174.3 MB | 200 | 440 s | 12× | 2,005 | 75,165 |
 - Throughput is flat at ~12× realtime. 90 minutes costs ~7.5 minutes of wall time. This is
  a minutes-long job, not a request/response one (see ADR-033 on ADR-018).
 - Segments per source repetition stay at 30.1–30.4 from ×4 to ×66, and segment times are
  monotonic with `last_end` within 0.2 s of `duration`. No drift and no repetition-loop
  hallucination appeared across 90 minutes. This is a weak check — the input is a repeated
  loop and synthetic voice — not evidence of accuracy.
 - **Only `iguana/kb-whisper`'s `x4` run reported `last_end` 360.0 s against `duration`
  330.2 s.** Whisper's final segment can end past the audio; clamp to `duration`.
 ## Findings that change the design
 1. **Use the NodePort route, not the public hostname.** Tapir runs in-cluster beside the
   gateway; `llm-api.d-ma.be` is the external door and has a body cap. #33 said "use the
   gateway, never the host" and named the public URL; the gateway is right, that URL is not.
   `TAPIR_GATEWAY_URL` already points at `koala:30401/v1`.
 2. **`response_format=srt` survives the LiteLLM hop, but wrapped.** The response is JSON
   `{"text": "<the SRT>", "usage": …}`, not a bare SRT body — a client that parses the body
   as SRT gets a parse error on `{`. #33 question 2 is answered: it passes through, inside
   an envelope.
 3. **The two backends return different timestamp granularity.** `iguana/kb-whisper`
   segments are **whole seconds** (`0→1`, `1→4`, `4→7`); `berget/kb-whisper` returns real
   sub-second times (`0.051→1.192`) and a different `language` token (`swedish` vs `sv`).
   `verbose_json` and the default JSON were byte-identical on iguana. An adapter that
   falls back between the two must normalise both, and "which endpoint served this" is
   a quality fact, not just a log line.
 4. **The existing chat path cannot answer about most of a long recording.** At
   828 chars/min (this fixture; real speech is plausibly a little denser),
   `TAPIR_MAX_TRANSCRIPT_CHARS`'s default of **18,000** is ~21.7 minutes. A 60-minute
   transcript is 50 k chars, a 90-minute one 75 k. `chat.Service` truncates by keeping
   the head (`internal/adapters/chat/chat.go`), so questions about the last two-thirds of
   a one-hour meeting get an answer from a transcript that does not contain it. #33 says
   chat "retrieves rather than generates" and therefore has no ceiling; it **stuffs and
   truncates**, and its ceiling is the model context. See ADR-033.
 5. **Chunking is not needed for v1 on length.** Nothing failed up to 90 minutes. The
   chunking-and-stitching recipe in #33 (offset timestamps, renumber cues, strip `\r`) is
   not built. It stays the answer *if* a longer cap is wanted or the OOM mechanism forces
   smaller requests — see ADR-033's resolution triggers.
 ## What this did not measure
 - **Metal OOM under contention.** Deliberately avoided. A big resident ollama model
  during a long transcription is still the known way to wedge iguana permanently.
 - **Real speech.** TTS is clean, single-voice, no crosstalk or room noise. WER and
  speaker overlap in a Teams export are untested. Speed is probably representative;
  accuracy is not claimed.
 - **Compressed input.** Only WAV was sent. Whether `m4a`/`mp3`/`opus` can reach whisper
  without a server-side transcode is not established here (ADR-033 treats it as needing one).
 - **Concurrency.** One request at a time. Two simultaneous 90-minute jobs on iguana were
  not tried.
 - **`berget/kb-whisper` beyond 22 min / 42 MB.** Enough to know the fallback is not
  size-capped at meeting length for 22 minutes; not proven at 90.
 - **Time-of-day / other tenants.** One afternoon, one run per length.
 Scripts were throwaway shell/Python in a session scratchpad and are not committed; the
 method above reproduces them.
@@ -0,0 +1,66 @@
 # Chat over a long transcript — what the offered models really hold (tapir#33, 2026-10-01)
 Question: ADR-033 reuses `chat.Service`, which stuffs the transcript into the prompt and
 cuts the tail. #33 assumed chat "retrieves rather than generates" and so has no length
 ceiling. It does not retrieve, so its ceiling is the model's context. What is it, for the
 models chat actually offers?
 ## Answer
 | Model (via the NodePort gateway) | Result | Limit found |
 |---|---|---|
 | `koala/phi4-mini` | correct to 30,000 chars; **HTTP 400 at 50,000** (13,332 tokens vs an 8,192-token context) | ~22,000 chars in production, where the client adds `max_tokens: 1500` |
 | `iguana/gemma4-26b` | correct at 18k, 50k and **90,000 chars** (26.5 k tokens); **at 120,000 chars it silently loses the head** | **90,000 chars** |
 | `berget/mistral-small` | answered "the transcript does not contain it" for a fact **at the end** of an 18,000-char and a 50,000-char transcript | unreliable here, one run each — see caveats |
 The dangerous one is gemma at 120,000 chars: **no error, no truncation flag** — the reported
 prompt tokens fell from 26,548 (90 k chars) to 16,387 (120 k chars), and the model answered
 "it does not say who the chair is" about a sentence at the very start of the transcript. The
 serving layer truncated the prompt from the front. `chat.Service` reports `Truncated: false`
 because *it* did not cut anything.
 ## What this changes
 1. **The budget for an uploaded transcript is 90,000 chars, not a round 120,000.** That is the
   best offered model's measured limit, ~100 minutes of speech at the fixture's density.
   `TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS` defaults to it.
 2. **Chat over an upload must not open on the summarizer default.** The offered list is
   `[SummarizerModel, FallbackModel, CloudFallbackModel]`, so `koala/phi4-mini` is first — and
   400s on an hour of speech. `TAPIR_UPLOAD_CHAT_MODEL` (default `iguana/gemma4-26b`) is what
   the upload chat opens with; the switcher still lists every model.
 3. **A per-model budget does not exist yet.** Someone who switches the dropdown to
   `phi4-mini` on a long recording gets a loud HTTP 400, shown inline as "couldn't answer".
   That fails honestly but unhelpfully. Filed as a follow-up.
 4. **The "retrieval chat" trigger in ADR-033 is now concrete:** any recording past 90,000 chars
   (≈100 min) cannot be answered by stuffing, for any offered model.
 ## Method
 `POST /v1/chat/completions` through `http://koala:30401/v1`, `temperature: 0`,
 `max_tokens: 200` (production sends 1500 for chat via the summary token cap), the same system
 framing as `chat.Service`. The transcript is the 60-minute synthetic fixture from
 `audio-length-ceiling-2026-10-01.md` truncated/repeated to N chars, with one unique sentence
 planted either at the **end** ("lagret på Kvarngatan ska tömmas … av Pelle", question: who/when)
 or at the **head** ("kvällens ordförande är Ingrid", question: who chairs). Needle at the
 end alone would have missed the gemma failure — a serving layer that truncates from the front
 keeps the tail, so the end-needle passed at 120,000 chars; only the head-needle exposed it.
 Grounded = the answer contains the planted fact.
 ## What this did not measure
 - **Real speech**: the fixture is a repeated 82-second script, so retrieval "difficulty" is
  artificially easy except for the planted needle. One question per run, one run per cell.
 - **`berget/mistral-small`'s failure**: it missed an end-needle at 18,000 chars where the
  others succeeded. One run; could be the model, the prompt framing, or position bias. Not
  investigated; do not read it as a ranking.
 - **Latency under load**, **concurrent** chat while whisper is transcribing, and in particular
  the hazard below.
 - **`koala/qwen36-35b-a3b` or any frontier model** — not in the offered list.
 ## A hazard this surfaces and does not solve
 `iguana/gemma4-26b` is a large ollama model on the same host as `iguana/kb-whisper`. infra#273
 is precisely that a large resident ollama model can Metal-OOM whisper-server permanently. Making
 gemma the default *chat* model for uploads means chatting with a transcript can load the model
 that wedges the transcriber. The primary-fails-over-to-berget design limits the blast radius but
 does not remove it. Recorded in ADR-033 and filed.
@@ -0,0 +1,75 @@
 # Can a local model adjudicate two ASR transcripts? (tapir#33, 2026-10-01)
 Question: when `iguana/kb-whisper` and `iguana/pianissimo` disagree about a word or phrase,
 can a **local** model say which reading is right, well enough to merge the two transcripts?
 Ground truth: the speaker's own blind answers on 30 disagreements of one real recording
 (see `asr-kb-whisper-vs-pianissimo-2026-10-01.md`; no transcript text is recorded here,
 this repo is public). Reference: Claude Opus 5.5 agreed with the speaker on all 30.
 ## Method
 - **Items:** 30 disagreement spans that Opus had picked as changing meaning, the speaker's
  verdict as truth (pianissimo right 17, kb-whisper right 13).
 - **Prompt:** one fixed English instruction (two transcriptions of Swedish speech differ at
  ONE marked spot; say which reading the speaker most likely said; reply `ANSWER: 1|2|UNSURE`
  plus one sentence). Each item was asked in **both reading orders** and in **two contexts**:
  narrow (+-8 words) and wide (+-100 words). 120 calls per model, temperature 0.
 - **Models:** 11, all local (`koala/*`, `iguana/*`): nothing left the homelab. Run one iguana
  model at a time, each unloaded afterwards, to avoid the memory pressure behind infra#273;
  whisper was confirmed healthy afterwards.
 - **Pass criteria, fixed before the run:** wide context, strict accuracy >= 80% (an
  unparseable or "unsure" answer counts as wrong), order-swap consistency >= 85%,
  unparseable <= 10%.
 ## Results (wide context, 60 calls per model)
 | Model | Correct | 95% CI | Same pick when order swapped | Unparseable | s/call | Pass |
 |---|---|---|---|---|---|---|
 | `iguana/gemma4-31b` | 58 = 97% | 89-99% | 93% | 0 | 10.4 | **yes** |
 | `iguana/gemma4-26b` | 55 = 92% | 82-96% | 93% | 0 | 2.0 | **yes** |
 | `iguana/ornith-35b` | 51 = 85% | 74-92% | 77% | 0 | 2.5 | no (consistency) |
 | `koala/phi4-14b` | 50 = 83% | 72-91% | 80% | 0 | 1.0 | no (consistency) |
 | `koala/qwen36-35b-a3b` | 49 = 82% | 70-89% | 83% | 0 | 3.3 | no (consistency) |
 | `iguana/granite4` | 47 = 78% | 66-87% | 83% | 0 | 4.6 | no |
 | `iguana/qwen3-14b` | 44 = 73% | 61-83% | 87% | 0 | 4.4 | no (accuracy) |
 | `iguana/gpt-oss-20b` | 40 = 67% | 54-77% | 100% | 17 | 11.2 | no (unparseable) |
 | `koala/phi4-mini` | 37 = 62% | 49-73% | 24% | 1 | 0.5 | no |
 | `iguana/gemma4-26b-think` | 23 = 38% | 27-51% | 100% | 37 | 15.3 | no (unparseable) |
 | `koala/qwen35-9b-fast` | 0 | n/a | n/a | 60 | 7.2 | no (no output) |
 Narrow context only (+-8 words) costs 6-12 points for the models that pass: gemma4-31b 92%,
 gemma4-26b 83%, ornith-35b 80%. Context is not decoration: Opus also used evidence from
 elsewhere in the recording (an amount stated earlier, a term that recurs).
 Position bias: the passing models pick "Reading 1" 47-51% of the time. `phi4-mini` picks it 15%
 and flips its answer when the order is swapped 76% of the time: it carries almost no signal.
 ## Reading it
 - **Two models pass:** the gemma4 pair. Both clear the bar and neither shows position bias.
  26b is ~5x faster; their intervals overlap, so 30 items cannot separate 92% from 97%.
 - **The thinking models were not tested fairly.** `gpt-oss-20b` and `gemma4-26b-think` spend
  the 600-token budget reasoning and often never reach the answer line. When gemma4-26b-think
  did answer, it was right 23 of 23; gpt-oss-20b 93% of the answered. A larger budget would
  make them eligible; at 15 s a call it would not make them practical.
 ## What this does not show
 - **Thirty items, one recording, one speaker, one domain.** The 30 were chosen by Opus as
  decidable, so they overstate how easy the typical disagreement is; ~350 others are mostly
  spelling, compounds and fillers, which no ground truth covers.
 - Opus agreeing 30/30 is not a measure of Opus over all 380 disagreements.
 - Accuracy was measured at temperature 0 on one prompt; no prompt tuning was tried.
 - The speaker's answers are the only truth; they are one person's recollection of what they said.
 ## Why gemma4-31b is slow, and what was ruled out
 On iguana (M2 Ultra, 64 GB) the dense 31B runs at **103 tok/s prefill, 7.9 tok/s decode**; the
 26B MoE at 641 and 39.6. Ruled out as the cause: memory pressure (no swap, 45% free, model 100%
 on GPU), context length (32k vs 4k made no difference), and the **inference engine** — MLX 4-bit
 of the same model measured 76 tok/s prefill and 8.6 decode, the same within noise. (Terse
 output saves only ~3.6 s of ~9.3 s because prefill dominates.) Two unrelated engines at the same
 speed points at the machine: ~140 GB/s effective memory bandwidth on a part rated for 800, and
 **iguana has macOS Low Power Mode on** (`pmset` `lowpowermode 1`). That is the leading suspect
 and is **not proven**: turning it off needs root and was not done. A first MLX benchmark was
 wrong because `mlx_lm.server` caches prompts; the figures above are from the corrected run.
@@ -0,0 +1,108 @@
 Feature: Upload an audio recording, get a private Swedish transcript, discuss it
  As someone with a recorded meeting on my computer
  I want to upload it and then ask questions about what was said
  So that I can find out what was decided, what is open and who owes what
  # ADR-033, tapir#33. The load-bearing constraint: an uploaded transcript is
  # PRIVATE content, so it lives in its own RLS-scoped store and never in the
  # shared public-caption `transcripts` table (ADR-021). Rejection is synchronous,
  # the audio is never retained, and a failed job ends in a terminal state with a
  # message — never a spinner (ADR-025). A file with a video track (a Teams meeting
  # with the camera off is one) is accepted: only its audio is used and the user is
  # told. Video playback, keyframes and analysis of what is shown remain #28.
  Background:
    Given I am a registered user with audio upload enabled
  Scenario: The upload form states the limits up front
    When I open the upload page
    Then I see the size limit and the length limit before I choose a file
  Scenario: An accepted recording is queued and I am taken to its page
    When I upload an audio file within the limits
    Then it is recorded as queued for me
    And I am redirected to its page
  Scenario: A recording with no title is named after its file
    When I upload an audio file and give no title
    Then its title is the filename without its extension
  Scenario: A file with a video track is accepted and I am told the video was ignored
    When I upload a recording that also has a video track
    Then it is accepted and queued like any other
    And its page says only its audio was used and the video was discarded
    And it says so while queued, while transcribing, when done and when failed
  Scenario: A video file with no audio is rejected for having no audio
    When I upload a video that has no audio track
    Then it is rejected with a message that it has no audio
    And nothing is recorded
  Scenario: A recording over the length limit is rejected with both lengths
    When I upload a recording longer than the limit
    Then it is rejected stating the recording's length and the limit
    And nothing is recorded
  Scenario: A file over the size limit is rejected as too large
    When I upload a file larger than the size limit
    Then it is rejected with 413 and a message about the limit
    And nothing is recorded
  Scenario: Cover art on an audio file is not a video track
    When I upload an mp3 whose only video stream is attached cover art
    Then it is treated as audio and no video notice is shown
  Scenario: A file that is not media is rejected as unreadable
    When I upload a file ffprobe cannot read
    Then it is rejected as the file's fault
  Scenario: A broken ffprobe is reported as our fault, not as a bad file
    When the prober itself fails
    Then the upload is an error rather than a rejection of my file
  Scenario: A recording becomes a transcript and the audio is deleted
    Given I have uploaded a recording
    When it has been transcribed
    Then the transcript is stored privately for me
    And the audio is deleted
  Scenario: The endpoint that served a transcript is recorded and shown
    Given a recording was transcribed by the fallback endpoint
    When I view its page
    Then it names the fallback endpoint, because that means the audio left the homelab
  Scenario: The local endpoint is tried first and the fallback only on failure
    When the primary transcription endpoint fails for any reason
    Then the fallback endpoint transcribes it
    But when the primary succeeds the fallback is never contacted
  Scenario: A failed transcription ends in a message, never a spinner
    When every transcription endpoint fails
    Then the upload is failed with a typed reason
    And its page shows that reason and stops polling
  Scenario: A restart fails the jobs it interrupted
    Given the service restarted while a recording was queued or transcribing
    When it starts again
    Then those uploads are failed as interrupted
    And any audio left in the spool is deleted
  Scenario: Only one recording is transcribed at a time
    When several recordings are queued
    Then they are transcribed one after another
  Scenario: My uploads are invisible to other users
    Given another user has uploaded a recording
    When I ask for it by its id
    Then I get 404 and no part of its title or text
    And the chat for it calls no model
  Scenario: I can ask about my recording and get a grounded answer
    Given my recording has been transcribed
    When I ask a question about it
    Then the answer comes from my transcript through the same chat as a video's
  Scenario: A long recording is not cut to its first third
    Given my recording's transcript is longer than the caption default
    When I ask a question about it
    Then the transcript is sent with the upload budget, not the 18,000-character caption default
@@ -0,0 +1,47 @@
 package audio
 import (
 	"context"
 	"fmt"
 	"os"
 	"os/exec"
 	"strings"
 )
 // FFmpeg converts any audio container to the strict format whisper wants: 16 kHz
 // mono signed 16-bit PCM WAV (ADR-033). It ALWAYS transcodes, even when the input
 // already is that format — a Teams export often is, and the transcode is then
 // nearly free; assuming it would be the bug. This replaces whisper-server's
 // --convert, whose --tmp-dir is created at process start and rots under macOS
 // periodic cleanup.
 type FFmpeg struct {
 	// Bin is the ffmpeg executable ("ffmpeg" resolves via PATH).
 	Bin string
 }
 // ToWAV writes src, converted, to dst. Video streams are dropped (-vn): by now the
 // file has already been probed as audio-only, but a cover-art stream must not end
 // up in the WAV.
 func (f *FFmpeg) ToWAV(ctx context.Context, src, dst string) error {
 	bin := f.Bin
 	if bin == "" {
 		bin = "ffmpeg"
 	}
 	// Input restrictions go BEFORE -i: placed after it they would apply to the output.
 	args := append([]string{"-y", "-v", "error"}, inputRestrictions...)
 	args = append(args, "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", "-f", "wav", dst)
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
 	if out, err := cmd.CombinedOutput(); err != nil {
 		if ctxErr := ctx.Err(); ctxErr != nil {
 			return fmt.Errorf("audio: ffmpeg: %w", ctxErr)
 		}
 		return fmt.Errorf("audio: ffmpeg: %w: %s", err, strings.TrimSpace(string(out)))
 	}
 	// A zero exit that wrote nothing is still a failure: never hand whisper a
 	// missing file and let the error surface three layers later.
 	if info, err := os.Stat(dst); err != nil || info.Size() == 0 {
 		return fmt.Errorf("audio: ffmpeg wrote no output at %s", dst)
 	}
 	return nil
 }
@@ -0,0 +1,79 @@
 package audio_test
 import (
 	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/audio"
 )
 func TestFFmpegToWAV_AsksForSixteenKilohertzMonoPCMAlways(t *testing.T) {
 	// Always transcode, even when the input already is 16 kHz mono: a Teams export
 	// often is, and the point is to not ASSUME (ADR-033). Records the argv.
 	rec := filepath.Join(t.TempDir(), "argv")
 	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
 for a; do last="$a"; done
 printf data > "$last"`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "out.wav"))
 	require.NoError(t, err)
 	raw, err := os.ReadFile(rec)
 	require.NoError(t, err)
 	argv := strings.Split(strings.TrimSpace(string(raw)), "\n")
 	joined := " " + strings.Join(argv, " ") + " "
 	for _, want := range []string{" -ac 1 ", " -ar 16000 ", " -c:a pcm_s16le ", " -vn ", " -i /spool/in "} {
 		assert.Contains(t, joined, want)
 	}
 	assert.True(t, strings.HasSuffix(strings.TrimSpace(joined), "out.wav"), "the output path is the last argument")
 }
 func TestFFmpegToWAV_NonzeroExitIsAnErrorCarryingStderr(t *testing.T) {
 	bin := stub(t, `echo "moov atom not found" >&2; exit 1`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/in", filepath.Join(t.TempDir(), "o.wav"))
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "moov atom not found")
 }
 func TestFFmpegToWAV_ZeroExitWithNoOutputIsAnError(t *testing.T) {
 	bin := stub(t, `exit 0`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/in", filepath.Join(t.TempDir(), "never-written.wav"))
 	require.Error(t, err)
 }
 func TestFFmpegToWAV_MissingBinaryIsAnError(t *testing.T) {
 	err := (&audio.FFmpeg{Bin: filepath.Join(t.TempDir(), "no-ffmpeg")}).ToWAV(context.Background(), "/in", "/out.wav")
 	require.Error(t, err)
 	assert.False(t, errors.Is(err, context.Canceled))
 }
 func TestFFmpegToWAV_RestrictsWhatTheFileMayMakeFFmpegOpen(t *testing.T) {
 	rec := filepath.Join(t.TempDir(), "argv")
 	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
 for a; do last="$a"; done
 printf data > "$last"`)
 	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "o.wav"))
 	require.NoError(t, err)
 	args := argvOf(t, rec)
 	pw, fw, in := indexOf(args, "-protocol_whitelist"), indexOf(args, "-format_whitelist"), indexOf(args, "-i")
 	require.GreaterOrEqual(t, pw, 0, "argv: %v", args)
 	require.GreaterOrEqual(t, fw, 0, "argv: %v", args)
 	assert.Equal(t, "file,pipe", args[pw+1])
 	assert.Equal(t, audio.AllowedDemuxers, args[fw+1])
 	assert.Less(t, pw, in, "input options must come BEFORE -i or ffmpeg applies them to the output")
 	assert.Less(t, fw, in)
 }
@@ -0,0 +1,109 @@
 // Package audio holds the adapters that inspect and convert user-supplied audio
 // with ffmpeg's tools (ADR-033). They sit behind small ports so the use case is
 // tested with fakes and only this package knows a subprocess is involved.
 package audio
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"os/exec"
 	"strconv"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // FFprobe implements uploads.Prober by running ffprobe on the spooled file.
 type FFprobe struct {
 	// Bin is the ffprobe executable ("ffprobe" resolves via PATH).
 	Bin string
 }
 // AllowedDemuxers are the input formats an upload may be. The input is
 // attacker-supplied, and a file's CONTENT can tell ffmpeg to open other files or
 // URLs (HLS and concat playlists, image2 sequences, network demuxers). Recent
 // ffmpeg refuses the ones tried (7.0.2: HLS without a .m3u8 name is not sniffed,
 // concat rejects unsafe paths), but that is version luck; this list is not. It
 // holds the containers real recordings use and none of the playlist or network
 // formats. "mov" covers .mp4/.m4a/.3gp; "matroska" covers .webm.
 const AllowedDemuxers = "wav,mov,mp4,m4a,3gp,mp3,ogg,matroska,webm,flac,aac,opus,aiff,amr,asf"
 // inputRestrictions are ffmpeg/ffprobe INPUT options and must precede the input.
 // Local files and pipes only: no network, no other protocols.
 var inputRestrictions = []string{"-protocol_whitelist", "file,pipe", "-format_whitelist", AllowedDemuxers}
 // killGrace bounds how long Probe waits for a cancelled ffprobe's pipes to close.
 const killGrace = 2 * time.Second
 // Probe runs ffprobe and classifies the outcome. A non-zero exit means ffprobe
 // looked at the file and could not read it: that is the FILE's fault and returns
 // uploads.ErrUnreadable. A missing binary, a cancelled context or unparsable
 // output is OURS and is returned as an ordinary error, so it is never reported to
 // the user as their file being bad.
 func (f *FFprobe) Probe(ctx context.Context, path string) (uploads.Probe, error) {
 	bin := f.Bin
 	if bin == "" {
 		bin = "ffprobe"
 	}
 	args := append([]string{"-v", "error"}, inputRestrictions...)
 	args = append(args, "-print_format", "json", "-show_format", "-show_streams", path)
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
 	out, err := cmd.Output()
 	if err != nil {
 		if ctxErr := ctx.Err(); ctxErr != nil {
 			return uploads.Probe{}, fmt.Errorf("audio: ffprobe: %w", ctxErr)
 		}
 		var exit *exec.ExitError
 		if errors.As(err, &exit) {
 			return uploads.Probe{}, fmt.Errorf("%w: ffprobe: %s", uploads.ErrUnreadable, exit.Stderr)
 		}
 		return uploads.Probe{}, fmt.Errorf("audio: run ffprobe: %w", err)
 	}
 	p, err := ParseProbe(out)
 	if err != nil {
 		return uploads.Probe{}, fmt.Errorf("audio: ffprobe output: %w", err)
 	}
 	return p, nil
 }
 // probeJSON is the subset of `ffprobe -print_format json` output that matters.
 type probeJSON struct {
 	Streams []struct {
 		CodecType   string `json:"codec_type"`
 		Disposition struct {
 			AttachedPic int `json:"attached_pic"`
 		} `json:"disposition"`
 	} `json:"streams"`
 	Format struct {
 		Duration string `json:"duration"`
 	} `json:"format"`
 }
 // ParseProbe turns ffprobe's JSON into a uploads.Probe. A video stream that is
 // only attached cover art (an mp3/m4a with an album picture) is not video. A
 // missing or "N/A" duration yields zero, which uploads.Validate rejects as
 // unreadable rather than accepting an empty recording.
 func ParseProbe(data []byte) (uploads.Probe, error) {
 	var j probeJSON
 	if err := json.Unmarshal(data, &j); err != nil {
 		return uploads.Probe{}, fmt.Errorf("decode: %w", err)
 	}
 	var p uploads.Probe
 	for _, s := range j.Streams {
 		switch s.CodecType {
 		case "audio":
 			p.HasAudio = true
 		case "video":
 			if s.Disposition.AttachedPic == 0 {
 				p.HasVideo = true
 			}
 		}
 	}
 	if secs, err := strconv.ParseFloat(j.Format.Duration, 64); err == nil && secs > 0 {
 		p.Duration = time.Duration(secs * float64(time.Second))
 	}
 	return p, nil
 }
@@ -0,0 +1,186 @@
 package audio_test
 import (
 	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/audio"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 func TestParseProbe(t *testing.T) {
 	tests := []struct {
 		name string
 		json string
 		want uploads.Probe
 	}{
 		{
 			name: "audio-only m4a",
 			json: `{"streams":[{"codec_type":"audio","disposition":{"attached_pic":0}}],"format":{"duration":"2701.5"}}`,
 			want: uploads.Probe{Duration: 2701*time.Second + 500*time.Millisecond, HasAudio: true},
 		},
 		{
 			name: "mp4 with a real video stream",
 			json: `{"streams":[{"codec_type":"video","disposition":{"attached_pic":0}},{"codec_type":"audio"}],"format":{"duration":"240.0"}}`,
 			want: uploads.Probe{Duration: 240 * time.Second, HasAudio: true, HasVideo: true},
 		},
 		{
 			name: "mp3 whose only video stream is attached cover art is NOT video",
 			json: `{"streams":[{"codec_type":"audio"},{"codec_type":"video","disposition":{"attached_pic":1}}],"format":{"duration":"60"}}`,
 			want: uploads.Probe{Duration: 60 * time.Second, HasAudio: true},
 		},
 		{
 			name: "no streams at all",
 			json: `{"streams":[],"format":{"duration":"10"}}`,
 			want: uploads.Probe{Duration: 10 * time.Second},
 		},
 		{
 			name: "duration absent means zero, which Validate rejects as unreadable",
 			json: `{"streams":[{"codec_type":"audio"}],"format":{}}`,
 			want: uploads.Probe{HasAudio: true},
 		},
 		{
 			name: "duration reported as N/A means zero",
 			json: `{"streams":[{"codec_type":"audio"}],"format":{"duration":"N/A"}}`,
 			want: uploads.Probe{HasAudio: true},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := audio.ParseProbe([]byte(tt.json))
 			require.NoError(t, err)
 			assert.Equal(t, tt.want, got)
 		})
 	}
 }
 func TestParseProbe_GarbageIsAnError(t *testing.T) {
 	_, err := audio.ParseProbe([]byte("not json"))
 	assert.Error(t, err)
 }
 // stub writes an executable shell script standing in for ffprobe. This is a fake
 // at the process boundary: the real binary is not on every host (it is not on
 // koala), and what is under test is how Probe drives and interprets a process.
 func stub(t *testing.T, body string) string {
 	t.Helper()
 	p := filepath.Join(t.TempDir(), "ffprobe")
 	require.NoError(t, os.WriteFile(p, []byte("#!/bin/sh\n"+body+"\n"), 0o755))
 	return p
 }
 func TestFFprobeProbe_ParsesWhatTheProcessPrints(t *testing.T) {
 	bin := stub(t, `echo '{"streams":[{"codec_type":"audio"}],"format":{"duration":"90"}}'`)
 	got, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/ignored")
 	require.NoError(t, err)
 	assert.Equal(t, uploads.Probe{Duration: 90 * time.Second, HasAudio: true}, got)
 }
 func TestFFprobeProbe_PassesTheFilePathAsTheLastArgument(t *testing.T) {
 	out := filepath.Join(t.TempDir(), "args")
 	bin := stub(t, `for a; do last="$a"; done; printf '%s' "$last" > `+out+`
 echo '{"streams":[{"codec_type":"audio"}],"format":{"duration":"1"}}'`)
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/spool/upload-123")
 	require.NoError(t, err)
 	got, err := os.ReadFile(out)
 	require.NoError(t, err)
 	assert.Equal(t, "/spool/upload-123", string(got))
 }
 func TestFFprobeProbe_NonzeroExitMeansTheFileIsUnreadable(t *testing.T) {
 	bin := stub(t, `echo "Invalid data found when processing input" >&2; exit 1`)
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/x")
 	assert.ErrorIs(t, err, uploads.ErrUnreadable)
 }
 func TestFFprobeProbe_MissingBinaryIsOurFaultNotAnUnreadableFile(t *testing.T) {
 	_, err := (&audio.FFprobe{Bin: filepath.Join(t.TempDir(), "no-such-ffprobe")}).Probe(context.Background(), "/x")
 	require.Error(t, err)
 	assert.False(t, errors.Is(err, uploads.ErrUnreadable),
 		"a missing ffprobe must not be reported to the user as their file being bad")
 }
 func TestFFprobeProbe_StopsWhenTheContextIsCancelled(t *testing.T) {
 	bin := stub(t, `sleep 30`)
 	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
 	defer cancel()
 	start := time.Now()
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(ctx, "/x")
 	require.Error(t, err)
 	assert.Less(t, time.Since(start), 5*time.Second)
 	assert.False(t, errors.Is(err, uploads.ErrUnreadable), "a timeout is not a verdict on the file")
 }
 // argvStub records the arguments it was called with into a file and then behaves as
 // a successful ffprobe, so a test can assert exactly what the process was asked.
 func argvStub(t *testing.T) (bin, argvFile string) {
 	t.Helper()
 	argvFile = filepath.Join(t.TempDir(), "argv")
 	bin = stub(t, `printf '%s\n' "$@" > `+argvFile+`
 echo '{"streams":[{"codec_type":"audio"}],"format":{"duration":"1"}}'`)
 	return bin, argvFile
 }
 func argvOf(t *testing.T, file string) []string {
 	t.Helper()
 	raw, err := os.ReadFile(file)
 	require.NoError(t, err)
 	return strings.Split(strings.TrimSpace(string(raw)), "\n")
 }
 func indexOf(args []string, want string) int {
 	for i, a := range args {
 		if a == want {
 			return i
 		}
 	}
 	return -1
 }
 func TestFFprobeProbe_RestrictsWhatTheFileMayMakeFFmpegOpen(t *testing.T) {
 	// The input is attacker-supplied. ffmpeg can be told by a file's CONTENT to open
 	// other files or URLs (HLS and concat playlists); recent versions refuse by
 	// default, but that is version luck. Pin it: local files and pipes only, and
 	// only the demuxers real audio recordings use.
 	bin, argvFile := argvStub(t)
 	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/spool/upload-1")
 	require.NoError(t, err)
 	args := argvOf(t, argvFile)
 	pw := indexOf(args, "-protocol_whitelist")
 	require.GreaterOrEqual(t, pw, 0, "argv: %v", args)
 	assert.Equal(t, "file,pipe", args[pw+1])
 	fw := indexOf(args, "-format_whitelist")
 	require.GreaterOrEqual(t, fw, 0, "argv: %v", args)
 	assert.Equal(t, audio.AllowedDemuxers, args[fw+1])
 	assert.Equal(t, "/spool/upload-1", args[len(args)-1], "the path stays the last argument")
 }
 func TestAllowedDemuxers_ExcludeThePlaylistFormats(t *testing.T) {
 	for _, bad := range []string{"concat", "hls", "applehttp", "dash", "rtsp", "sdp", "image2"} {
 		assert.NotContains(t, strings.Split(audio.AllowedDemuxers, ","), bad,
 			"%s can make ffmpeg open other files or URLs named inside the upload", bad)
 	}
 	for _, good := range []string{"wav", "mov", "mp4", "m4a", "mp3", "ogg", "matroska", "flac"} {
 		assert.Contains(t, strings.Split(audio.AllowedDemuxers, ","), good)
 	}
 }
@@ -0,0 +1,32 @@
 package audio_test
 import (
 	"context"
 	"os"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/audio"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // TestFFprobeLive_HostilePlaylistsAreRefusedAndRealAudioIsNot runs the REAL ffprobe
 // (opt-in: TAPIR_LIVE_FFPROBE) on crafted concat/HLS files and on a real m4a.
 func TestFFprobeLive_HostilePlaylistsAreRefusedAndRealAudioIsNot(t *testing.T) {
 	bin := os.Getenv("TAPIR_LIVE_FFPROBE")
 	if bin == "" {
 		t.Skip("set TAPIR_LIVE_FFPROBE (and TAPIR_LIVE_HOSTILE_DIR, TAPIR_LIVE_M4A) to run against the real ffprobe")
 	}
 	p := &audio.FFprobe{Bin: bin}
 	for _, name := range []string{"up-concat", "up-hls"} {
 		_, err := p.Probe(context.Background(), os.Getenv("TAPIR_LIVE_HOSTILE_DIR")+"/"+name)
 		assert.ErrorIs(t, err, uploads.ErrUnreadable, name)
 	}
 	got, err := p.Probe(context.Background(), os.Getenv("TAPIR_LIVE_M4A"))
 	require.NoError(t, err)
 	assert.True(t, got.HasAudio)
 	assert.False(t, got.HasVideo)
 	assert.InDelta(t, 82.5, got.Duration.Seconds(), 1)
 }
@@ -41,6 +41,11 @@ type Request struct {
 	Transcript string
 	History    []Turn
 	Question   string
 	// MaxChars, when positive, overrides the Service's transcript budget for this
 	// request. The Service default is sized for YouTube captions (~22 minutes of
 	// speech); an uploaded recording is much longer, and truncation keeps only the
 	// head (ADR-033). Zero or negative means "use the Service default".
 	MaxChars int
 }
 // Reply is the model's answer plus whether the transcript was bounded to fit the
@@ -113,7 +118,11 @@ func (s *Service) Answer(ctx context.Context, req Request) (Reply, error) {
 		model = s.DefaultModel("")
 	}
-	transcript, truncated := truncate(req.Transcript, s.maxChars)
+	budget := s.maxChars
 	if req.MaxChars > 0 {
 		budget = req.MaxChars
 	}
 	transcript, truncated := truncate(req.Transcript, budget)
 	system := buildSystem(transcript, truncated)
 	user := buildUser(req.History, req.Question)
@@ -0,0 +1,52 @@
 package chat
 import (
 	"context"
 	"strings"
 	"testing"
 )
 // A Request may carry its own transcript budget. The Service's cap (18,000 chars by
 // default) is sized for YouTube captions; an uploaded recording is much longer
 // (~50,000 chars an hour), and keeping only the head of it would answer questions
 // about the last two-thirds of a meeting from text that does not contain them
 // (ADR-033). The per-request value overrides; zero means "the service default".
 func TestAnswerMaxCharsOverridesTheServiceCap(t *testing.T) {
 	tests := []struct {
 		name          string
 		serviceCap    int
 		requestCap    int
 		transcriptLen int
 		wantKept      int
 		wantTruncated bool
 	}{
 		{"request cap above the service cap keeps the whole transcript", 10, 100, 50, 50, false},
 		{"request cap below the service cap bounds tighter", 100, 10, 50, 10, true},
 		{"zero request cap falls back to the service cap", 20, 0, 50, 20, true},
 		{"negative request cap is treated as unset", 20, -1, 50, 20, true},
 		{"request cap exceeded is reported as truncated", 10, 30, 50, 30, true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			f := &factory{answer: "answer"}
 			s := New(f.make, []string{"koala/phi4-mini"}, tt.serviceCap)
 			reply, err := s.Answer(context.Background(), Request{
 				Model:      "koala/phi4-mini",
 				Transcript: strings.Repeat("x", tt.transcriptLen),
 				Question:   "what was decided?",
 				MaxChars:   tt.requestCap,
 			})
 			if err != nil {
 				t.Fatalf("Answer: %v", err)
 			}
 			if got := strings.Count(f.used.lastSystem, "x"); got != tt.wantKept {
 				t.Errorf("transcript chars sent = %d, want %d", got, tt.wantKept)
 			}
 			if reply.Truncated != tt.wantTruncated {
 				t.Errorf("Truncated = %v, want %v", reply.Truncated, tt.wantTruncated)
 			}
 		})
 	}
 }
@@ -0,0 +1,3 @@
 -- Drops the private uploaded-transcript store and every transcript in it. There
 -- is no revert of the data: the original audio was never kept (ADR-033).
 DROP TABLE uploaded_transcripts;
@@ -0,0 +1,48 @@
 -- Migration 017: uploaded_transcripts — PRIVATE transcripts of audio a user
 -- uploaded themselves (ADR-033, tapir#33).
 --
 -- This is deliberately NOT the shared `transcripts` table (migration 015,
 -- ADR-021). That table is non-RLS on the explicit grounds that it holds only
 -- public caption content and nothing user-identifying. A recorded meeting is the
 -- opposite: private third-party content owned by exactly one user. Reusing
 -- `transcripts` — or adding a user_id to it with a partial policy — would put a
 -- private row in the one table the isolation test asserts is shared, and would
 -- pass CI green. A separate table keeps ADR-021's exception singular.
 --
 -- Row-level security follows migration 003 exactly: ENABLE + FORCE (the app
 -- connects as the table owner, which bypasses RLS unless forced), and a policy
 -- keyed off the per-request GUC tapir.current_user_id. With no GUC set the
 -- predicate is NULL and the table is deny-all.
 --
 -- The original audio is never stored (ADR-033): this row is all that is kept.
 -- segments holds the timestamped cues; re-transcribing 90 minutes costs ~7
 -- minutes, so discarding the timestamps would be irreversible.
 CREATE TABLE uploaded_transcripts (
    id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id       UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    title         TEXT NOT NULL,
    status        TEXT NOT NULL DEFAULT 'queued'
                  CHECK (status IN ('queued', 'transcribing', 'done', 'failed')),
    content       TEXT,
    segments      JSONB,
    endpoint      TEXT,             -- which backend served it (iguana | berget); a quality fact
    audio_seconds DOUBLE PRECISION,
    error_kind    TEXT,             -- typed, never a provider's error string (ADR-033)
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    finished_at   TIMESTAMPTZ,
    CONSTRAINT uploaded_transcripts_done_has_content
        CHECK (status <> 'done' OR content IS NOT NULL),
    CONSTRAINT uploaded_transcripts_failed_has_error_kind
        CHECK (status <> 'failed' OR error_kind IS NOT NULL)
 );
 CREATE INDEX idx_uploaded_transcripts_user ON uploaded_transcripts (user_id, created_at DESC);
 ALTER TABLE uploaded_transcripts ENABLE ROW LEVEL SECURITY;
 ALTER TABLE uploaded_transcripts FORCE ROW LEVEL SECURITY;
 CREATE POLICY uploaded_transcripts_isolation ON uploaded_transcripts
    FOR ALL
    USING (user_id = current_setting('tapir.current_user_id', true)::uuid);
 COMMENT ON TABLE uploaded_transcripts IS
    'PRIVATE per-user transcripts of user-supplied audio. RLS-scoped (ADR-012). Never merge into the shared transcripts table (ADR-021, ADR-033).';
@@ -0,0 +1 @@
 ALTER TABLE uploaded_transcripts DROP COLUMN had_video;
@@ -0,0 +1,9 @@
 -- Migration 018: record whether an uploaded file carried a video track (ADR-033,
 -- amended 2026-10-01).
 --
 -- A Teams meeting with the camera off is still an .mp4 with a video track, so video
 -- files are ACCEPTED: only the audio is extracted and the video is discarded. This
 -- flag lets the transcript page say so — "this file contained a video track; only its
 -- audio was used" — so the user is never left to wonder what happened to the picture.
 -- It outlives the job: completing or failing an upload does not clear it.
 ALTER TABLE uploaded_transcripts ADD COLUMN had_video BOOLEAN NOT NULL DEFAULT FALSE;
@@ -0,0 +1,201 @@
 package store
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"time"
 	"github.com/jackc/pgx/v5"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // ErrUploadNotFound is returned when an uploaded transcript does not exist OR is
 // not the caller's. The two are deliberately indistinguishable: a non-owner learns
 // nothing about whether someone else's upload exists (ADR-033).
 var ErrUploadNotFound = errors.New("store: uploaded transcript not found")
 // Uploaded transcripts are PRIVATE per-user content, stored in their own
 // RLS-scoped table (migration 017) — never in the shared `transcripts` (ADR-021).
 // Every method goes through withUser, so row-level security confines it to the
 // caller's rows; each statement ALSO names user_id in its predicate, so the
 // isolation does not rest on a single mechanism and stays testable under the
 // superuser connection the unit tests use.
 // CreateUpload records a new upload in the queued state and returns its id.
 // hadVideo records that the file carried a video track (only its audio is used);
 // it is kept for the life of the row so the page can say so.
 func (s *Store) CreateUpload(ctx context.Context, userID, title string, hadVideo bool) (string, error) {
 	var id string
 	if err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		return tx.QueryRow(ctx,
 			`INSERT INTO uploaded_transcripts (user_id, title, had_video) VALUES ($1, $2, $3) RETURNING id`,
 			userID, title, hadVideo).Scan(&id)
 	}); err != nil {
 		return "", fmt.Errorf("store: create upload: %w", err)
 	}
 	return id, nil
 }
 // StartTranscribing moves an upload to transcribing.
 func (s *Store) StartTranscribing(ctx context.Context, userID, id string) error {
 	return s.updateUpload(ctx, userID, id, "start transcribing",
 		`UPDATE uploaded_transcripts SET status = 'transcribing'
 		  WHERE id = $1 AND user_id = $2`)
 }
 // CompleteUpload stores the finished transcription and moves the upload to done.
 func (s *Store) CompleteUpload(ctx context.Context, userID, id string, t domain.Transcription) error {
 	segs, err := json.Marshal(t.Segments)
 	if err != nil {
 		return fmt.Errorf("store: complete upload: marshal segments: %w", err)
 	}
 	return s.updateUpload(ctx, userID, id, "complete upload",
 		`UPDATE uploaded_transcripts
 		    SET status = 'done', content = $3, segments = $4, endpoint = $5,
 		        audio_seconds = $6, error_kind = NULL, finished_at = NOW()
 		  WHERE id = $1 AND user_id = $2`,
 		t.Text, segs, t.Endpoint, t.AudioSeconds)
 }
 // FailUpload moves an upload to failed with a typed reason.
 func (s *Store) FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error {
 	return s.updateUpload(ctx, userID, id, "fail upload",
 		`UPDATE uploaded_transcripts
 		    SET status = 'failed', error_kind = $3, finished_at = NOW()
 		  WHERE id = $1 AND user_id = $2`,
 		string(kind))
 }
 // updateUpload runs one UPDATE keyed on ($1 = id, $2 = userID) plus extra args,
 // and maps "no row touched" to ErrUploadNotFound — which is what a write to another
 // user's upload looks like under RLS (the row is invisible, not forbidden).
 func (s *Store) updateUpload(ctx context.Context, userID, id, op, sql string, args ...any) error {
 	all := append([]any{id, userID}, args...)
 	return s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		ct, err := tx.Exec(ctx, sql, all...)
 		if err != nil {
 			return fmt.Errorf("store: %s: %w", op, err)
 		}
 		if ct.RowsAffected() == 0 {
 			return ErrUploadNotFound
 		}
 		return nil
 	})
 }
 // GetUpload returns one of the caller's uploads, including the transcript text.
 func (s *Store) GetUpload(ctx context.Context, userID, id string) (*domain.UploadedTranscript, error) {
 	var u domain.UploadedTranscript
 	err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		row := tx.QueryRow(ctx, uploadSelect+` WHERE id = $1 AND user_id = $2`, id, userID)
 		return scanUpload(row, &u, true)
 	})
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrUploadNotFound
 	}
 	if err != nil {
 		return nil, fmt.Errorf("store: get upload: %w", err)
 	}
 	return &u, nil
 }
 // ListUploads returns the caller's uploads, newest first, WITHOUT transcript text
 // or segments: a list view must not drag every transcript along.
 func (s *Store) ListUploads(ctx context.Context, userID string) ([]domain.UploadedTranscript, error) {
 	var out []domain.UploadedTranscript
 	err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		rows, err := tx.Query(ctx, uploadSelect+` WHERE user_id = $1 ORDER BY created_at DESC, id`, userID)
 		if err != nil {
 			return err
 		}
 		defer rows.Close()
 		for rows.Next() {
 			var u domain.UploadedTranscript
 			if err := scanUpload(rows, &u, false); err != nil {
 				return err
 			}
 			out = append(out, u)
 		}
 		return rows.Err()
 	})
 	if err != nil {
 		return nil, fmt.Errorf("store: list uploads: %w", err)
 	}
 	return out, nil
 }
 // FailInterruptedUploads is the start-up sweep. The audio of an upload is never
 // retained (ADR-033), so a job that was queued or transcribing when the process
 // stopped can never resume; leaving it would be a stuck spinner. Every such row,
 // for every user, becomes failed/interrupted and the user re-uploads. It
 // enumerates users from the un-RLS'd identity map and scopes each pass with
 // withUser, exactly as scheduled discovery does (ADR-018). Returns rows failed.
 func (s *Store) FailInterruptedUploads(ctx context.Context) (int, error) {
 	users, err := s.ListAllUsers(ctx)
 	if err != nil {
 		return 0, fmt.Errorf("store: fail interrupted uploads: %w", err)
 	}
 	total := 0
 	for _, u := range users {
 		err := s.withUser(ctx, u.UserID, func(tx pgx.Tx) error {
 			ct, err := tx.Exec(ctx,
 				`UPDATE uploaded_transcripts
 				    SET status = 'failed', error_kind = $2, finished_at = NOW()
 				  WHERE user_id = $1 AND status IN ('queued', 'transcribing')`,
 				u.UserID, string(domain.UploadErrInterrupted))
 			total += int(ct.RowsAffected())
 			return err
 		})
 		if err != nil {
 			return total, fmt.Errorf("store: fail interrupted uploads: user %s: %w", u.UserID, err)
 		}
 	}
 	return total, nil
 }
 const uploadSelect = `SELECT id, user_id, title, status, content, segments, endpoint,
       audio_seconds, error_kind, had_video, created_at, finished_at FROM uploaded_transcripts`
 // scanUpload scans one uploadSelect row. withText controls whether the transcript
 // body and segments are kept (GetUpload) or dropped (ListUploads).
 func scanUpload(row pgx.Row, u *domain.UploadedTranscript, withText bool) error {
 	var (
 		status, errKind, endpoint, content *string
 		segments                           []byte
 		seconds                            *float64
 		finished                           *time.Time
 	)
 	if err := row.Scan(&u.ID, &u.UserID, &u.Title, &status, &content, &segments, &endpoint,
 		&seconds, &errKind, &u.HadVideo, &u.CreatedAt, &finished); err != nil {
 		return err
 	}
 	u.Status = domain.UploadStatus(deref(status))
 	u.Endpoint = deref(endpoint)
 	u.ErrorKind = domain.UploadErrorKind(deref(errKind))
 	if seconds != nil {
 		u.AudioSeconds = *seconds
 	}
 	if finished != nil {
 		u.FinishedAt = *finished
 	}
 	if !withText {
 		return nil
 	}
 	u.Content = deref(content)
 	if len(segments) > 0 {
 		if err := json.Unmarshal(segments, &u.Segments); err != nil {
 			return fmt.Errorf("unmarshal segments: %w", err)
 		}
 	}
 	return nil
 }
 func deref(s *string) string {
 	if s == nil {
 		return ""
 	}
 	return *s
 }
@@ -0,0 +1,196 @@
 package store_test
 import (
 	"context"
 	"sort"
 	"testing"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/stretchr/testify/require"
 )
 // Isolation proof for ADR-033: an uploaded transcript is PRIVATE content owned by
 // one user, so it lives in its own RLS-scoped table — never in the shared,
 // non-RLS `transcripts` (ADR-021). These tests drive the database directly (raw
 // SQL as the non-superuser `app` role) so they observe row-level security itself,
 // not any application-layer WHERE clause. The superuser pool is used only to seed
 // and to read pg_catalog; it bypasses RLS and so must never be the pool whose
 // answers the assertions rest on.
 // seedUploadedTranscript inserts one finished upload for userID as the superuser
 // (RLS bypassed so both users' rows land regardless of any GUC) and returns its id.
 // The text is synthetic — this repo is public, and a real transcript must never
 // appear in it (#33).
 func seedUploadedTranscript(t *testing.T, super *pgxpool.Pool, userID, text string) string {
 	t.Helper()
 	ctx := context.Background()
 	_, err := super.Exec(ctx, `INSERT INTO users (id) VALUES ($1) ON CONFLICT DO NOTHING`, userID)
 	require.NoError(t, err)
 	var id string
 	require.NoError(t, super.QueryRow(ctx,
 		`INSERT INTO uploaded_transcripts (user_id, title, status, content)
 		 VALUES ($1, 'synthetic fixture', 'done', $2) RETURNING id`,
 		userID, text).Scan(&id))
 	return id
 }
 func TestUploadedTranscriptsRLS_ScopedReadsSeeOnlyOwnRows(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	seedUploadedTranscript(t, super, userB, "text owned by B")
 	app := appPool(t, super)
 	require.Equal(t, 0, scopedCount(t, app, "", "uploaded_transcripts"),
 		"no tapir.current_user_id must be deny-all: this proves RLS is live, not bypassed")
 	require.Equal(t, 1, scopedCount(t, app, userA, "uploaded_transcripts"),
 		"user A must see exactly its own upload")
 	require.Equal(t, 1, scopedCount(t, app, userB, "uploaded_transcripts"),
 		"user B must see exactly its own upload")
 	// Count alone cannot distinguish "A's row" from "B's row" — read the content.
 	var got string
 	ctx := context.Background()
 	tx, err := app.Begin(ctx)
 	require.NoError(t, err)
 	defer tx.Rollback(ctx) //nolint:errcheck
 	_, err = tx.Exec(ctx, `SELECT set_config('tapir.current_user_id', $1, true)`, userA)
 	require.NoError(t, err)
 	require.NoError(t, tx.QueryRow(ctx, `SELECT content FROM uploaded_transcripts`).Scan(&got))
 	require.Equal(t, "text owned by A", got, "A's scoped read must return A's text, never B's")
 }
 func TestUploadedTranscriptsRLS_CrossUserWritesAffectZeroRows(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	bID := seedUploadedTranscript(t, super, userB, "text owned by B")
 	app := appPool(t, super)
 	require.Equal(t, int64(0), scopedRowsAffected(t, app, userA,
 		`UPDATE uploaded_transcripts SET content = 'hacked' WHERE id = $1`, bID),
 		"user A scoped UPDATE must touch zero of B's uploads")
 	require.Equal(t, int64(0), scopedRowsAffected(t, app, userA,
 		`DELETE FROM uploaded_transcripts WHERE id = $1`, bID),
 		"user A scoped DELETE must touch zero of B's uploads")
 	var content string
 	require.NoError(t, super.QueryRow(context.Background(),
 		`SELECT content FROM uploaded_transcripts WHERE id = $1`, bID).Scan(&content))
 	require.Equal(t, "text owned by B", content, "B's upload must survive A's writes unchanged")
 }
 func TestUploadedTranscriptsRLS_InsertForAnotherUserIsRejected(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	_, err := super.Exec(context.Background(), `INSERT INTO users (id) VALUES ($1)`, userB)
 	require.NoError(t, err)
 	app := appPool(t, super)
 	ctx := context.Background()
 	tx, err := app.Begin(ctx)
 	require.NoError(t, err)
 	defer tx.Rollback(ctx) //nolint:errcheck
 	_, err = tx.Exec(ctx, `SELECT set_config('tapir.current_user_id', $1, true)`, userA)
 	require.NoError(t, err)
 	// Scoped as A, plant a row that claims to belong to B. The policy's WITH CHECK
 	// (defaulting to USING under FOR ALL) must refuse it.
 	_, err = tx.Exec(ctx,
 		`INSERT INTO uploaded_transcripts (user_id, title, status, content)
 		 VALUES ($1, 'planted', 'done', 'planted')`, userB)
 	require.Error(t, err, "a row scoped as A must not be insertable on behalf of B")
 	require.Contains(t, err.Error(), "row-level security")
 }
 func TestUploadedTranscripts_RowSecurityIsEnabledForcedAndKeyedByUser(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	ctx := context.Background()
 	var enabled, forced bool
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT relrowsecurity, relforcerowsecurity FROM pg_class
 		  WHERE oid = 'public.uploaded_transcripts'::regclass`).Scan(&enabled, &forced))
 	require.True(t, enabled, "uploaded_transcripts must have row-level security enabled")
 	require.True(t, forced,
 		"FORCE is what binds the table-owner role tapir; without it the policy is dead in production")
 	var userIDNotNull bool
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT is_nullable = 'NO' FROM information_schema.columns
 		  WHERE table_name = 'uploaded_transcripts' AND column_name = 'user_id'`).Scan(&userIDNotNull))
 	require.True(t, userIDNotNull, "an upload with no owner would match no policy and be unreachable")
 }
 func TestUploadedTranscripts_DeleteUserRemovesTheirUploads(t *testing.T) {
 	s := newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	bID := seedUploadedTranscript(t, super, userB, "text owned by B")
 	require.NoError(t, s.DeleteUser(context.Background(), userA))
 	var aRows, bRows int
 	ctx := context.Background()
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT count(*) FROM uploaded_transcripts WHERE user_id = $1`, userA).Scan(&aRows))
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT count(*) FROM uploaded_transcripts WHERE id = $1`, bID).Scan(&bRows))
 	require.Equal(t, 0, aRows, "deleting a user must remove their private transcripts (ON DELETE CASCADE)")
 	require.Equal(t, 1, bRows, "deleting A must not touch B's transcripts")
 }
 // rowSecurityOffTables are the public-schema tables that deliberately have row
 // security OFF. The list is exact on purpose: a NEW table added without RLS must
 // fail this test and force a decision, instead of passing CI by omission — the
 // failure mode ADR-033 names, where a naive reuse "leaks private content across
 // tenants and passes CI green".
 //
 //   - transcripts: shared public caption content, the single exception for CONTENT
 //     (ADR-021). It is the one that must never gain a private row.
 //   - user_identities: the Dex-subject -> user_id map, read at login before any
 //     user is known (migration 004). Holds no user content.
 //   - invitations: exists before the user does, so there is no user to scope by;
 //     the single-use token is the capability (migration 009).
 //   - schema_migrations: golang-migrate bookkeeping.
 //
 // #33 describes `transcripts` as "the only non-RLS table". That is true of content
 // and false of tables; this test asserts the real set.
 var rowSecurityOffTables = []string{
 	"invitations",
 	"schema_migrations",
 	"transcripts",
 	"user_identities",
 }
 func TestRowSecurityOffTablesAreExactlyTheKnownSet(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	rows, err := super.Query(context.Background(),
 		`SELECT c.relname FROM pg_class c
 		   JOIN pg_namespace n ON n.oid = c.relnamespace
 		  WHERE n.nspname = 'public' AND c.relkind IN ('r', 'p') AND NOT c.relrowsecurity
 		  ORDER BY c.relname`)
 	require.NoError(t, err)
 	defer rows.Close()
 	var got []string
 	for rows.Next() {
 		var name string
 		require.NoError(t, rows.Scan(&name))
 		got = append(got, name)
 	}
 	require.NoError(t, rows.Err())
 	want := append([]string{}, rowSecurityOffTables...)
 	sort.Strings(want)
 	require.Equal(t, want, got,
 		"every public table must have row security ON unless it is in rowSecurityOffTables; "+
 			"adding a table here is a decision that needs an ADR")
 }
@@ -0,0 +1,232 @@
 package store_test
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // These exercise the Store API over uploaded_transcripts. The test Store connects
 // as the superuser, which BYPASSES row-level security — so the cross-user cases
 // here prove the query's own user_id predicate (defence in depth), while the
 // database-enforced guarantee is proven separately, as the non-superuser app
 // role, in uploaded_transcripts_isolation_test.go. Text is synthetic; this repo is
 // public and no real transcript may appear in it (#33).
 func seedUsers(t *testing.T, ids ...string) {
 	t.Helper()
 	super := rawPool(t)
 	resetDB(t, super)
 	for _, id := range ids {
 		_, err := super.Exec(context.Background(), `INSERT INTO users (id) VALUES ($1)`, id)
 		require.NoError(t, err)
 	}
 }
 func TestCreateUpload_StartsQueuedAndIsOwnedByTheCreator(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "Teams export", false)
 	require.NoError(t, err)
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, id, got.ID)
 	assert.Equal(t, userA, got.UserID)
 	assert.Equal(t, "Teams export", got.Title)
 	assert.Equal(t, domain.UploadQueued, got.Status)
 	assert.Empty(t, got.Content)
 	assert.True(t, got.FinishedAt.IsZero(), "an unfinished upload has no finish time")
 }
 func TestUploadLifecycle_CompletedKeepsTextSegmentsEndpointAndDuration(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	mid, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadTranscribing, mid.Status)
 	want := domain.Transcription{
 		Text: "God morgon allihopa. Vi går igenom läget.",
 		Segments: []domain.Segment{
 			{Start: 0.0, End: 1.5, Text: "God morgon allihopa."},
 			{Start: 1.5, End: 4.25, Text: "Vi går igenom läget."},
 		},
 		Endpoint:     "iguana/kb-whisper",
 		AudioSeconds: 4.25,
 	}
 	require.NoError(t, s.CompleteUpload(ctx, userA, id, want))
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadDone, got.Status)
 	assert.Equal(t, want.Text, got.Content)
 	assert.Equal(t, want.Segments, got.Segments, "segment times must survive the JSONB round trip")
 	assert.Equal(t, "iguana/kb-whisper", got.Endpoint, "the serving endpoint is a quality fact and is recorded per row")
 	assert.InDelta(t, 4.25, got.AudioSeconds, 1e-9)
 	assert.False(t, got.FinishedAt.IsZero())
 	assert.Empty(t, got.ErrorKind)
 }
 func TestUploadLifecycle_FailedRecordsTypedKindAndNoContent(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "m", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	require.NoError(t, s.FailUpload(ctx, userA, id, domain.UploadErrTranscriptionFailed))
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadFailed, got.Status)
 	assert.Equal(t, domain.UploadErrTranscriptionFailed, got.ErrorKind)
 	assert.Empty(t, got.Content)
 	assert.False(t, got.FinishedAt.IsZero())
 }
 func TestGetUpload_AnotherUsersIDIsNotFound(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "A's meeting", false)
 	require.NoError(t, err)
 	_, err = s.GetUpload(ctx, userB, id)
 	assert.ErrorIs(t, err, store.ErrUploadNotFound,
 		"a non-owner must get not-found, not forbidden: existence is not disclosed")
 }
 func TestUploadWrites_ByAnotherUserChangeNothing(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "A's meeting", false)
 	require.NoError(t, err)
 	assert.ErrorIs(t, s.StartTranscribing(ctx, userB, id), store.ErrUploadNotFound)
 	assert.ErrorIs(t, s.CompleteUpload(ctx, userB, id, domain.Transcription{Text: "planted"}), store.ErrUploadNotFound)
 	assert.ErrorIs(t, s.FailUpload(ctx, userB, id, domain.UploadErrTranscriptionFailed), store.ErrUploadNotFound)
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadQueued, got.Status, "B's writes must leave A's upload exactly as it was")
 	assert.Empty(t, got.Content)
 }
 func TestListUploads_ReturnsOnlyTheCallersNewestFirstWithoutTranscriptText(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	first, err := s.CreateUpload(ctx, userA, "first", false)
 	require.NoError(t, err)
 	second, err := s.CreateUpload(ctx, userA, "second", false)
 	require.NoError(t, err)
 	_, err = s.CreateUpload(ctx, userB, "B's", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, first))
 	require.NoError(t, s.CompleteUpload(ctx, userA, first, domain.Transcription{Text: "long text body", Endpoint: "e"}))
 	got, err := s.ListUploads(ctx, userA)
 	require.NoError(t, err)
 	require.Len(t, got, 2, "A must see only A's uploads")
 	assert.Equal(t, second, got[0].ID, "newest first")
 	assert.Equal(t, first, got[1].ID)
 	assert.Empty(t, got[1].Content, "a list row must not drag the whole transcript along")
 	assert.Equal(t, domain.UploadDone, got[1].Status)
 }
 func TestFailInterruptedUploads_FailsOnlyUnfinishedRowsForEveryUser(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	super := rawPool(t)
 	ctx := context.Background()
 	for subject, uid := range map[string]string{"sub-a": userA, "sub-b": userB} {
 		_, err := super.Exec(ctx, `INSERT INTO user_identities (dex_subject, user_id) VALUES ($1, $2)`, subject, uid)
 		require.NoError(t, err)
 	}
 	queued, err := s.CreateUpload(ctx, userA, "queued", false)
 	require.NoError(t, err)
 	running, err := s.CreateUpload(ctx, userB, "running", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userB, running))
 	done, err := s.CreateUpload(ctx, userA, "done", false)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, done))
 	require.NoError(t, s.CompleteUpload(ctx, userA, done, domain.Transcription{Text: "kept", Endpoint: "e"}))
 	n, err := s.FailInterruptedUploads(ctx)
 	require.NoError(t, err)
 	assert.Equal(t, 2, n, "the queued and the transcribing row, across both users")
 	for _, c := range []struct{ user, id string }{{userA, queued}, {userB, running}} {
 		got, err := s.GetUpload(ctx, c.user, c.id)
 		require.NoError(t, err)
 		assert.Equal(t, domain.UploadFailed, got.Status)
 		assert.Equal(t, domain.UploadErrInterrupted, got.ErrorKind,
 			"audio is not retained, so a restart cannot resume: the honest state is failed/interrupted")
 	}
 	kept, err := s.GetUpload(ctx, userA, done)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadDone, kept.Status, "a finished transcript must survive the sweep")
 	assert.Equal(t, "kept", kept.Content)
 }
 func TestCreateUpload_RecordsWhetherTheFileHadAVideoTrack(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	withVideo, err := s.CreateUpload(ctx, userA, "camera off", true)
 	require.NoError(t, err)
 	audioOnly, err := s.CreateUpload(ctx, userA, "voice only", false)
 	require.NoError(t, err)
 	gotVideo, err := s.GetUpload(ctx, userA, withVideo)
 	require.NoError(t, err)
 	gotAudio, err := s.GetUpload(ctx, userA, audioOnly)
 	require.NoError(t, err)
 	listed, err := s.ListUploads(ctx, userA)
 	require.NoError(t, err)
 	assert.True(t, gotVideo.HadVideo, "the page must be able to say the video was ignored")
 	assert.False(t, gotAudio.HadVideo)
 	byID := map[string]bool{}
 	for _, u := range listed {
 		byID[u.ID] = u.HadVideo
 	}
 	assert.Equal(t, map[string]bool{withVideo: true, audioOnly: false}, byID, "the list carries it too")
 }
 func TestUploadHadVideo_SurvivesCompletionAndFailure(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	done, err := s.CreateUpload(ctx, userA, "d", true)
 	require.NoError(t, err)
 	failed, err := s.CreateUpload(ctx, userA, "f", true)
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, done))
 	require.NoError(t, s.CompleteUpload(ctx, userA, done, domain.Transcription{Text: "x", Endpoint: "e"}))
 	require.NoError(t, s.FailUpload(ctx, userA, failed, domain.UploadErrTranscriptionFailed))
 	for _, id := range []string{done, failed} {
 		got, err := s.GetUpload(ctx, userA, id)
 		require.NoError(t, err)
 		assert.True(t, got.HadVideo, "completing or failing must not clear it: the notice outlives the job")
 	}
 }
@@ -0,0 +1,53 @@
 package transcribe
 import (
 	"context"
 	"errors"
 	"fmt"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // Backend is one transcription endpoint. *Gateway satisfies it; Name is the value
 // recorded as the serving endpoint.
 type Backend interface {
 	Name() string
 	Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error)
 }
 // Chain tries a primary (local) backend and, if it fails for ANY reason, a
 // fallback. The fallback exists because iguana can wedge permanently on a Metal
 // OOM (infra#273) — which is also why a fallback is a data-egress decision: the
 // berget endpoint is a cloud service, so the result records which one served it.
 type Chain struct {
 	primary  Backend
 	fallback Backend // nil disables the fallback
 }
 // NewChain builds a Chain. A nil fallback means a primary failure is the result.
 func NewChain(primary, fallback Backend) *Chain {
 	return &Chain{primary: primary, fallback: fallback}
 }
 // Transcribe returns the first backend's success. It falls back on any primary
 // error — transport, timeout, non-2xx, empty transcript — and never inspects a
 // response body to decide. A cancelled context stops the chain: a job the user or
 // shutdown cancelled must not ship its audio to a cloud endpoint as a last act.
 func (c *Chain) Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error) {
 	t, err := c.primary.Transcribe(ctx, wavPath)
 	if err == nil {
 		t.Endpoint = c.primary.Name()
 		return t, nil
 	}
 	if c.fallback == nil || ctx.Err() != nil {
 		return domain.Transcription{}, fmt.Errorf("%s: %w", c.primary.Name(), err)
 	}
 	t, ferr := c.fallback.Transcribe(ctx, wavPath)
 	if ferr != nil {
 		return domain.Transcription{}, errors.Join(
 			fmt.Errorf("%s: %w", c.primary.Name(), err),
 			fmt.Errorf("%s: %w", c.fallback.Name(), ferr))
 	}
 	t.Endpoint = c.fallback.Name()
 	return t, nil
 }
@@ -0,0 +1,99 @@
 package transcribe_test
 import (
 	"context"
 	"errors"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 type fakeBackend struct {
 	name  string
 	text  string
 	err   error
 	calls int
 }
 func (f *fakeBackend) Name() string { return f.name }
 func (f *fakeBackend) Transcribe(_ context.Context, _ string) (domain.Transcription, error) {
 	f.calls++
 	if f.err != nil {
 		return domain.Transcription{}, f.err
 	}
 	return domain.Transcription{Text: f.text, Endpoint: f.name}, nil
 }
 func TestChain_PrimarySuccessNeverTouchesTheFallback(t *testing.T) {
 	primary := &fakeBackend{name: "iguana/kb-whisper", text: "primary text"}
 	fallback := &fakeBackend{name: "berget/kb-whisper", text: "fallback text"}
 	got, err := transcribe.NewChain(primary, fallback).Transcribe(context.Background(), "/a.wav")
 	require.NoError(t, err)
 	assert.Equal(t, "primary text", got.Text)
 	assert.Equal(t, "iguana/kb-whisper", got.Endpoint)
 	assert.Zero(t, fallback.calls, "audio must not leave the homelab when the local endpoint worked")
 }
 func TestChain_AnyPrimaryFailureFallsBackAndRecordsTheFallbackEndpoint(t *testing.T) {
 	tests := []struct {
 		name string
 		err  error
 	}{
 		{"server error", &transcribe.StatusError{Code: 500}},
 		{"gateway timeout", &transcribe.StatusError{Code: 504}},
 		{"client error", &transcribe.StatusError{Code: 400}},
 		{"transport failure", errors.New("dial tcp: connection refused")},
 		{"empty transcript", transcribe.ErrEmptyTranscript},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			primary := &fakeBackend{name: "iguana/kb-whisper", err: tt.err}
 			fallback := &fakeBackend{name: "berget/kb-whisper", text: "fallback text"}
 			got, err := transcribe.NewChain(primary, fallback).Transcribe(context.Background(), "/a.wav")
 			require.NoError(t, err)
 			assert.Equal(t, "fallback text", got.Text)
 			assert.Equal(t, "berget/kb-whisper", got.Endpoint,
 				"the row must say berget served it: that means the audio left the homelab")
 		})
 	}
 }
 func TestChain_BothFailingReportsBothErrors(t *testing.T) {
 	primary := &fakeBackend{name: "iguana/kb-whisper", err: errors.New("iguana down")}
 	fallback := &fakeBackend{name: "berget/kb-whisper", err: errors.New("berget down")}
 	_, err := transcribe.NewChain(primary, fallback).Transcribe(context.Background(), "/a.wav")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "iguana down")
 	assert.Contains(t, err.Error(), "berget down")
 }
 func TestChain_WithoutAFallbackAPrimaryFailureIsTheResult(t *testing.T) {
 	primary := &fakeBackend{name: "iguana/kb-whisper", err: errors.New("iguana down")}
 	_, err := transcribe.NewChain(primary, nil).Transcribe(context.Background(), "/a.wav")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "iguana down")
 }
 func TestChain_ACancelledJobDoesNotFallBack(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	primary := &fakeBackend{name: "iguana/kb-whisper", err: context.Canceled}
 	fallback := &fakeBackend{name: "berget/kb-whisper", text: "x"}
 	_, err := transcribe.NewChain(primary, fallback).Transcribe(ctx, "/a.wav")
 	assert.ErrorIs(t, err, context.Canceled)
 	assert.Zero(t, fallback.calls, "a cancelled job must not ship the audio to a cloud endpoint")
 }
@@ -0,0 +1,185 @@
 // Package transcribe turns a WAV file into a timed Swedish transcript by calling
 // the LiteLLM gateway's OpenAI-compatible /audio/transcriptions endpoint
 // (ADR-033). A Gateway is one model alias; a Chain tries a local one and falls
 // back to a second.
 package transcribe
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"mime/multipart"
 	"net/http"
 	"os"
 	"strings"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // ErrEmptyTranscript is returned when the endpoint answered 200 but with no text.
 // An empty transcript is not a success: chat over it could only answer "nothing".
 var ErrEmptyTranscript = errors.New("transcribe: endpoint returned an empty transcript")
 // StatusError is a non-2xx answer from the gateway. Nothing may branch on the
 // body — {"error":"failed to process audio"} has had at least five distinct
 // causes — so only the status code is exposed for logic; Snippet is for logs.
 type StatusError struct {
 	Code    int
 	Snippet string
 }
 func (e *StatusError) Error() string {
 	return fmt.Sprintf("transcribe: gateway returned HTTP %d: %s", e.Code, e.Snippet)
 }
 // Gateway transcribes through one model alias on the gateway. baseURL is the
 // gateway's /v1 root — the in-cluster NodePort, not the public hostname, whose
 // ingress rejects bodies over ~8-10 MB with 413 (docs/research/audio-length-ceiling).
 type Gateway struct {
 	baseURL string
 	key     string
 	model   string
 	client  *http.Client
 }
 // NewGateway builds a Gateway. The client should carry no overall Timeout: a 90
 // minute recording takes minutes, so the deadline belongs to the caller's context.
 func NewGateway(baseURL, key, model string, client *http.Client) *Gateway {
 	return &Gateway{baseURL: strings.TrimRight(baseURL, "/"), key: key, model: model, client: client}
 }
 // Name is the model alias; it is what gets recorded as the serving endpoint.
 func (g *Gateway) Name() string { return g.model }
 // Transcribe uploads the WAV at path and returns the normalised transcription.
 // The body is streamed from disk with a COMPUTED Content-Length: a 90 minute WAV
 // is ~170 MB, so it is neither buffered in memory nor sent chunked.
 func (g *Gateway) Transcribe(ctx context.Context, path string) (domain.Transcription, error) {
 	f, err := os.Open(path)
 	if err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: open audio: %w", err)
 	}
 	defer f.Close()
 	info, err := f.Stat()
 	if err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: stat audio: %w", err)
 	}
 	var prefix bytes.Buffer
 	mw := multipart.NewWriter(&prefix)
 	for _, kv := range [][2]string{{"model", g.model}, {"response_format", "verbose_json"}, {"language", "sv"}} {
 		if err := mw.WriteField(kv[0], kv[1]); err != nil {
 			return domain.Transcription{}, fmt.Errorf("transcribe: build request: %w", err)
 		}
 	}
 	// The multipart field is `file`; `audio_file` is rejected as "Invalid request".
 	if _, err := mw.CreateFormFile("file", "audio.wav"); err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: build request: %w", err)
 	}
 	suffix := []byte("\r\n--" + mw.Boundary() + "--\r\n")
 	body := io.MultiReader(bytes.NewReader(prefix.Bytes()), f, bytes.NewReader(suffix))
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.baseURL+"/audio/transcriptions", body)
 	if err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: build request: %w", err)
 	}
 	req.ContentLength = int64(prefix.Len()) + info.Size() + int64(len(suffix))
 	req.Header.Set("Content-Type", mw.FormDataContentType())
 	req.Header.Set("Authorization", "Bearer "+g.key)
 	// No "Expect: 100-continue": it trips the proxy for any body over 1 KB.
 	resp, err := g.client.Do(req)
 	if err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: %s: %w", g.model, err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
 		snip, _ := io.ReadAll(io.LimitReader(resp.Body, 200))
 		return domain.Transcription{}, &StatusError{Code: resp.StatusCode, Snippet: strings.TrimSpace(string(snip))}
 	}
 	t, err := parseVerbose(resp.Body)
 	if err != nil {
 		return domain.Transcription{}, fmt.Errorf("transcribe: %s: %w", g.model, err)
 	}
 	t.Endpoint = g.model
 	return t, nil
 }
 // verboseJSON is the subset of the verbose_json response used. Both backends
 // return it; they differ in segment granularity (iguana: whole seconds and
 // sub-sentence pieces, berget: sub-second sentences), in the language token, and in
 // whether a segment's text starts with a space.
 type verboseJSON struct {
 	Text     string  `json:"text"`
 	Duration float64 `json:"duration"`
 	Segments []struct {
 		Start float64 `json:"start"`
 		End   float64 `json:"end"`
 		Text  string  `json:"text"`
 	} `json:"segments"`
 }
 // parseVerbose normalises a verbose_json body. Whisper's final window can end past
 // the audio (9.0 s for 4.25 s of audio was observed), so segment ends are clamped
 // to the reported duration. Text is rebuilt from the segments, not taken from the
 // response's `text` field: see joinSegments.
 func parseVerbose(r io.Reader) (domain.Transcription, error) {
 	var v verboseJSON
 	if err := json.NewDecoder(r).Decode(&v); err != nil {
 		return domain.Transcription{}, fmt.Errorf("decode response: %w", err)
 	}
 	raw := make([]string, 0, len(v.Segments))
 	for _, s := range v.Segments {
 		raw = append(raw, s.Text)
 	}
 	text := joinSegments(raw)
 	if text == "" {
 		text = collapseSpace(v.Text)
 	}
 	if text == "" {
 		return domain.Transcription{}, ErrEmptyTranscript
 	}
 	t := domain.Transcription{Text: text, AudioSeconds: v.Duration}
 	for _, s := range v.Segments {
 		seg := domain.Segment{Start: s.Start, End: s.End, Text: strings.TrimSpace(s.Text)}
 		if v.Duration > 0 {
 			seg.End = min(seg.End, v.Duration)
 			seg.Start = min(seg.Start, seg.End)
 		}
 		t.Segments = append(t.Segments, seg)
 	}
 	return t, nil
 }
 // joinSegments rebuilds the running text from raw (untrimmed) segment texts.
 //
 // whisper.cpp wraps its output at ~60 characters and a wrap can land INSIDE a word
 // ("nyt" | "t godkännande"): a segment that begins with a space starts a new word,
 // one that does not continues the previous one, and the response's own `text`
 // field joins them with newlines, which breaks the word. So when any segment
 // carries a leading space the raw texts are concatenated as they are. Backends
 // that return whole sentences with no leading space (berget) are joined with a
 // space instead — concatenating those would glue sentences together.
 func joinSegments(raw []string) string {
 	leadingSpace := false
 	for _, s := range raw {
 		if strings.HasPrefix(s, " ") {
 			leadingSpace = true
 			break
 		}
 	}
 	sep := " "
 	if leadingSpace {
 		sep = ""
 	}
 	return collapseSpace(strings.Join(raw, sep))
 }
 // collapseSpace turns every run of whitespace (including newlines) into one space.
 func collapseSpace(s string) string {
 	return strings.Join(strings.Fields(s), " ")
 }
@@ -0,0 +1,232 @@
 package transcribe_test
 import (
 	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // The httptest server stands in for the LiteLLM gateway: it is the process
 // boundary, so a fake here is legitimate. The JSON it returns mirrors what the
 // real gateway returned for iguana/kb-whisper and berget/kb-whisper on 2026-10-01
 // (docs/research/audio-length-ceiling-2026-10-01.md). All text is synthetic.
 const verboseJSON = `{
  "text": " God morgon allihopa.\n Vi går igenom läget.\n",
  "language": "swedish",
  "duration": 4.25,
  "segments": [
    {"id": 0, "start": 0.0, "end": 1.0, "text": " God morgon allihopa."},
    {"id": 1, "start": 1.0, "end": 9.0, "text": " Vi går igenom läget."}
  ]
 }`
 func wavFile(t *testing.T, content string) string {
 	t.Helper()
 	p := filepath.Join(t.TempDir(), "a.wav")
 	require.NoError(t, os.WriteFile(p, []byte(content), 0o600))
 	return p
 }
 type seen struct {
 	method, path, auth, expect, contentType string
 	contentLength                           int64
 	transferEncoding                        []string
 	fields                                  map[string]string
 	file                                    string
 	fileField                               string
 	bodyLen                                 int
 }
 // serve starts a gateway fake that records the request it received and replies
 // with status and body.
 func serve(t *testing.T, status int, reply string, got *seen) *httptest.Server {
 	t.Helper()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if got != nil {
 			got.method, got.path = r.Method, r.URL.Path
 			got.auth = r.Header.Get("Authorization")
 			got.expect = r.Header.Get("Expect")
 			got.contentType = r.Header.Get("Content-Type")
 			got.contentLength = r.ContentLength
 			got.transferEncoding = r.TransferEncoding
 			raw, _ := io.ReadAll(r.Body)
 			got.bodyLen = len(raw)
 			r.Body = io.NopCloser(bytes.NewReader(raw))
 			require.NoError(t, r.ParseMultipartForm(32<<20))
 			got.fields = map[string]string{}
 			for k, v := range r.MultipartForm.Value {
 				got.fields[k] = v[0]
 			}
 			for field, fhs := range r.MultipartForm.File {
 				got.fileField = field
 				f, _ := fhs[0].Open()
 				b, _ := io.ReadAll(f)
 				got.file = string(b)
 			}
 		}
 		w.WriteHeader(status)
 		_, _ = io.WriteString(w, reply)
 	}))
 	t.Cleanup(srv.Close)
 	return srv
 }
 func TestGateway_SendsTheRequestTheGatewayExpects(t *testing.T) {
 	var got seen
 	srv := serve(t, 200, verboseJSON, &got)
 	g := transcribe.NewGateway(srv.URL+"/v1", "secret-key", "iguana/kb-whisper", srv.Client())
 	_, err := g.Transcribe(context.Background(), wavFile(t, "RIFF-synthetic-pcm"))
 	require.NoError(t, err)
 	assert.Equal(t, http.MethodPost, got.method)
 	assert.Equal(t, "/v1/audio/transcriptions", got.path)
 	assert.Equal(t, "Bearer secret-key", got.auth)
 	assert.Equal(t, "file", got.fileField, "the multipart field is `file`; `audio_file` is rejected as 'Invalid request'")
 	assert.Equal(t, "RIFF-synthetic-pcm", got.file)
 	assert.Equal(t, "iguana/kb-whisper", got.fields["model"])
 	assert.Equal(t, "verbose_json", got.fields["response_format"])
 	assert.Equal(t, "sv", got.fields["language"])
 	assert.Empty(t, got.expect, "no Expect: 100-continue: it trips the proxy for any body over 1 KB")
 }
 func TestGateway_SendsAKnownContentLengthNotChunked(t *testing.T) {
 	var got seen
 	srv := serve(t, 200, verboseJSON, &got)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "m", srv.Client())
 	_, err := g.Transcribe(context.Background(), wavFile(t, "0123456789"))
 	require.NoError(t, err)
 	assert.Empty(t, got.transferEncoding, "a 90-minute WAV is ~170 MB: stream it with a computed length, not chunked and not buffered")
 	assert.Equal(t, int64(got.bodyLen), got.contentLength)
 }
 func TestGateway_NormalisesTheVerboseJSONResponse(t *testing.T) {
 	srv := serve(t, 200, verboseJSON, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client())
 	got, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	require.NoError(t, err)
 	assert.Equal(t, "God morgon allihopa. Vi går igenom läget.", got.Text)
 	assert.Equal(t, "iguana/kb-whisper", got.Endpoint, "the serving endpoint is part of the result")
 	assert.InDelta(t, 4.25, got.AudioSeconds, 1e-9)
 	assert.Equal(t, []domain.Segment{
 		{Start: 0, End: 1, Text: "God morgon allihopa."},
 		// The final segment ended at 9.0 s for 4.25 s of audio: whisper's last
 		// window can run past the end. Clamped to the audio duration.
 		{Start: 1, End: 4.25, Text: "Vi går igenom läget."},
 	}, got.Segments)
 }
 func TestGateway_ErrorsDoNotDependOnTheBody(t *testing.T) {
 	// {"error":"failed to process audio"} has had at least five distinct causes, so
 	// no code may branch on it. Two different bodies must be treated identically.
 	for _, reply := range []string{`{"error":"failed to process audio"}`, `{"error":"something else entirely"}`} {
 		srv := serve(t, 500, reply, nil)
 		g := transcribe.NewGateway(srv.URL+"/v1", "k", "m", srv.Client())
 		_, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 		var se *transcribe.StatusError
 		require.ErrorAs(t, err, &se)
 		assert.Equal(t, 500, se.Code)
 	}
 }
 func TestGateway_AnEmptyTranscriptIsAFailureNotASuccess(t *testing.T) {
 	srv := serve(t, 200, `{"text":"  ","language":"swedish","duration":3,"segments":[]}`, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "m", srv.Client())
 	_, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	assert.ErrorIs(t, err, transcribe.ErrEmptyTranscript)
 }
 func TestGateway_MalformedJSONIsAnError(t *testing.T) {
 	srv := serve(t, 200, `not json`, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "m", srv.Client())
 	_, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	assert.Error(t, err)
 }
 func TestGateway_MissingAudioFileIsAnError(t *testing.T) {
 	g := transcribe.NewGateway("http://127.0.0.1:1/v1", "k", "m", http.DefaultClient)
 	_, err := g.Transcribe(context.Background(), filepath.Join(t.TempDir(), "nope.wav"))
 	assert.Error(t, err)
 }
 // whisper.cpp wraps its output at ~60 characters, and a wrap can land INSIDE a word:
 // the continuation segment has no leading space, the `text` field joins segments
 // with newlines, and a segment can be a lone ".". Measured on real gateway output
 // 2026-10-01: 7% of a one-hour recording's segments were such fragments. Joining by
 // newline hands the chat model broken words ("nyt\nt"), so Text is rebuilt from the
 // segments: a segment that begins with a space starts a new word, one that does not
 // continues the previous one.
 func TestGateway_RejoinsWordsWhisperCppSplitAcrossSegments(t *testing.T) {
 	reply := `{
 	  "text": " Vi ligger just nu 12 procent över den ursprungliga kalkylen\n.\n Det kräver ett nyt\nt godkännande från beställaren.\n Framförallt på arbetspl\natsen.\n",
 	  "language": "swedish", "duration": 20,
 	  "segments": [
 	    {"start": 0, "end": 4, "text": " Vi ligger just nu 12 procent över den ursprungliga kalkylen"},
 	    {"start": 4, "end": 5, "text": "."},
 	    {"start": 5, "end": 8, "text": " Det kräver ett nyt"},
 	    {"start": 8, "end": 11, "text": "t godkännande från beställaren."},
 	    {"start": 11, "end": 14, "text": " Framförallt på arbetspl"},
 	    {"start": 14, "end": 16, "text": "atsen."}
 	  ]}`
 	srv := serve(t, 200, reply, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "iguana/kb-whisper", srv.Client())
 	got, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	require.NoError(t, err)
 	assert.Equal(t, "Vi ligger just nu 12 procent över den ursprungliga kalkylen. "+
 		"Det kräver ett nytt godkännande från beställaren. Framförallt på arbetsplatsen.", got.Text)
 	assert.Len(t, got.Segments, 6, "the timed segments are kept as the backend gave them (trimmed)")
 	assert.Equal(t, ".", got.Segments[1].Text)
 }
 func TestGateway_SentenceLevelSegmentsWithNoLeadingSpaceAreJoinedWithASpace(t *testing.T) {
 	// berget/kb-whisper returns whole sentences with no leading space; rebuilding by
 	// concatenation would glue them ("allihopa!Vi").
 	reply := `{"text": "God morgon allihopa!\nVi går igenom läget.", "language": "sv", "duration": 5,
 	  "segments": [
 	    {"start": 0.05, "end": 1.2, "text": "God morgon allihopa!"},
 	    {"start": 1.6, "end": 4.2, "text": "Vi går igenom läget."}
 	  ]}`
 	srv := serve(t, 200, reply, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "berget/kb-whisper", srv.Client())
 	got, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	require.NoError(t, err)
 	assert.Equal(t, "God morgon allihopa! Vi går igenom läget.", got.Text)
 }
 func TestGateway_WithNoSegmentsTheTextFieldIsUsedWithWhitespaceCollapsed(t *testing.T) {
 	srv := serve(t, 200, `{"text": "  Hej  allihopa.\n Vi börjar.  ", "duration": 3, "segments": []}`, nil)
 	g := transcribe.NewGateway(srv.URL+"/v1", "k", "m", srv.Client())
 	got, err := g.Transcribe(context.Background(), wavFile(t, "x"))
 	require.NoError(t, err)
 	assert.Equal(t, "Hej allihopa. Vi börjar.", got.Text)
 }
@@ -0,0 +1,49 @@
 package transcribe_test
 import (
 	"context"
 	"net/http"
 	"os"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/transcribe"
 )
 // TestGateway_LiveGateway is an opt-in check against the REAL gateway, because
 // the httptest fake above can only prove what we think the gateway accepts. It
 // is skipped unless TAPIR_LIVE_WAV names a 16 kHz mono WAV and the gateway
 // coordinates are set:
 //
 //	TAPIR_LIVE_WAV=/path/a.wav TAPIR_LIVE_GATEWAY_URL=http://koala:30401/v1 \
 //	TAPIR_LIVE_MODEL=iguana/kb-whisper op run --env-file ~/.op-env -- \
 //	  go test ./internal/adapters/transcribe -run LiveGateway -v
 //
 // Use SYNTHETIC audio only: this repo is public and the gateway may be a cloud
 // endpoint (#33).
 func TestGateway_LiveGateway(t *testing.T) {
 	wav := os.Getenv("TAPIR_LIVE_WAV")
 	url := os.Getenv("TAPIR_LIVE_GATEWAY_URL")
 	if wav == "" || url == "" {
 		t.Skip("set TAPIR_LIVE_WAV and TAPIR_LIVE_GATEWAY_URL to run against the real gateway")
 	}
 	model := os.Getenv("TAPIR_LIVE_MODEL")
 	if model == "" {
 		model = "iguana/kb-whisper"
 	}
 	key := os.Getenv("LITELLM_MASTER_KEY")
 	require.NotEmpty(t, key, "LITELLM_MASTER_KEY must be set (via op run)")
 	ctx, cancel := context.WithTimeout(context.Background(), 25*time.Minute)
 	defer cancel()
 	got, err := transcribe.NewGateway(url, key, model, &http.Client{}).Transcribe(ctx, wav)
 	require.NoError(t, err)
 	assert.NotEmpty(t, got.Text)
 	assert.NotEmpty(t, got.Segments)
 	assert.Equal(t, model, got.Endpoint)
 	t.Logf("endpoint=%s audio_s=%.1f segments=%d chars=%d", got.Endpoint, got.AudioSeconds, len(got.Segments), len(got.Text))
 }
@@ -20,6 +20,9 @@ import (
 // Config is Tapir's fully-resolved runtime configuration.
 type Config struct {
 	// UploadConfig is the audio-upload and private-transcription settings (ADR-033).
 	UploadConfig
 	// UserID is the Tapir user the run operates as. Stage 0 has exactly one.
 	// It must be a UUID: it keys the UUID user_id/video_id columns (data-model).
 	UserID string
@@ -320,6 +323,10 @@ func Load() (Config, error) {
 	}
 	c.OnboardMaxVideoSeconds = onboardMax
 	if c.UploadConfig, err = loadUploadConfig(); err != nil {
 		return Config{}, err
 	}
 	return c, nil
 }
@@ -0,0 +1,118 @@
 package config
 import (
 	"fmt"
 	"os"
 	"strconv"
 	"time"
 )
 // UploadConfig holds the settings for audio upload and private transcription
 // (ADR-033). It is embedded in Config, so its fields read as c.UploadsEnabled etc.
 type UploadConfig struct {
 	// UploadsEnabled mounts the /uploads routes and starts the worker. Off by
 	// default: the runtime image must contain ffmpeg and ffprobe first (ADR-033).
 	UploadsEnabled bool
 	// UploadMaxBytes caps one upload. UploadMaxDuration caps one recording; 90
 	// minutes is the longest length MEASURED, not a ceiling that was found, so
 	// raising it is a measurement, not an edit.
 	UploadMaxBytes    int64
 	UploadMaxDuration time.Duration
 	// TranscribeModel is the primary gateway alias; TranscribeFallbackModel is the
 	// fallback, tried on ANY primary failure. The fallback is a cloud endpoint
 	// (berget): set it EMPTY to keep private audio on the homelab.
 	TranscribeModel         string
 	TranscribeFallbackModel string
 	// TranscribeTimeout bounds one job (conversion + transcription); a 90 minute
 	// recording took ~7.5 minutes on iguana.
 	TranscribeTimeout time.Duration
 	// UploadTmpDir is where uploads are spooled and converted. Audio is deleted
 	// after transcription, so this holds at most the in-flight files.
 	UploadTmpDir string
 	FFmpegBin    string
 	FFprobeBin   string
 	// MaxUploadedTranscriptChars bounds the transcript sent to a chat model for an
 	// UPLOADED recording. The 18,000-char default for captions is ~22 minutes of
 	// speech; an hour of meeting is ~50,000 chars. MEASURED 2026-10-01 against the
 	// real models: iguana/gemma4-26b answers correctly to 90,000 chars but silently
 	// drops the head of a 120,000-char transcript, so 90,000 is the ceiling of the
 	// best model, not a round number.
 	MaxUploadedTranscriptChars int
 	// UploadChatModel is the model chat over an uploaded recording opens with. It is
 	// NOT the summarizer default: koala/phi4-mini has an 8,192-token context and
 	// returns HTTP 400 on an hour of speech (~13,000 tokens).
 	UploadChatModel string
 }
 const (
 	defaultUploadMaxMB             = 200
 	defaultUploadMaxMinutes        = 90
 	defaultTranscribeModel         = "iguana/kb-whisper"
 	defaultTranscribeFallbackModel = "berget/kb-whisper"
 	defaultTranscribeTimeout       = 30 * time.Minute
 	defaultMaxUploadedChars        = 90000
 	defaultUploadChatModel         = "iguana/gemma4-26b"
 )
 func loadUploadConfig() (UploadConfig, error) {
 	u := UploadConfig{
 		TranscribeModel:         envOr("TAPIR_TRANSCRIBE_MODEL", defaultTranscribeModel),
 		TranscribeFallbackModel: lookupOr("TAPIR_TRANSCRIBE_FALLBACK_MODEL", defaultTranscribeFallbackModel),
 		UploadTmpDir:            envOr("TAPIR_UPLOAD_TMP_DIR", os.TempDir()),
 		FFmpegBin:               envOr("TAPIR_FFMPEG_BIN", "ffmpeg"),
 		FFprobeBin:              envOr("TAPIR_FFPROBE_BIN", "ffprobe"),
 		UploadChatModel:         envOr("TAPIR_UPLOAD_CHAT_MODEL", defaultUploadChatModel),
 	}
 	if v := os.Getenv("TAPIR_UPLOADS_ENABLED"); v != "" {
 		on, err := strconv.ParseBool(v)
 		if err != nil {
 			return UploadConfig{}, fmt.Errorf("config: TAPIR_UPLOADS_ENABLED=%q: %w", v, err)
 		}
 		u.UploadsEnabled = on
 	}
 	mb, err := positiveInt("TAPIR_UPLOAD_MAX_MB", defaultUploadMaxMB)
 	if err != nil {
 		return UploadConfig{}, err
 	}
 	u.UploadMaxBytes = int64(mb) << 20
 	mins, err := positiveInt("TAPIR_UPLOAD_MAX_MINUTES", defaultUploadMaxMinutes)
 	if err != nil {
 		return UploadConfig{}, err
 	}
 	u.UploadMaxDuration = time.Duration(mins) * time.Minute
 	timeout, err := durationOr("TAPIR_TRANSCRIBE_TIMEOUT", defaultTranscribeTimeout)
 	if err != nil {
 		return UploadConfig{}, err
 	}
 	if timeout <= 0 {
 		return UploadConfig{}, fmt.Errorf("config: TAPIR_TRANSCRIBE_TIMEOUT must be positive, got %v", timeout)
 	}
 	u.TranscribeTimeout = timeout
 	chars, err := intOr("TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", defaultMaxUploadedChars)
 	if err != nil {
 		return UploadConfig{}, err
 	}
 	if chars < 0 {
 		chars = 0
 	}
 	u.MaxUploadedTranscriptChars = chars
 	return u, nil
 }
 // positiveInt is intOr that refuses zero and negatives: a zero upload limit would
 // reject every file, which is a misconfiguration to fail on, not to run with.
 func positiveInt(key string, fallback int) (int, error) {
 	n, err := intOr(key, fallback)
 	if err != nil {
 		return 0, err
 	}
 	if n <= 0 {
 		return 0, fmt.Errorf("config: %s must be positive, got %d", key, n)
 	}
 	return n, nil
 }
@@ -0,0 +1,141 @@
 package config
 import (
 	"os"
 	"testing"
 	"time"
 )
 // clearUploadEnv unsets every upload knob so a test observes the default, not the
 // host environment.
 func clearUploadEnv(t *testing.T) {
 	t.Helper()
 	for _, k := range []string{
 		"TAPIR_UPLOADS_ENABLED", "TAPIR_UPLOAD_MAX_MB", "TAPIR_UPLOAD_MAX_MINUTES",
 		"TAPIR_TRANSCRIBE_MODEL", "TAPIR_TRANSCRIBE_FALLBACK_MODEL", "TAPIR_TRANSCRIBE_TIMEOUT",
 		"TAPIR_UPLOAD_TMP_DIR", "TAPIR_FFMPEG_BIN", "TAPIR_FFPROBE_BIN",
 		"TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", "TAPIR_UPLOAD_CHAT_MODEL",
 	} {
 		unset(t, k)
 	}
 }
 func TestLoad_UploadDefaults(t *testing.T) {
 	clearUploadEnv(t)
 	c, err := Load()
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	if c.UploadsEnabled {
 		t.Error("uploads must be OFF by default: the runtime image needs ffmpeg first (ADR-033)")
 	}
 	if c.UploadMaxBytes != 200<<20 {
 		t.Errorf("UploadMaxBytes = %d, want 200 MB", c.UploadMaxBytes)
 	}
 	if c.UploadMaxDuration != 90*time.Minute {
 		t.Errorf("UploadMaxDuration = %v, want 90m (the longest length measured, not a found ceiling)", c.UploadMaxDuration)
 	}
 	if c.TranscribeModel != "iguana/kb-whisper" {
 		t.Errorf("TranscribeModel = %q", c.TranscribeModel)
 	}
 	if c.TranscribeFallbackModel != "berget/kb-whisper" {
 		t.Errorf("TranscribeFallbackModel = %q", c.TranscribeFallbackModel)
 	}
 	if c.TranscribeTimeout != 30*time.Minute {
 		t.Errorf("TranscribeTimeout = %v, want 30m (a 90 min recording took ~7.5 min)", c.TranscribeTimeout)
 	}
 	if c.UploadTmpDir != os.TempDir() {
 		t.Errorf("UploadTmpDir = %q, want os.TempDir()", c.UploadTmpDir)
 	}
 	if c.FFmpegBin != "ffmpeg" || c.FFprobeBin != "ffprobe" {
 		t.Errorf("bins = %q, %q", c.FFmpegBin, c.FFprobeBin)
 	}
 	if c.MaxUploadedTranscriptChars != 90000 {
 		t.Errorf("MaxUploadedTranscriptChars = %d, want 90000: iguana/gemma4-26b answered correctly at 90,000 chars "+
 			"but silently dropped the head of a 120,000-char transcript (docs/research/chat-context)", c.MaxUploadedTranscriptChars)
 	}
 	if c.UploadChatModel != "iguana/gemma4-26b" {
 		t.Errorf("UploadChatModel = %q: koala/phi4-mini has an 8,192-token context and answers HTTP 400 on an hour of speech", c.UploadChatModel)
 	}
 }
 func TestLoad_UploadChatModelOverride(t *testing.T) {
 	clearUploadEnv(t)
 	t.Setenv("TAPIR_UPLOAD_CHAT_MODEL", "koala/qwen36-35b-a3b")
 	c, err := Load()
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	if c.UploadChatModel != "koala/qwen36-35b-a3b" {
 		t.Errorf("UploadChatModel = %q", c.UploadChatModel)
 	}
 }
 func TestLoad_UploadValuesAreParsed(t *testing.T) {
 	clearUploadEnv(t)
 	setEnv(t, map[string]string{
 		"TAPIR_UPLOADS_ENABLED":               "true",
 		"TAPIR_UPLOAD_MAX_MB":                 "50",
 		"TAPIR_UPLOAD_MAX_MINUTES":            "30",
 		"TAPIR_TRANSCRIBE_MODEL":              "koala/whisper",
 		"TAPIR_TRANSCRIBE_TIMEOUT":            "10m",
 		"TAPIR_UPLOAD_TMP_DIR":                "/var/spool/tapir",
 		"TAPIR_FFMPEG_BIN":                    "/opt/ffmpeg",
 		"TAPIR_FFPROBE_BIN":                   "/opt/ffprobe",
 		"TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS": "60000",
 	})
 	c, err := Load()
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	if !c.UploadsEnabled || c.UploadMaxBytes != 50<<20 || c.UploadMaxDuration != 30*time.Minute ||
 		c.TranscribeModel != "koala/whisper" || c.TranscribeTimeout != 10*time.Minute ||
 		c.UploadTmpDir != "/var/spool/tapir" || c.FFmpegBin != "/opt/ffmpeg" ||
 		c.FFprobeBin != "/opt/ffprobe" || c.MaxUploadedTranscriptChars != 60000 {
 		t.Errorf("values not applied: %+v", c)
 	}
 }
 func TestLoad_EmptyTranscribeFallbackDisablesIt(t *testing.T) {
 	clearUploadEnv(t)
 	t.Setenv("TAPIR_TRANSCRIBE_FALLBACK_MODEL", "")
 	c, err := Load()
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 	if c.TranscribeFallbackModel != "" {
 		t.Errorf("TranscribeFallbackModel = %q: an explicit empty value must disable the cloud fallback, "+
 			"so private audio can be kept on the homelab", c.TranscribeFallbackModel)
 	}
 }
 func TestLoad_UploadRejectsInvalidValues(t *testing.T) {
 	tests := []struct{ key, val string }{
 		{"TAPIR_UPLOADS_ENABLED", "maybe"},
 		{"TAPIR_UPLOAD_MAX_MB", "lots"},
 		{"TAPIR_UPLOAD_MAX_MB", "0"},
 		{"TAPIR_UPLOAD_MAX_MB", "-5"},
 		{"TAPIR_UPLOAD_MAX_MINUTES", "0"},
 		{"TAPIR_UPLOAD_MAX_MINUTES", "forever"},
 		{"TAPIR_TRANSCRIBE_TIMEOUT", "soon"},
 		{"TAPIR_TRANSCRIBE_TIMEOUT", "0s"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.key+"="+tt.val, func(t *testing.T) {
 			clearUploadEnv(t)
 			t.Setenv(tt.key, tt.val)
 			if _, err := Load(); err == nil {
 				t.Errorf("Load accepted %s=%q; a zero or negative limit would reject every upload", tt.key, tt.val)
 			}
 		})
 	}
 }
@@ -111,3 +111,66 @@ type Summary struct {
 	FallbackUsed bool
 	CreatedAt    time.Time
 }
 // Segment is one timed span of a transcription. Times are seconds from the start
 // of the audio.
 type Segment struct {
 	Start float64 `json:"start"`
 	End   float64 `json:"end"`
 	Text  string  `json:"text"`
 }
 // Transcription is the result of transcribing user-supplied audio (ADR-033):
 // the full text, its timed segments, which backend served it, and how long the
 // audio was. Endpoint is recorded because the backends differ in timestamp
 // granularity — which one served a transcript is a quality fact.
 type Transcription struct {
 	Text         string
 	Segments     []Segment
 	Endpoint     string
 	AudioSeconds float64
 }
 // UploadStatus is the state of an uploaded-audio transcription job.
 type UploadStatus string
 const (
 	UploadQueued       UploadStatus = "queued"
 	UploadTranscribing UploadStatus = "transcribing"
 	UploadDone         UploadStatus = "done"
 	UploadFailed       UploadStatus = "failed"
 )
 // UploadErrorKind is the typed reason an upload failed. It is deliberately NOT a
 // provider's error string: the whisper server's "failed to process audio" has had
 // at least five distinct causes, so nothing may branch on it (ADR-033).
 type UploadErrorKind string
 const (
 	// UploadErrInterrupted: the process restarted mid-job. The audio is not
 	// retained, so the job cannot resume; the user re-uploads.
 	UploadErrInterrupted UploadErrorKind = "interrupted"
 	// UploadErrTranscriptionFailed: every configured transcription endpoint failed.
 	UploadErrTranscriptionFailed UploadErrorKind = "transcription_failed"
 )
 // UploadedTranscript is a user's PRIVATE transcript of audio they uploaded. It is
 // never stored in, or merged with, the shared public-caption Transcript (ADR-021).
 // Content and Segments are empty until Status is UploadDone.
 type UploadedTranscript struct {
 	ID           string
 	UserID       string
 	Title        string
 	Status       UploadStatus
 	Content      string
 	Segments     []Segment
 	Endpoint     string
 	AudioSeconds float64
 	ErrorKind    UploadErrorKind
 	// HadVideo records that the uploaded file carried a video track. Only its audio
 	// was used and the video was discarded; the page says so. It is set at upload
 	// and never cleared (ADR-033).
 	HadVideo   bool
 	CreatedAt  time.Time
 	FinishedAt time.Time // zero until the job reaches done or failed
 }
@@ -0,0 +1,115 @@
 package uploads
 import (
 	"context"
 	"errors"
 	"fmt"
 	"io"
 	"os"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // ErrUnreadable is what a Prober returns when the FILE is the problem (not media,
 // truncated, damaged), as opposed to the prober itself failing. Accept turns it
 // into a user-facing rejection; any other prober error is our fault and surfaces
 // as an internal error — a missing ffprobe must not read as "your file is bad".
 var ErrUnreadable = errors.New("uploads: file is not readable media")
 // Prober inspects a file on disk. The ffprobe adapter implements it.
 type Prober interface {
 	Probe(ctx context.Context, path string) (Probe, error)
 }
 // Store is the slice of the private transcript store the intake needs.
 type Store interface {
 	CreateUpload(ctx context.Context, userID, title string, hadVideo bool) (string, error)
 	FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error
 }
 // Job is one accepted upload awaiting transcription. Path is a temp file the
 // receiver owns: it must delete it when finished (the audio is never retained).
 type Job struct {
 	UserID   string
 	UploadID string
 	Path     string
 }
 // Submitter hands accepted jobs to the in-process worker (ADR-033).
 type Submitter interface {
 	Submit(Job) error
 }
 // Intake validates an uploaded recording and, if it passes, queues it.
 type Intake struct {
 	store  Store
 	prober Prober
 	sub    Submitter
 	limits Limits
 	tmpDir string
 }
 // NewIntake wires an Intake. tmpDir is where uploads are spooled; it must exist.
 func NewIntake(s Store, p Prober, sub Submitter, l Limits, tmpDir string) *Intake {
 	return &Intake{store: s, prober: p, sub: sub, limits: l, tmpDir: tmpDir}
 }
 // Accept spools src to disk (bounded by MaxBytes), probes it, validates it, records
 // a queued upload and submits the job. It returns the upload id. A file that fails
 // validation yields a *RejectError and creates NO row — rejection is synchronous
 // and leaves nothing behind. On success the temp file is handed to the job and the
 // worker deletes it; on every failure path Accept deletes it itself.
 func (in *Intake) Accept(ctx context.Context, userID, title string, src io.Reader) (string, error) {
 	f, err := os.CreateTemp(in.tmpDir, "upload-*")
 	if err != nil {
 		return "", fmt.Errorf("uploads: spool: %w", err)
 	}
 	path := f.Name()
 	handedOver := false
 	defer func() {
 		if !handedOver {
 			_ = os.Remove(path)
 		}
 	}()
 	// Read one byte past the cap so "exactly at the limit" and "over" are told apart.
 	n, err := io.Copy(f, io.LimitReader(src, in.limits.MaxBytes+1))
 	if cerr := f.Close(); err == nil {
 		err = cerr
 	}
 	if err != nil {
 		return "", fmt.Errorf("uploads: receive: %w", err)
 	}
 	if n > in.limits.MaxBytes {
 		return "", &RejectError{Reason: ReasonTooLarge, Message: fmt.Sprintf(
 			"This file is larger than the %d MB limit.", in.limits.MaxBytes>>20)}
 	}
 	probe, err := in.prober.Probe(ctx, path)
 	if errors.Is(err, ErrUnreadable) {
 		return "", &RejectError{
 			Reason:  ReasonUnreadable,
 			Message: "This file could not be read as audio; it may be damaged or not a recording.",
 		}
 	}
 	if err != nil {
 		return "", fmt.Errorf("uploads: probe: %w", err)
 	}
 	if err := Validate(probe, in.limits); err != nil {
 		return "", err
 	}
 	id, err := in.store.CreateUpload(ctx, userID, title, probe.HasVideo)
 	if err != nil {
 		return "", fmt.Errorf("uploads: create: %w", err)
 	}
 	if err := in.sub.Submit(Job{UserID: userID, UploadID: id, Path: path}); err != nil {
 		// A row that will never run must not sit queued: that is the stuck spinner.
 		if ferr := in.store.FailUpload(ctx, userID, id, domain.UploadErrInterrupted); ferr != nil {
 			return "", fmt.Errorf("uploads: submit: %w (and failing the row: %v)", err, ferr)
 		}
 		return "", fmt.Errorf("uploads: submit: %w", err)
 	}
 	handedOver = true
 	return id, nil
 }
@@ -0,0 +1,239 @@
 package uploads_test
 import (
 	"bytes"
 	"context"
 	"errors"
 	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"testing/iotest"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 type fakeStore struct {
 	created  []string // titles
 	hadVideo []bool
 	failed   map[string]domain.UploadErrorKind
 	nextID   string
 }
 func (f *fakeStore) CreateUpload(_ context.Context, _, title string, hadVideo bool) (string, error) {
 	f.created = append(f.created, title)
 	f.hadVideo = append(f.hadVideo, hadVideo)
 	return f.nextID, nil
 }
 func (f *fakeStore) FailUpload(_ context.Context, _, id string, kind domain.UploadErrorKind) error {
 	if f.failed == nil {
 		f.failed = map[string]domain.UploadErrorKind{}
 	}
 	f.failed[id] = kind
 	return nil
 }
 type fakeProber struct {
 	probe uploads.Probe
 	err   error
 	paths []string
 	seen  []byte // content of the file at probe time
 }
 func (f *fakeProber) Probe(_ context.Context, path string) (uploads.Probe, error) {
 	f.paths = append(f.paths, path)
 	f.seen, _ = os.ReadFile(path)
 	return f.probe, f.err
 }
 type fakeSubmitter struct {
 	jobs []uploads.Job
 	err  error
 }
 func (f *fakeSubmitter) Submit(j uploads.Job) error {
 	f.jobs = append(f.jobs, j)
 	return f.err
 }
 type rig struct {
 	in  *uploads.Intake
 	st  *fakeStore
 	pr  *fakeProber
 	sub *fakeSubmitter
 	tmp string
 }
 func newRig(t *testing.T) *rig {
 	t.Helper()
 	r := &rig{
 		st:  &fakeStore{nextID: "up-1"},
 		pr:  &fakeProber{probe: uploads.Probe{Duration: 10 * time.Minute, HasAudio: true}},
 		sub: &fakeSubmitter{},
 		tmp: t.TempDir(),
 	}
 	r.in = uploads.NewIntake(r.st, r.pr, r.sub, uploads.Limits{MaxBytes: 1024, MaxDuration: 90 * time.Minute}, r.tmp)
 	return r
 }
 func (r *rig) tmpFiles(t *testing.T) []string {
 	t.Helper()
 	ents, err := os.ReadDir(r.tmp)
 	require.NoError(t, err)
 	var names []string
 	for _, e := range ents {
 		names = append(names, e.Name())
 	}
 	return names
 }
 func TestAccept_ValidAudioIsStoredProbedQueuedAndSubmitted(t *testing.T) {
 	r := newRig(t)
 	audio := bytes.Repeat([]byte("a"), 500)
 	id, err := r.in.Accept(context.Background(), "user-1", "Teams export", bytes.NewReader(audio))
 	require.NoError(t, err)
 	assert.Equal(t, "up-1", id)
 	assert.Equal(t, []string{"Teams export"}, r.st.created)
 	assert.Equal(t, audio, r.pr.seen, "the prober must see the complete uploaded bytes, on disk")
 	require.Len(t, r.sub.jobs, 1)
 	job := r.sub.jobs[0]
 	assert.Equal(t, uploads.Job{UserID: "user-1", UploadID: "up-1", Path: job.Path}, job)
 	assert.Equal(t, filepath.Dir(job.Path), r.tmp, "the temp file lives in the configured directory")
 	got, err := os.ReadFile(job.Path)
 	require.NoError(t, err)
 	assert.Equal(t, audio, got, "the handed-over file still exists: the worker, not Accept, deletes it")
 }
 func TestAccept_OversizeBodyIsRejectedAndLeavesNothingBehind(t *testing.T) {
 	r := newRig(t)
 	_, err := r.in.Accept(context.Background(), "user-1", "big", strings.NewReader(strings.Repeat("a", 1025)))
 	var rej *uploads.RejectError
 	require.True(t, errors.As(err, &rej))
 	assert.Equal(t, uploads.ReasonTooLarge, rej.Reason)
 	assert.Contains(t, rej.Message, "limit")
 	assert.Empty(t, r.pr.paths, "a file already over the size cap must not be probed")
 	assert.Empty(t, r.st.created, "a rejected upload creates no row")
 	assert.Empty(t, r.sub.jobs)
 	assert.Empty(t, r.tmpFiles(t), "the partial temp file must be removed")
 }
 func TestAccept_BodyExactlyAtTheLimitIsAccepted(t *testing.T) {
 	r := newRig(t)
 	_, err := r.in.Accept(context.Background(), "user-1", "edge", strings.NewReader(strings.Repeat("a", 1024)))
 	require.NoError(t, err)
 }
 func TestAccept_ProbeVerdictRejectsWithoutRowAndRemovesTheFile(t *testing.T) {
 	tests := []struct {
 		name   string
 		probe  uploads.Probe
 		reason uploads.Reason
 	}{
 		{"video with no audio", uploads.Probe{Duration: time.Minute, HasVideo: true}, uploads.ReasonNoAudio},
 		{"too long", uploads.Probe{Duration: 2 * time.Hour, HasAudio: true}, uploads.ReasonTooLong},
 		{"no audio", uploads.Probe{Duration: time.Minute}, uploads.ReasonNoAudio},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := newRig(t)
 			r.pr.probe = tt.probe
 			_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 			var rej *uploads.RejectError
 			require.True(t, errors.As(err, &rej))
 			assert.Equal(t, tt.reason, rej.Reason)
 			assert.Empty(t, r.st.created)
 			assert.Empty(t, r.sub.jobs)
 			assert.Empty(t, r.tmpFiles(t))
 		})
 	}
 }
 func TestAccept_UnreadableFileIsARejectionButAProberFaultIsAnError(t *testing.T) {
 	t.Run("ffprobe says the file is not media", func(t *testing.T) {
 		r := newRig(t)
 		r.pr.err = uploads.ErrUnreadable
 		_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("not media"))
 		var rej *uploads.RejectError
 		require.True(t, errors.As(err, &rej), "the user's file is the problem: tell them")
 		assert.Equal(t, uploads.ReasonUnreadable, rej.Reason)
 		assert.Empty(t, r.tmpFiles(t))
 	})
 	t.Run("the prober itself broke", func(t *testing.T) {
 		r := newRig(t)
 		r.pr.err = errors.New("exec: ffprobe: executable file not found")
 		_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 		require.Error(t, err)
 		var rej *uploads.RejectError
 		assert.False(t, errors.As(err, &rej), "our fault must not be reported as the user's bad file")
 		assert.Empty(t, r.st.created)
 		assert.Empty(t, r.tmpFiles(t))
 	})
 }
 func TestAccept_ClientDisconnectMidUploadLeavesNothingBehind(t *testing.T) {
 	r := newRig(t)
 	body := io.MultiReader(strings.NewReader("partial"), iotest.ErrReader(errors.New("client went away")))
 	_, err := r.in.Accept(context.Background(), "user-1", "t", body)
 	require.Error(t, err)
 	assert.Empty(t, r.pr.paths)
 	assert.Empty(t, r.st.created)
 	assert.Empty(t, r.tmpFiles(t))
 }
 func TestAccept_SubmitFailureFailsTheRowHonestlyAndRemovesTheFile(t *testing.T) {
 	r := newRig(t)
 	r.sub.err = errors.New("worker stopped")
 	_, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 	require.Error(t, err)
 	assert.Equal(t, domain.UploadErrInterrupted, r.st.failed["up-1"],
 		"a row that will never run must not sit queued: that is the stuck spinner ADR-025 forbids")
 	assert.Empty(t, r.tmpFiles(t))
 }
 func TestAccept_AFileWithAVideoTrackIsAcceptedAndRecordsThatItHadOne(t *testing.T) {
 	tests := []struct {
 		name      string
 		probe     uploads.Probe
 		wantVideo bool
 	}{
 		{"audio only", uploads.Probe{Duration: 10 * time.Minute, HasAudio: true}, false},
 		{"audio with a video track (a Teams meeting with the camera off)", uploads.Probe{Duration: 10 * time.Minute, HasAudio: true, HasVideo: true}, true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := newRig(t)
 			r.pr.probe = tt.probe
 			id, err := r.in.Accept(context.Background(), "user-1", "t", strings.NewReader("data"))
 			require.NoError(t, err)
 			assert.Equal(t, "up-1", id)
 			assert.Equal(t, []bool{tt.wantVideo}, r.st.hadVideo,
 				"the row must say whether a video track was present, so the page can say it was ignored")
 			assert.Len(t, r.sub.jobs, 1, "it is queued like any other recording")
 		})
 	}
 }
@@ -0,0 +1,81 @@
 // Package uploads is the use case behind "upload an audio recording" (ADR-033):
 // validate the file by PROBING it, keep the transcript private, never retain the
 // audio. It depends only on ports (a Prober, a store, a job Submitter) — the
 // concrete ffprobe adapter, the web handler and the transcription worker are wired
 // from outside.
 package uploads
 import (
 	"fmt"
 	"time"
 )
 // Limits bound what an upload may be. Both are rejected synchronously, with a
 // specific message, rather than by a timeout (ADR-033).
 type Limits struct {
 	MaxBytes    int64
 	MaxDuration time.Duration
 }
 // Probe is what inspecting an uploaded file revealed. It is the input to Validate
 // because a name or MIME type cannot say what a container holds: a Teams recording
 // is an .mp4 whether or not the camera was on.
 type Probe struct {
 	Duration time.Duration
 	HasAudio bool
 	HasVideo bool
 }
 // Reason is the machine-checkable class of a rejection.
 type Reason string
 const (
 	ReasonNoAudio    Reason = "no_audio"
 	ReasonTooLong    Reason = "too_long"
 	ReasonTooLarge   Reason = "too_large"
 	ReasonUnreadable Reason = "unreadable"
 )
 // RejectError is a synchronous, user-presentable refusal. Message is written for
 // the person who uploaded the file; Reason is for code and tests.
 type RejectError struct {
 	Reason  Reason
 	Message string
 }
 func (e *RejectError) Error() string { return string(e.Reason) + ": " + e.Message }
 // Validate decides whether a probed file may be transcribed. A video track is NOT
 // a reason to refuse: a Teams meeting with the camera off is still an .mp4 with a
 // video track, so rejecting video would reject the primary use case. Only the audio
 // is used (Probe.HasVideo is recorded so the user can be told the video was
 // ignored). What IS refused: no audio at all, an unreadable length, too long.
 func Validate(p Probe, l Limits) error {
 	switch {
 	case !p.HasAudio:
 		return &RejectError{Reason: ReasonNoAudio, Message: "This file has no audio track to transcribe."}
 	case p.Duration <= 0:
 		return &RejectError{Reason: ReasonUnreadable, Message: "Could not read a length from this file; it may be damaged."}
 	case p.Duration > l.MaxDuration:
 		return &RejectError{Reason: ReasonTooLong, Message: fmt.Sprintf(
 			"This recording is %s long; the limit is %s.", FormatDuration(p.Duration), FormatDuration(l.MaxDuration))}
 	}
 	return nil
 }
 // FormatDuration renders a length for people: "1 h 42 min", "45 min", "30 s".
 func FormatDuration(d time.Duration) string {
 	d = d.Round(time.Second)
 	h := int(d / time.Hour)
 	m := int(d % time.Hour / time.Minute)
 	switch {
 	case h > 0 && m > 0:
 		return fmt.Sprintf("%d h %d min", h, m)
 	case h > 0:
 		return fmt.Sprintf("%d h", h)
 	case m > 0:
 		return fmt.Sprintf("%d min", m)
 	default:
 		return fmt.Sprintf("%d s", int(d/time.Second))
 	}
 }
@@ -0,0 +1,93 @@
 package uploads_test
 import (
 	"errors"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 var testLimits = uploads.Limits{MaxBytes: 200 << 20, MaxDuration: 90 * time.Minute}
 func TestValidate(t *testing.T) {
 	tests := []struct {
 		name       string
 		probe      uploads.Probe
 		wantReason uploads.Reason // "" = accepted
 		wantInMsg  []string
 	}{
 		{
 			name:  "audio-only file within the duration limit is accepted",
 			probe: uploads.Probe{Duration: 45 * time.Minute, HasAudio: true},
 		},
 		{
 			name:  "a recording exactly at the limit is accepted",
 			probe: uploads.Probe{Duration: 90 * time.Minute, HasAudio: true},
 		},
 		{
 			name:  "a recording that also has a video stream is accepted: the audio is what is used",
 			probe: uploads.Probe{Duration: 4 * time.Minute, HasAudio: true, HasVideo: true},
 		},
 		{
 			name:       "video with no audio is rejected as having no audio, and says so",
 			probe:      uploads.Probe{Duration: 4 * time.Minute, HasVideo: true},
 			wantReason: uploads.ReasonNoAudio,
 			wantInMsg:  []string{"no audio"},
 		},
 		{
 			name:       "a file with no audio stream is rejected",
 			probe:      uploads.Probe{Duration: 4 * time.Minute},
 			wantReason: uploads.ReasonNoAudio,
 			wantInMsg:  []string{"no audio"},
 		},
 		{
 			name:       "a recording over the limit is rejected, stating both lengths",
 			probe:      uploads.Probe{Duration: 102 * time.Minute, HasAudio: true},
 			wantReason: uploads.ReasonTooLong,
 			wantInMsg:  []string{"1 h 42 min", "1 h 30 min"},
 		},
 		{
 			name:       "zero duration is unreadable, not accepted as an empty recording",
 			probe:      uploads.Probe{HasAudio: true},
 			wantReason: uploads.ReasonUnreadable,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			err := uploads.Validate(tt.probe, testLimits)
 			if tt.wantReason == "" {
 				require.NoError(t, err)
 				return
 			}
 			var rej *uploads.RejectError
 			require.True(t, errors.As(err, &rej), "want a *RejectError, got %v", err)
 			assert.Equal(t, tt.wantReason, rej.Reason)
 			for _, s := range tt.wantInMsg {
 				assert.Contains(t, rej.Message, s)
 			}
 		})
 	}
 }
 func TestFormatDuration(t *testing.T) {
 	tests := []struct {
 		d    time.Duration
 		want string
 	}{
 		{90 * time.Minute, "1 h 30 min"},
 		{102 * time.Minute, "1 h 42 min"},
 		{45 * time.Minute, "45 min"},
 		{2 * time.Hour, "2 h"},
 		{30 * time.Second, "30 s"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.want, func(t *testing.T) {
 			assert.Equal(t, tt.want, uploads.FormatDuration(tt.d))
 		})
 	}
 }
@@ -0,0 +1,191 @@
 package uploads
 import (
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"os"
 	"sync"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // ErrStopped is returned by Submit once the worker has stopped.
 var ErrStopped = errors.New("uploads: worker stopped")
 // Converter turns the uploaded file into the 16 kHz mono PCM WAV whisper wants.
 type Converter interface {
 	ToWAV(ctx context.Context, src, dst string) error
 }
 // Transcriber turns a WAV into a timed transcription. The gateway chain
 // (iguana primary, berget fallback) implements it.
 type Transcriber interface {
 	Transcribe(ctx context.Context, wavPath string) (domain.Transcription, error)
 }
 // WorkerStore is the slice of the private transcript store the worker drives.
 type WorkerStore interface {
 	StartTranscribing(ctx context.Context, userID, id string) error
 	CompleteUpload(ctx context.Context, userID, id string, t domain.Transcription) error
 	FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error
 }
 // Worker transcribes accepted uploads in-process, ONE AT A TIME (ADR-033). It is
 // not a second deployable: it shares the web process's lifetime, which is why it
 // inherits ADR-018's single-replica assumption — the queue is process-local. The
 // concurrency of one is deliberate: two simultaneous 90-minute jobs on iguana were
 // never measured, and a Metal OOM there latches the whisper backend (infra#273).
 type Worker struct {
 	store   WorkerStore
 	conv    Converter
 	tr      Transcriber
 	tmpDir  string
 	timeout time.Duration
 	mu      sync.Mutex
 	queue   []Job
 	stopped bool
 	wake    chan struct{}
 }
 // NewWorker wires a Worker. timeout bounds each job (conversion + transcription);
 // a job that outlives it is failed rather than left spinning.
 func NewWorker(s WorkerStore, c Converter, t Transcriber, tmpDir string, timeout time.Duration) *Worker {
 	return &Worker{store: s, conv: c, tr: t, tmpDir: tmpDir, timeout: timeout, wake: make(chan struct{}, 1)}
 }
 // Submit queues a job. It never blocks. It satisfies Submitter.
 func (w *Worker) Submit(j Job) error {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	if w.stopped {
 		return ErrStopped
 	}
 	w.queue = append(w.queue, j)
 	select {
 	case w.wake <- struct{}{}:
 	default:
 	}
 	return nil
 }
 // Run processes queued jobs until ctx ends, then deletes the audio of anything
 // still queued and refuses new jobs. The rows of those jobs stay queued or
 // transcribing and are failed as interrupted by the start-up sweep
 // (store.FailInterruptedUploads): the audio is not retained, so they cannot resume.
 func (w *Worker) Run(ctx context.Context) {
 	defer w.stop()
 	for {
 		job, ok := w.next(ctx)
 		if !ok {
 			return
 		}
 		w.Process(ctx, job)
 	}
 }
 // next blocks for the next job. Cancellation wins over a non-empty queue: a job
 // still queued at shutdown must not be STARTED (it would begin a long conversion
 // with an already-cancelled context); stop() deletes its audio instead.
 func (w *Worker) next(ctx context.Context) (Job, bool) {
 	for {
 		if ctx.Err() != nil {
 			return Job{}, false
 		}
 		w.mu.Lock()
 		if len(w.queue) > 0 {
 			j := w.queue[0]
 			w.queue = w.queue[1:]
 			w.mu.Unlock()
 			return j, true
 		}
 		w.mu.Unlock()
 		select {
 		case <-w.wake:
 		case <-ctx.Done():
 			return Job{}, false
 		}
 	}
 }
 func (w *Worker) stop() {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	w.stopped = true
 	for _, j := range w.queue {
 		_ = os.Remove(j.Path)
 	}
 	w.queue = nil
 }
 // Process runs one job: row -> transcribing, convert, transcribe, store. The
 // uploaded file and the converted WAV are deleted on every path — the audio is
 // never retained (ADR-033). A failure is recorded with a TYPED kind; a shutdown
 // mid-job is not a failure and leaves the row for the start-up sweep.
 func (w *Worker) Process(ctx context.Context, job Job) {
 	defer func() { _ = os.Remove(job.Path) }()
 	log := slog.Default().With("upload", job.UploadID)
 	start := time.Now()
 	if err := w.store.StartTranscribing(ctx, job.UserID, job.UploadID); err != nil {
 		log.Error("upload: start transcribing", "err", err)
 		w.fail(ctx, job, log)
 		return
 	}
 	wav, err := w.tempWAV()
 	if err != nil {
 		log.Error("upload: temp wav", "err", err)
 		w.fail(ctx, job, log)
 		return
 	}
 	defer func() { _ = os.Remove(wav) }()
 	jobCtx, cancel := context.WithTimeout(ctx, w.timeout)
 	defer cancel()
 	if err := w.conv.ToWAV(jobCtx, job.Path, wav); err != nil {
 		log.Error("upload: convert", "err", err)
 		w.fail(ctx, job, log)
 		return
 	}
 	t, err := w.tr.Transcribe(jobCtx, wav)
 	if err != nil {
 		log.Error("upload: transcribe", "err", err, "elapsed", time.Since(start).Round(time.Second))
 		w.fail(ctx, job, log)
 		return
 	}
 	if err := w.store.CompleteUpload(ctx, job.UserID, job.UploadID, t); err != nil {
 		log.Error("upload: store transcript", "err", err)
 		w.fail(ctx, job, log)
 		return
 	}
 	log.Info("upload transcribed", "endpoint", t.Endpoint, "audio_s", t.AudioSeconds,
 		"segments", len(t.Segments), "elapsed", time.Since(start).Round(time.Second))
 }
 // fail records a transcription failure — unless the PARENT context ended, which
 // is a shutdown, not a failure: the row is left for the start-up sweep.
 func (w *Worker) fail(ctx context.Context, job Job, log *slog.Logger) {
 	if ctx.Err() != nil {
 		return
 	}
 	if err := w.store.FailUpload(ctx, job.UserID, job.UploadID, domain.UploadErrTranscriptionFailed); err != nil {
 		log.Error("upload: record failure", "err", err)
 	}
 }
 func (w *Worker) tempWAV() (string, error) {
 	f, err := os.CreateTemp(w.tmpDir, "wav-*")
 	if err != nil {
 		return "", fmt.Errorf("uploads: temp wav: %w", err)
 	}
 	name := f.Name()
 	if err := f.Close(); err != nil {
 		_ = os.Remove(name)
 		return "", fmt.Errorf("uploads: temp wav: %w", err)
 	}
 	return name, nil
 }
@@ -0,0 +1,282 @@
 package uploads_test
 import (
 	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 type wStore struct {
 	mu        sync.Mutex
 	started   []string
 	completed map[string]domain.Transcription
 	failed    map[string]domain.UploadErrorKind
 	startErr  error
 }
 func newWStore() *wStore {
 	return &wStore{completed: map[string]domain.Transcription{}, failed: map[string]domain.UploadErrorKind{}}
 }
 func (s *wStore) StartTranscribing(_ context.Context, _, id string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.started = append(s.started, id)
 	return s.startErr
 }
 func (s *wStore) CompleteUpload(_ context.Context, _, id string, t domain.Transcription) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.completed[id] = t
 	return nil
 }
 func (s *wStore) FailUpload(_ context.Context, _, id string, k domain.UploadErrorKind) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.failed[id] = k
 	return nil
 }
 func (s *wStore) snapshot() (map[string]domain.Transcription, map[string]domain.UploadErrorKind) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	c := map[string]domain.Transcription{}
 	f := map[string]domain.UploadErrorKind{}
 	for k, v := range s.completed {
 		c[k] = v
 	}
 	for k, v := range s.failed {
 		f[k] = v
 	}
 	return c, f
 }
 type fakeConverter struct {
 	err  error
 	srcs []string
 	dsts []string
 }
 func (c *fakeConverter) ToWAV(_ context.Context, src, dst string) error {
 	c.srcs = append(c.srcs, src)
 	c.dsts = append(c.dsts, dst)
 	if c.err != nil {
 		return c.err
 	}
 	return os.WriteFile(dst, []byte("wav"), 0o600)
 }
 type fakeTranscriber struct {
 	result domain.Transcription
 	err    error
 	paths  []string
 	// block, when non-nil, holds every call until it is closed or ctx ends.
 	block   chan struct{}
 	running atomic.Int32
 	maxSeen atomic.Int32
 }
 func (f *fakeTranscriber) Transcribe(ctx context.Context, wav string) (domain.Transcription, error) {
 	f.paths = append(f.paths, wav)
 	n := f.running.Add(1)
 	defer f.running.Add(-1)
 	for {
 		m := f.maxSeen.Load()
 		if n <= m || f.maxSeen.CompareAndSwap(m, n) {
 			break
 		}
 	}
 	if f.block != nil {
 		select {
 		case <-f.block:
 		case <-ctx.Done():
 			return domain.Transcription{}, ctx.Err()
 		}
 	}
 	return f.result, f.err
 }
 type wrig struct {
 	w    *uploads.Worker
 	st   *wStore
 	conv *fakeConverter
 	tr   *fakeTranscriber
 	tmp  string
 }
 func newWRig(t *testing.T, timeout time.Duration) *wrig {
 	t.Helper()
 	r := &wrig{
 		st:   newWStore(),
 		conv: &fakeConverter{},
 		tr:   &fakeTranscriber{result: domain.Transcription{Text: "synthetic text", Endpoint: "iguana/kb-whisper", AudioSeconds: 3}},
 		tmp:  t.TempDir(),
 	}
 	r.w = uploads.NewWorker(r.st, r.conv, r.tr, r.tmp, timeout)
 	return r
 }
 // spool writes a fake uploaded file (what Intake would hand over) and returns a Job.
 func (r *wrig) spool(t *testing.T, id string) uploads.Job {
 	t.Helper()
 	p := filepath.Join(r.tmp, "upload-"+id)
 	require.NoError(t, os.WriteFile(p, []byte("audio"), 0o600))
 	return uploads.Job{UserID: "u1", UploadID: id, Path: p}
 }
 func (r *wrig) leftovers(t *testing.T) []string {
 	t.Helper()
 	ents, err := os.ReadDir(r.tmp)
 	require.NoError(t, err)
 	var n []string
 	for _, e := range ents {
 		n = append(n, e.Name())
 	}
 	return n
 }
 func TestWorkerProcess_SuccessConvertsTranscribesStoresAndDeletesTheAudio(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	job := r.spool(t, "a")
 	r.w.Process(context.Background(), job)
 	c, f := r.st.snapshot()
 	assert.Equal(t, []string{"a"}, r.st.started)
 	assert.Equal(t, "synthetic text", c["a"].Text)
 	assert.Equal(t, "iguana/kb-whisper", c["a"].Endpoint)
 	assert.Empty(t, f)
 	require.Len(t, r.conv.srcs, 1)
 	assert.Equal(t, job.Path, r.conv.srcs[0], "the converter reads the uploaded file")
 	assert.Equal(t, r.conv.dsts, r.tr.paths, "whisper is sent the converted WAV, not the original")
 	assert.Equal(t, r.tmp, filepath.Dir(r.conv.dsts[0]))
 	assert.Empty(t, r.leftovers(t), "the audio is never retained: both the upload and the WAV are deleted")
 }
 func TestWorkerProcess_FailuresAreTypedAndStillDeleteTheAudio(t *testing.T) {
 	tests := []struct {
 		name  string
 		setup func(*wrig)
 	}{
 		{"conversion fails", func(r *wrig) { r.conv.err = errors.New("moov atom not found") }},
 		{"every transcription endpoint fails", func(r *wrig) { r.tr.err = errors.New("iguana down; berget down") }},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := newWRig(t, time.Minute)
 			tt.setup(r)
 			job := r.spool(t, "a")
 			r.w.Process(context.Background(), job)
 			c, f := r.st.snapshot()
 			assert.Empty(t, c)
 			assert.Equal(t, domain.UploadErrTranscriptionFailed, f["a"])
 			assert.Empty(t, r.leftovers(t))
 		})
 	}
 	t.Run("conversion failure never reaches whisper", func(t *testing.T) {
 		r := newWRig(t, time.Minute)
 		r.conv.err = errors.New("bad")
 		r.w.Process(context.Background(), r.spool(t, "a"))
 		assert.Empty(t, r.tr.paths)
 	})
 }
 func TestWorkerProcess_ShutdownMidJobLeavesTheRowForTheStartupSweep(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	r.tr.block = make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
 	job := r.spool(t, "a")
 	go func() { r.w.Process(ctx, job); close(done) }()
 	require.Eventually(t, func() bool { return r.tr.running.Load() == 1 }, 2*time.Second, 5*time.Millisecond)
 	cancel()
 	<-done
 	_, f := r.st.snapshot()
 	assert.Empty(t, f, "a shutdown is not a transcription failure: the row stays for FailInterruptedUploads to mark interrupted")
 	assert.Empty(t, r.leftovers(t), "but the audio is still deleted")
 }
 func TestWorkerProcess_AJobThatOutlivesItsTimeoutIsFailedNotStuck(t *testing.T) {
 	r := newWRig(t, 50*time.Millisecond)
 	r.tr.block = make(chan struct{}) // never released
 	done := make(chan struct{})
 	go func() { r.w.Process(context.Background(), r.spool(t, "a")); close(done) }()
 	select {
 	case <-done:
 	case <-time.After(5 * time.Second):
 		t.Fatal("Process did not return: a hung endpoint was not bounded by the job timeout")
 	}
 	_, f := r.st.snapshot()
 	assert.Equal(t, domain.UploadErrTranscriptionFailed, f["a"], "a hung endpoint must end in failed, not an eternal spinner (ADR-025)")
 	assert.Empty(t, r.leftovers(t))
 }
 func TestWorkerProcess_StartFailureDropsTheJobAndDeletesTheAudio(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	r.st.startErr = errors.New("db down")
 	r.w.Process(context.Background(), r.spool(t, "a"))
 	assert.Empty(t, r.tr.paths, "never transcribe a job whose row could not be moved to transcribing")
 	_, f := r.st.snapshot()
 	assert.Contains(t, f, "a")
 	assert.Empty(t, r.leftovers(t))
 }
 func TestWorkerRun_ProcessesOneJobAtATime(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	r.tr.block = make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	go r.w.Run(ctx)
 	for _, id := range []string{"a", "b", "c"} {
 		require.NoError(t, r.w.Submit(r.spool(t, id)))
 	}
 	require.Eventually(t, func() bool { return r.tr.running.Load() == 1 }, 2*time.Second, 5*time.Millisecond)
 	time.Sleep(50 * time.Millisecond) // give a (wrong) second job time to start
 	assert.Equal(t, int32(1), r.tr.running.Load(), "two simultaneous long jobs on iguana were never measured: concurrency is 1")
 	close(r.tr.block)
 	require.Eventually(t, func() bool { c, _ := r.st.snapshot(); return len(c) == 3 }, 3*time.Second, 5*time.Millisecond)
 	assert.Equal(t, int32(1), r.tr.maxSeen.Load())
 }
 func TestWorkerRun_StoppingDeletesQueuedAudioAndRefusesNewJobs(t *testing.T) {
 	r := newWRig(t, time.Minute)
 	r.tr.block = make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
 	stopped := make(chan struct{})
 	go func() { r.w.Run(ctx); close(stopped) }()
 	require.NoError(t, r.w.Submit(r.spool(t, "a")))
 	require.Eventually(t, func() bool { return r.tr.running.Load() == 1 }, 2*time.Second, 5*time.Millisecond)
 	require.NoError(t, r.w.Submit(r.spool(t, "b"))) // queued behind the running job
 	cancel()
 	<-stopped
 	assert.Len(t, r.conv.srcs, 1, "a job still queued at shutdown must never be started: only the running job was converted")
 	assert.Empty(t, r.leftovers(t), "audio of queued jobs is deleted on stop: the rows are swept to interrupted at next start")
 	assert.ErrorIs(t, r.w.Submit(r.spool(t, "c")), uploads.ErrStopped)
 }
@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"strings"
 	"github.com/a-h/templ"
 	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 )
@@ -43,6 +45,28 @@ type chatView struct {
 	History   []chat.Turn
 	Truncated bool
 	Error     string
 	// PostURL and Subject let the same chat panel serve an UPLOADED recording
 	// (ADR-033): where the form posts, and what the transcript is called. Empty
 	// means a YouTube video (/v/{VideoID}/chat, "video"), so existing callers are
 	// unchanged.
 	PostURL templ.SafeURL
 	Subject string
 }
 // postURL is where the chat form posts.
 func (v chatView) postURL() templ.SafeURL {
 	if v.PostURL != "" {
 		return v.PostURL
 	}
 	return chatURL(v.VideoID)
 }
 // subject is what the transcript is called in the panel's wording.
 func (v chatView) subject() string {
 	if v.Subject != "" {
 		return v.Subject
 	}
 	return "video"
 }
 // handleChat renders the chat page for a summarized video (GET). Entry is scoped
@@ -13,6 +13,7 @@ import (
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // Store is the read/write surface the web handlers depend on — a narrow port over
@@ -53,6 +54,12 @@ type Store interface {
 	// the most recent discovery pass, shown on the account page as a warning.
 	ListChannelErrors(ctx context.Context, userID string) ([]store.ChannelError, error)
 	// Uploaded-audio transcripts (ADR-033): the caller's own PRIVATE uploads,
 	// stored apart from the shared public captions. Both are user-scoped; a
 	// non-owner's id is ErrUploadNotFound.
 	GetUpload(ctx context.Context, userID, id string) (*domain.UploadedTranscript, error)
 	ListUploads(ctx context.Context, userID string) ([]domain.UploadedTranscript, error)
 	// SetTranscriptStatus clears or updates a video's transcript backoff state.
 	// Used by handleRetryNow to clear rate_limited_at before immediate processing.
 	SetTranscriptStatus(ctx context.Context, userID, videoID, status string) error
@@ -100,6 +107,21 @@ type App struct {
 	// summary view shows no "dig deeper" affordance. It holds no caption-fetch
 	// dependency, so an enabled chat cannot reach YouTube or the rate gate.
 	Chat Chatter
 	// Uploads, when non-nil, accepts audio recordings for private transcription
 	// (ADR-033). Nil = the /uploads routes are not mounted. UploadLimits are the
 	// same limits the Uploader enforces, shown on the form so they are stated up
 	// front rather than discovered by failing.
 	Uploads      Uploader
 	UploadLimits uploads.Limits
 	// UploadChatMaxChars is the transcript budget for chat over an uploaded
 	// recording. The caption default (18,000 chars, ~22 minutes of speech) would
 	// keep only the first third of an hour-long meeting.
 	UploadChatMaxChars int
 	// UploadChatModel is the model chat over an uploaded recording opens with. Empty
 	// means the Chatter's own default. It exists because that default is the
 	// summarizer's (koala/phi4-mini, 8,192-token context) and cannot hold an hour of
 	// speech.
 	UploadChatModel string
 	// Processing tracks in-flight immediate summarizations so the status endpoint
 	// shows the animation until the summary lands. The zero value is ready to use.
 	Processing ProcessingSet
@@ -166,6 +188,20 @@ func (a *App) Router() http.Handler {
 		app.HandleFunc("GET /v/{videoId}/chat", a.handleChat)
 		app.HandleFunc("POST /v/{videoId}/chat", a.handleChatMessage)
 	}
 	// Audio upload → private transcript (ADR-033). Mounted only when an Uploader is
 	// wired; every handler is user-scoped, so another user's upload is a 404.
 	if a.Uploads != nil {
 		app.HandleFunc("GET /uploads", a.handleUploadsPage)
 		app.HandleFunc("POST /uploads", a.handleUploadPost)
 		app.HandleFunc("GET /uploads/{id}", a.handleUploadDetail)
 		app.HandleFunc("GET /uploads/{id}/status", a.handleUploadStatus)
 		// Chat over the uploaded transcript reuses the ADR-027 Chatter; mounted only
 		// when one is wired.
 		if a.Chat != nil {
 			app.HandleFunc("GET /uploads/{id}/chat", a.handleUploadChat)
 			app.HandleFunc("POST /uploads/{id}/chat", a.handleUploadChatMessage)
 		}
 	}
 	app.HandleFunc("GET /register", a.handleRegisterForm)
 	app.HandleFunc("POST /register", a.handleRegister)
@@ -0,0 +1,273 @@
 package web
 import (
 	"context"
 	"errors"
 	"io"
 	"net/http"
 	"path/filepath"
 	"strings"
 	"unicode/utf8"
 	"github.com/a-h/templ"
 	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // Uploader accepts an uploaded recording for transcription (ADR-033).
 // *uploads.Intake satisfies it. It is the whole of what the handlers know about
 // validation, spooling and queueing.
 type Uploader interface {
 	Accept(ctx context.Context, userID, title string, src io.Reader) (id string, err error)
 }
 const (
 	// uploadOverhead is headroom above the file-size cap for the multipart framing
 	// and the title field; the cap itself is enforced on the file part by Intake.
 	uploadOverhead = 1 << 20
 	maxTitleRunes  = 200
 	// uploadPollEvery is how often an unfinished upload re-asks for its status.
 	uploadPollEvery = "5s"
 )
 // uploadsView is what the /uploads page renders.
 type uploadsView struct {
 	Limits uploads.Limits
 	Rows   []domain.UploadedTranscript
 	Error  string // a synchronous rejection message, empty when none
 }
 // handleUploadsPage renders the upload form and the caller's own uploads.
 func (a *App) handleUploadsPage(w http.ResponseWriter, r *http.Request) {
 	userID, ok := a.currentUserID(w, r)
 	if !ok {
 		return
 	}
 	a.renderUploadsPage(w, r, userID, http.StatusOK, "")
 }
 func (a *App) renderUploadsPage(w http.ResponseWriter, r *http.Request, userID string, status int, msg string) {
 	rows, err := a.Store.ListUploads(r.Context(), userID)
 	if err != nil {
 		a.serverError(w, r, "list uploads", err)
 		return
 	}
 	a.renderStatus(w, r, status, UploadsPage(uploadsView{Limits: a.UploadLimits, Rows: rows, Error: msg}))
 }
 // handleUploadPost streams the multipart body: the optional title field, then the
 // file part, which goes straight to Intake without being buffered in memory. A
 // rejection is synchronous — a status code and a message on the upload page, no
 // row, no timeout (ADR-033).
 func (a *App) handleUploadPost(w http.ResponseWriter, r *http.Request) {
 	userID, ok := a.currentUserID(w, r)
 	if !ok {
 		return
 	}
 	r.Body = http.MaxBytesReader(w, r.Body, a.UploadLimits.MaxBytes+uploadOverhead)
 	mr, err := r.MultipartReader()
 	if err != nil {
 		a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "Choose an audio file to upload.")
 		return
 	}
 	title := ""
 	for {
 		part, err := mr.NextPart()
 		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
 			a.uploadFailure(w, r, userID, err)
 			return
 		}
 		switch part.FormName() {
 		case "title":
 			b, _ := io.ReadAll(io.LimitReader(part, maxTitleRunes*utf8.UTFMax))
 			title = clipRunes(strings.TrimSpace(string(b)), maxTitleRunes)
 		case "file":
 			if title == "" {
 				title = titleFromFilename(part.FileName())
 			}
 			id, err := a.Uploads.Accept(r.Context(), userID, title, part)
 			if err != nil {
 				a.uploadFailure(w, r, userID, err)
 				return
 			}
 			http.Redirect(w, r, "/uploads/"+id, http.StatusSeeOther)
 			return
 		}
 	}
 	a.renderUploadsPage(w, r, userID, http.StatusBadRequest, "Choose an audio file to upload.")
 }
 // uploadFailure maps an Accept (or multipart) error to a response: a validation
 // rejection is the user's to fix (422, or 413 for size) and carries its own
 // message; anything else is ours.
 func (a *App) uploadFailure(w http.ResponseWriter, r *http.Request, userID string, err error) {
 	var rej *uploads.RejectError
 	var tooBig *http.MaxBytesError
 	switch {
 	case errors.As(err, &rej):
 		// Logged by reason only: the filename and title are private content.
 		a.logger().Info("upload rejected", "reason", string(rej.Reason))
 		status := http.StatusUnprocessableEntity
 		if rej.Reason == uploads.ReasonTooLarge {
 			status = http.StatusRequestEntityTooLarge
 		}
 		a.renderUploadsPage(w, r, userID, status, rej.Message)
 	case errors.As(err, &tooBig):
 		a.logger().Info("upload rejected", "reason", string(uploads.ReasonTooLarge))
 		a.renderUploadsPage(w, r, userID, http.StatusRequestEntityTooLarge,
 			"This file is larger than the upload limit.")
 	default:
 		a.serverError(w, r, "upload", err)
 	}
 }
 // handleUploadDetail renders one upload's page (GET /uploads/{id}). The row is
 // read through the user-scoped store, so another user's id is a 404 — existence is
 // not disclosed, and the title never appears in the response.
 func (a *App) handleUploadDetail(w http.ResponseWriter, r *http.Request) {
 	u, ok := a.loadOwnedUpload(w, r)
 	if !ok {
 		return
 	}
 	a.render(w, r, UploadPage(*u, a.Chat != nil))
 }
 // handleUploadStatus renders the status fragment HTMX polls. Unfinished states
 // keep polling; terminal states render without hx-trigger so the page stops
 // asking (ADR-025: never a stuck spinner).
 func (a *App) handleUploadStatus(w http.ResponseWriter, r *http.Request) {
 	u, ok := a.loadOwnedUpload(w, r)
 	if !ok {
 		return
 	}
 	a.render(w, r, uploadStatus(*u, a.Chat != nil))
 }
 func (a *App) loadOwnedUpload(w http.ResponseWriter, r *http.Request) (*domain.UploadedTranscript, bool) {
 	userID, ok := a.currentUserID(w, r)
 	if !ok {
 		return nil, false
 	}
 	u, err := a.Store.GetUpload(r.Context(), userID, r.PathValue("id"))
 	if errors.Is(err, store.ErrUploadNotFound) {
 		http.NotFound(w, r)
 		return nil, false
 	}
 	if err != nil {
 		a.serverError(w, r, "get upload", err)
 		return nil, false
 	}
 	return u, true
 }
 // titleFromFilename is the default title: the file's name without its extension.
 func titleFromFilename(name string) string {
 	base := filepath.Base(name)
 	t := strings.TrimSuffix(base, filepath.Ext(base))
 	if t == "" || t == "." {
 		return "Untitled recording"
 	}
 	return clipRunes(t, maxTitleRunes)
 }
 func clipRunes(s string, n int) string {
 	if utf8.RuneCountInString(s) <= n {
 		return s
 	}
 	return string([]rune(s)[:n])
 }
 // uploadFailureMessage turns a typed failure kind into words for the user. It is
 // keyed on OUR kinds, never on a provider's error string (ADR-033).
 func uploadFailureMessage(k domain.UploadErrorKind) string {
 	switch k {
 	case domain.UploadErrInterrupted:
 		return "The server restarted before this recording was transcribed. Please upload it again."
 	case domain.UploadErrTranscriptionFailed:
 		return "Transcription failed on every available service. Please upload it again later."
 	default:
 		return "This upload failed. Please upload it again."
 	}
 }
 // handleUploadChat renders the chat page for a FINISHED upload (GET). The row is
 // read through the user-scoped store, so another user's id is a 404 before any
 // model is involved. An unfinished upload has no transcript to ask about yet, so
 // it goes back to its status page.
 func (a *App) handleUploadChat(w http.ResponseWriter, r *http.Request) {
 	u, ok := a.loadOwnedUpload(w, r)
 	if !ok {
 		return
 	}
 	if u.Status != domain.UploadDone {
 		http.Redirect(w, r, "/uploads/"+u.ID, http.StatusSeeOther)
 		return
 	}
 	a.render(w, r, UploadChatPage(*u, a.uploadChatView(*u, a.Chat.DefaultModel(a.UploadChatModel), nil, false, "")))
 }
 // handleUploadChatMessage answers one question against the owner's uploaded
 // transcript (POST), reusing the ADR-027 Chatter. Nothing is persisted: the prior
 // turns ride in the form. The transcript goes to the model with the UPLOAD budget,
 // not the caption default. A model failure is inline, not a 500.
 func (a *App) handleUploadChatMessage(w http.ResponseWriter, r *http.Request) {
 	u, ok := a.loadOwnedUpload(w, r)
 	if !ok {
 		return
 	}
 	if u.Status != domain.UploadDone {
 		http.Redirect(w, r, "/uploads/"+u.ID, http.StatusSeeOther)
 		return
 	}
 	if err := r.ParseForm(); err != nil {
 		http.Error(w, "bad form", http.StatusBadRequest)
 		return
 	}
 	model := a.resolveModel(r.FormValue("model"), a.UploadChatModel)
 	history := parseHistory(r.Form["hq"], r.Form["ha"])
 	question := strings.TrimSpace(r.FormValue("question"))
 	view := a.uploadChatView(*u, model, history, false, "")
 	if question != "" {
 		reply, err := a.Chat.Answer(r.Context(), chat.Request{
 			Model:      model,
 			Transcript: u.Content,
 			History:    history,
 			Question:   question,
 			MaxChars:   a.UploadChatMaxChars,
 		})
 		if err != nil {
 			a.logger().Error("upload chat answer", "upload", u.ID, "model", model, "err", err)
 			view.Error = "That model couldn't answer just now. Try again, or switch models."
 		} else {
 			view.History = appendTurn(history, chat.Turn{Question: question, Answer: reply.Answer})
 			view.Truncated = reply.Truncated
 		}
 	}
 	if isHTMX(r) {
 		a.render(w, r, chatPanel(view))
 		return
 	}
 	a.render(w, r, UploadChatPage(*u, view))
 }
 func (a *App) uploadChatView(u domain.UploadedTranscript, model string, history []chat.Turn, truncated bool, errMsg string) chatView {
 	return chatView{
 		VideoID:   u.ID,
 		Title:     u.Title,
 		Available: true,
 		Models:    a.Chat.Models(),
 		Selected:  model,
 		History:   history,
 		Truncated: truncated,
 		Error:     errMsg,
 		PostURL:   templ.SafeURL("/uploads/" + u.ID + "/chat"),
 		Subject:   "recording",
 	}
 }
@@ -0,0 +1,125 @@
 package web
 import (
 	"fmt"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // UploadsPage is the upload form plus the caller's own uploads (ADR-033).
 templ UploadsPage(v uploadsView) {
 	@Layout("Tapir — Upload a recording") {
 		<article class="account">
 			<h1>Upload a recording</h1>
 			<p class="muted">
 				Audio only. Up to { fmt.Sprintf("%d MB", v.Limits.MaxBytes>>20) } and
 				{ uploads.FormatDuration(v.Limits.MaxDuration) }. The transcript is private to you;
 				the audio is deleted once it has been transcribed.
 			</p>
 			if v.Error != "" {
 				<div class="flash flash-error" role="alert">{ v.Error }</div>
 			}
 			<form method="post" action="/uploads" enctype="multipart/form-data">
 				<p><label>Title (optional) <input type="text" name="title" maxlength="200"/></label></p>
 				<p><input type="file" name="file" accept="audio/*,.m4a,.mp3,.wav,.opus,.ogg,.mp4" required/></p>
 				<p><button type="submit">Upload and transcribe</button></p>
 			</form>
 			if len(v.Rows) > 0 {
 				<section>
 					<h2>Your recordings</h2>
 					<ul>
 						for _, u := range v.Rows {
 							<li>
 								<a href={ templ.SafeURL("/uploads/" + u.ID) }>{ u.Title }</a>
 								<span class="chip">{ string(u.Status) }</span>
 							</li>
 						}
 					</ul>
 				</section>
 			}
 		</article>
 	}
 }
 // UploadPage is one upload's page: its title and the polling status region.
 templ UploadPage(u domain.UploadedTranscript, chatEnabled bool) {
 	@Layout("Tapir — " + u.Title) {
 		<article class="account">
 			<h1>{ u.Title }</h1>
 			@uploadStatus(u, chatEnabled)
 			<p><a href="/uploads">All recordings</a></p>
 		</article>
 	}
 }
 // uploadStatus is the region HTMX polls. Unfinished states carry hx-trigger so the
 // page re-asks; done and failed render without it, so nothing polls forever.
 templ uploadStatus(u domain.UploadedTranscript, chatEnabled bool) {
 	switch u.Status {
 		case domain.UploadDone:
 			<div class="upload-status upload-done" role="status">
 				@videoNotice(u.HadVideo)
 				<p>
 					Transcribed { uploads.FormatDuration(time.Duration(u.AudioSeconds * float64(time.Second))) }
 					of audio by <span class="chip">{ u.Endpoint }</span>.
 				</p>
 				if chatEnabled {
 					<p><a class="btn" href={ templ.SafeURL("/uploads/" + u.ID + "/chat") }>Ask about this recording</a></p>
 				}
 				<details open>
 					<summary>Transcript</summary>
 					<pre class="transcript">{ u.Content }</pre>
 				</details>
 			</div>
 		case domain.UploadFailed:
 			<div class="upload-status upload-failed flash flash-error" role="alert">
 				@videoNotice(u.HadVideo)
 				<p>{ uploadFailureMessage(u.ErrorKind) }</p>
 			</div>
 		default:
 			<div
 				class="upload-status upload-working"
 				role="status"
 				hx-get={ "/uploads/" + u.ID + "/status" }
 				hx-trigger={ "every " + uploadPollEvery }
 				hx-swap="outerHTML"
 			>
 				@videoNotice(u.HadVideo)
 				if u.Status == domain.UploadTranscribing {
 					<p>Transcribing… a long recording takes a few minutes.</p>
 				} else {
 					<p>Queued — waiting for its turn to be transcribed.</p>
 				}
 			</div>
 	}
 }
 // UploadChatPage is the no-JS full page for chatting with an uploaded transcript:
 // the same chat panel as a video's (ADR-027), scoped to this recording.
 templ UploadChatPage(u domain.UploadedTranscript, v chatView) {
 	@Layout("Tapir — Ask about " + u.Title) {
 		<article class="account">
 			<h1>{ u.Title }</h1>
 			<section id="chat-section" class="chat-dock chat-dock-open">
 				<h2 class="chat-heading">Ask about this recording</h2>
 				<p class="chat-scope muted">Answers come only from this recording's transcript, which is private to you.</p>
 				@chatPanel(v)
 			</section>
 			<p><a href={ templ.SafeURL("/uploads/" + u.ID) }>Back to the transcript</a></p>
 		</article>
 	}
 }
 // videoNotice tells the user a video track was present and what became of it. A
 // Teams meeting with the camera off is still a video file; it is accepted, only the
 // audio is transcribed, and the picture is thrown away — so say so, in every state,
 // instead of leaving the user to wonder (ADR-033).
 templ videoNotice(hadVideo bool) {
 	if hadVideo {
 		<p class="muted video-notice">
 			This file contained a video track. Only its audio was used; the video was discarded and nothing from it was kept.
 		</p>
 	}
 }
@@ -0,0 +1,182 @@
 package web_test
 import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/chat"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
 // Chat over an uploaded transcript REUSES the ADR-027 chat path (the same
 // Chatter, the same panel) — only the lookup differs: the row comes from the
 // user-scoped private store, so another user's upload is a 404 and, crucially, no
 // model is ever called with it. Transcript text is synthetic; this repo is public.
 const meetingText = "Anders ansvarar för virket. Maria undersöker leverantörer."
 func newUploadChatApp(t *testing.T) (*web.App, *fakeChatter) {
 	t.Helper()
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	fc := &fakeChatter{
 		models: []string{"koala/phi4-mini", "iguana/gemma4-26b"},
 		reply:  chat.Reply{Answer: "Anders owns the timber order."},
 	}
 	app.Chat = fc
 	app.UploadChatMaxChars = 120000
 	return app, fc
 }
 func chatPost(path string, kv url.Values) *http.Request {
 	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(kv.Encode()))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	return req
 }
 func TestUploadChatPage_OwnerOfAFinishedUploadSeesThePanelPostingToTheUploadRoute(t *testing.T) {
 	app, _ := newUploadChatApp(t)
 	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
 	rec := do(t, app, get("/uploads/"+id+"/chat"))
 	require.Equal(t, http.StatusOK, rec.Code)
 	b := body(t, rec)
 	assert.Contains(t, b, `action="/uploads/`+id+`/chat"`, "the form posts to the UPLOAD route, not /v/{id}/chat")
 	assert.Contains(t, b, "Roadmap sync")
 	assert.Contains(t, b, "koala/phi4-mini")
 	assert.Contains(t, b, "recording", "wording says recording, not video")
 }
 func TestUploadChatPage_AnUnfinishedUploadRedirectsToItsStatusPage(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	id := seedUpload(t, userID, "m", "transcribing", "")
 	rec := do(t, app, get("/uploads/"+id+"/chat"))
 	assert.Equal(t, http.StatusSeeOther, rec.Code)
 	assert.Equal(t, "/uploads/"+id, rec.Header().Get("Location"))
 	assert.Zero(t, fc.callCount)
 }
 func TestUploadChat_AnotherUsersUploadIs404AndNoModelIsCalled(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	theirs := seedUpload(t, otherUserID, "Their private meeting", "done", meetingText)
 	getRec := do(t, app, get("/uploads/"+theirs+"/chat"))
 	postRec := do(t, app, chatPost("/uploads/"+theirs+"/chat", url.Values{"question": {"what did they say?"}}))
 	assert.Equal(t, http.StatusNotFound, getRec.Code)
 	assert.Equal(t, http.StatusNotFound, postRec.Code)
 	assert.NotContains(t, body(t, getRec), "Their private meeting")
 	assert.Zero(t, fc.callCount, "someone else's transcript must never reach a model")
 }
 func TestUploadChatPost_SendsTheOwnersTranscriptWithTheUploadBudget(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	app.UploadChatMaxChars = 77777
 	id := seedUpload(t, userID, "Roadmap sync", "done", meetingText)
 	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{
 		"question": {"Who owns the timber order?"},
 		"model":    {"iguana/gemma4-26b"},
 	}))
 	require.Equal(t, http.StatusOK, rec.Code)
 	assert.Equal(t, 1, fc.callCount)
 	assert.Equal(t, meetingText, fc.gotReq.Transcript)
 	assert.Equal(t, "Who owns the timber order?", fc.gotReq.Question)
 	assert.Equal(t, "iguana/gemma4-26b", fc.gotReq.Model)
 	assert.Equal(t, 77777, fc.gotReq.MaxChars,
 		"an uploaded transcript takes its own budget: the 18,000-char caption default would cut an hour to its first third")
 	assert.Contains(t, body(t, rec), "Anders owns the timber order.")
 }
 func TestUploadChatPost_AnUnofferedModelFallsBackToTheDefault(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}, "model": {"evil/model"}}))
 	assert.Equal(t, "koala/phi4-mini", fc.gotReq.Model)
 }
 func TestUploadChatPost_UnfinishedUploadCallsNoModel(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	id := seedUpload(t, userID, "m", "queued", "")
 	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}}))
 	assert.Equal(t, http.StatusSeeOther, rec.Code)
 	assert.Zero(t, fc.callCount)
 }
 func TestUploadChatPost_PriorTurnsRideAlongAndATruncatedReplyIsSaidSo(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	fc.reply = chat.Reply{Answer: "second answer", Truncated: true}
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{
 		"question": {"and who else?"},
 		"hq":       {"first question"},
 		"ha":       {"first answer"},
 	}))
 	require.Equal(t, http.StatusOK, rec.Code)
 	assert.Equal(t, []chat.Turn{{Question: "first question", Answer: "first answer"}}, fc.gotReq.History)
 	b := body(t, rec)
 	assert.Contains(t, b, "first answer")
 	assert.Contains(t, b, "second answer")
 	assert.Contains(t, b, "end of the recording", "a long recording cut to a budget must say so, in its own words")
 }
 func TestUploadChatPost_AModelFailureIsShownInlineNotAs500(t *testing.T) {
 	app, fc := newUploadChatApp(t)
 	fc.err = errors.New("gateway down")
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	rec := do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}, "hq": {"earlier"}, "ha": {"kept"}}))
 	require.Equal(t, http.StatusOK, rec.Code)
 	b := body(t, rec)
 	assert.Contains(t, b, "answer just now", "the failure is inline (the apostrophe is HTML-escaped, so match the tail)")
 	assert.Contains(t, b, "kept", "the conversation survives a failed turn")
 }
 func TestUploadChatRoutes_AreNotMountedWithoutAChatBackend(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	assert.Equal(t, http.StatusNotFound, do(t, app, get("/uploads/"+id+"/chat")).Code)
 }
 func TestUploadStatus_DoneOffersTheChatLinkOnlyWhenChatIsWired(t *testing.T) {
 	appWith, _ := newUploadChatApp(t)
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	assert.Contains(t, body(t, do(t, appWith, get("/uploads/"+id+"/status"))), `href="/uploads/`+id+`/chat"`)
 	appWithout, _ := newUploadApp(t, audioOK, 200<<20)
 	id2 := seedUpload(t, userID, "m2", "done", meetingText)
 	assert.NotContains(t, body(t, do(t, appWithout, get("/uploads/"+id2+"/status"))), "/chat")
 }
 func TestUploadChat_OpensWithTheUploadChatModelNotTheSummarizerDefault(t *testing.T) {
 	// koala/phi4-mini is first in the offered list (it is the summarizer default) and
 	// has an 8,192-token context: an hour of speech returns HTTP 400 there. Chat over
 	// an upload must open with the model configured for it.
 	app, fc := newUploadChatApp(t)
 	app.UploadChatModel = "iguana/gemma4-26b"
 	id := seedUpload(t, userID, "m", "done", meetingText)
 	page := body(t, do(t, app, get("/uploads/"+id+"/chat")))
 	do(t, app, chatPost("/uploads/"+id+"/chat", url.Values{"question": {"q"}}))
 	assert.Contains(t, page, `<option value="iguana/gemma4-26b" selected`, "the page opens on the upload chat model")
 	assert.Equal(t, "iguana/gemma4-26b", fc.gotReq.Model, "a post that names no model uses it too")
 }
@@ -0,0 +1,357 @@
 package web_test
 import (
 	"bytes"
 	"context"
 	"log/slog"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 	"git.d-ma.be/mathias/tapir/internal/web"
 )
 // Upload route tests drive the real Router, the real Intake and the real Postgres
 // store; only the process boundary (ffprobe) and the transcription worker are
 // faked. All audio bytes and transcript text are synthetic — this repo is public
 // and no real recording or transcript may appear in it (#33).
 const otherUserID = "22222222-2222-2222-2222-222222222222"
 type uploadProber struct{ probe uploads.Probe }
 func (p uploadProber) Probe(context.Context, string) (uploads.Probe, error) { return p.probe, nil }
 type uploadSubmitter struct{ jobs []uploads.Job }
 func (s *uploadSubmitter) Submit(j uploads.Job) error { s.jobs = append(s.jobs, j); return nil }
 func newUploadApp(t *testing.T, probe uploads.Probe, maxBytes int64) (*web.App, *uploadSubmitter) {
 	t.Helper()
 	app := newApp(t)
 	resetDB(t, rawPool(t))
 	sub := &uploadSubmitter{}
 	limits := uploads.Limits{MaxBytes: maxBytes, MaxDuration: 90 * time.Minute}
 	s := newStore(t)
 	app.Uploads = uploads.NewIntake(s, uploadProber{probe: probe}, sub, limits, t.TempDir())
 	app.UploadLimits = limits
 	return app, sub
 }
 var audioOK = uploads.Probe{Duration: 45 * time.Minute, HasAudio: true}
 func uploadReq(t *testing.T, title, filename string, content []byte) *http.Request {
 	t.Helper()
 	var buf bytes.Buffer
 	mw := multipart.NewWriter(&buf)
 	if title != "" {
 		require.NoError(t, mw.WriteField("title", title))
 	}
 	if filename != "" {
 		fw, err := mw.CreateFormFile("file", filename)
 		require.NoError(t, err)
 		_, err = fw.Write(content)
 		require.NoError(t, err)
 	}
 	require.NoError(t, mw.Close())
 	req := httptest.NewRequest(http.MethodPost, "/uploads", &buf)
 	req.Header.Set("Content-Type", mw.FormDataContentType())
 	return req
 }
 func seedUpload(t *testing.T, owner, title, status, content string) string {
 	t.Helper()
 	p := rawPool(t)
 	_, err := p.Exec(context.Background(), `INSERT INTO users (id) VALUES ($1) ON CONFLICT DO NOTHING`, owner)
 	require.NoError(t, err)
 	var id string
 	switch status {
 	case "done":
 		require.NoError(t, p.QueryRow(context.Background(),
 			`INSERT INTO uploaded_transcripts (user_id, title, status, content, endpoint, audio_seconds, finished_at)
 			 VALUES ($1, $2, 'done', $3, 'berget/kb-whisper', 2700, NOW()) RETURNING id`,
 			owner, title, content).Scan(&id))
 	case "failed":
 		require.NoError(t, p.QueryRow(context.Background(),
 			`INSERT INTO uploaded_transcripts (user_id, title, status, error_kind, finished_at)
 			 VALUES ($1, $2, 'failed', $3, NOW()) RETURNING id`,
 			owner, title, content).Scan(&id)) // content carries the error_kind here
 	default:
 		require.NoError(t, p.QueryRow(context.Background(),
 			`INSERT INTO uploaded_transcripts (user_id, title, status) VALUES ($1, $2, $3) RETURNING id`,
 			owner, title, status).Scan(&id))
 	}
 	return id
 }
 func get(path string) *http.Request { return httptest.NewRequest(http.MethodGet, path, nil) }
 func TestUploadsPage_ShowsAMultipartFormWithAFileField(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, get("/uploads"))
 	require.Equal(t, http.StatusOK, rec.Code)
 	b := body(t, rec)
 	assert.Contains(t, b, `enctype="multipart/form-data"`)
 	assert.Contains(t, b, `name="file"`, "the multipart field is `file`")
 	assert.Contains(t, b, "200 MB", "the size limit is stated up front, not discovered by failing")
 	assert.Contains(t, b, "1 h 30 min", "the length limit is stated up front")
 }
 func TestUploadsPage_ListsOnlyTheCallersUploads(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	seedUpload(t, userID, "My weekly sync", "queued", "")
 	seedUpload(t, otherUserID, "Someone else's board meeting", "queued", "")
 	b := body(t, do(t, app, get("/uploads")))
 	assert.Contains(t, b, "My weekly sync")
 	assert.NotContains(t, b, "Someone else's board meeting")
 }
 func TestUploadPost_AcceptedAudioQueuesARowAndRedirectsToIt(t *testing.T) {
 	app, sub := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, uploadReq(t, "Sprint review", "recording.m4a", []byte("synthetic audio bytes")))
 	require.Equal(t, http.StatusSeeOther, rec.Code)
 	var id, status, title string
 	require.NoError(t, rawPool(t).QueryRow(context.Background(),
 		`SELECT id, status, title FROM uploaded_transcripts WHERE user_id = $1`, userID).Scan(&id, &status, &title))
 	assert.Equal(t, "queued", status)
 	assert.Equal(t, "Sprint review", title)
 	assert.Equal(t, "/uploads/"+id, rec.Header().Get("Location"))
 	require.Len(t, sub.jobs, 1)
 	assert.Equal(t, uploads.Job{UserID: userID, UploadID: id, Path: sub.jobs[0].Path}, sub.jobs[0])
 	spooled, err := os.ReadFile(sub.jobs[0].Path)
 	require.NoError(t, err)
 	assert.Equal(t, "synthetic audio bytes", string(spooled))
 }
 func TestUploadPost_WithoutATitleUsesTheFilenameMinusItsExtension(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, uploadReq(t, "", "Teams meeting 2026-09-30.mp4", []byte("x")))
 	require.Equal(t, http.StatusSeeOther, rec.Code)
 	var title string
 	require.NoError(t, rawPool(t).QueryRow(context.Background(),
 		`SELECT title FROM uploaded_transcripts WHERE user_id = $1`, userID).Scan(&title))
 	assert.Equal(t, "Teams meeting 2026-09-30", title)
 }
 func TestUploadPost_RejectionsAreSynchronousWithAMessageAndNoRow(t *testing.T) {
 	tests := []struct {
 		name       string
 		probe      uploads.Probe
 		maxBytes   int64
 		content    string
 		wantStatus int
 		wantInBody []string
 	}{
 		{
 			name:       "video with no audio is rejected for having no audio",
 			probe:      uploads.Probe{Duration: time.Minute, HasVideo: true},
 			maxBytes:   1 << 20,
 			content:    "x",
 			wantStatus: http.StatusUnprocessableEntity,
 			wantInBody: []string{"no audio"},
 		},
 		{
 			name:       "too long states both lengths",
 			probe:      uploads.Probe{Duration: 2 * time.Hour, HasAudio: true},
 			maxBytes:   1 << 20,
 			content:    "x",
 			wantStatus: http.StatusUnprocessableEntity,
 			wantInBody: []string{"2 h", "1 h 30 min"},
 		},
 		{
 			name:       "too large is 413",
 			probe:      audioOK,
 			maxBytes:   4,
 			content:    "more than four bytes",
 			wantStatus: http.StatusRequestEntityTooLarge,
 			wantInBody: []string{"limit"},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			app, sub := newUploadApp(t, tt.probe, tt.maxBytes)
 			rec := do(t, app, uploadReq(t, "t", "r.m4a", []byte(tt.content)))
 			assert.Equal(t, tt.wantStatus, rec.Code)
 			b := body(t, rec)
 			for _, s := range tt.wantInBody {
 				assert.Contains(t, b, s)
 			}
 			var n int
 			require.NoError(t, rawPool(t).QueryRow(context.Background(),
 				`SELECT count(*) FROM uploaded_transcripts`).Scan(&n))
 			assert.Zero(t, n, "a rejected upload leaves no row")
 			assert.Empty(t, sub.jobs)
 		})
 	}
 }
 func TestUploadPost_WithNoFilePartIs400(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	rec := do(t, app, uploadReq(t, "only a title", "", nil))
 	assert.Equal(t, http.StatusBadRequest, rec.Code)
 	assert.Contains(t, body(t, rec), "Choose an audio file")
 }
 func TestUploadRoutes_AreNotMountedWithoutAnUploader(t *testing.T) {
 	app := newApp(t)
 	resetDB(t, rawPool(t))
 	assert.Equal(t, http.StatusNotFound, do(t, app, get("/uploads")).Code)
 }
 func TestUploadPage_OwnerSeesTitleStatusAndNonOwnerGetsNotFound(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	mine := seedUpload(t, userID, "Roadmap sync", "queued", "")
 	theirs := seedUpload(t, otherUserID, "Their private meeting", "queued", "")
 	own := do(t, app, get("/uploads/"+mine))
 	require.Equal(t, http.StatusOK, own.Code)
 	assert.Contains(t, body(t, own), "Roadmap sync")
 	for _, path := range []string{"/uploads/" + theirs, "/uploads/" + theirs + "/status"} {
 		rec := do(t, app, get(path))
 		assert.Equal(t, http.StatusNotFound, rec.Code, path)
 		assert.NotContains(t, body(t, rec), "Their private meeting", "a 404 must not leak the title")
 	}
 }
 func TestUploadStatus_UnfinishedStatesKeepPollingTerminalStatesStop(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	tests := []struct {
 		name, status, content string
 		polls                 bool
 		wantInBody            string
 	}{
 		{"queued", "queued", "", true, "Queued"},
 		{"transcribing", "transcribing", "", true, "ranscrib"},
 		{"done", "done", "Synthetic transcript text.", false, "Synthetic transcript text."},
 		{"failed interrupted", "failed", "interrupted", false, "upload it again"},
 		{"failed transcription", "failed", "transcription_failed", false, "Transcription failed"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			id := seedUpload(t, userID, "m-"+tt.name, tt.status, tt.content)
 			rec := do(t, app, get("/uploads/"+id+"/status"))
 			require.Equal(t, http.StatusOK, rec.Code)
 			b := body(t, rec)
 			assert.Contains(t, b, tt.wantInBody)
 			if tt.polls {
 				assert.Contains(t, b, `hx-trigger="every`, "an unfinished upload must keep polling")
 			} else {
 				assert.NotContains(t, b, "hx-trigger", "a finished upload must not poll forever: no stuck spinner")
 			}
 		})
 	}
 }
 func TestUploadStatus_DoneNamesTheEndpointThatServedIt(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "m", "done", "Synthetic transcript text.")
 	b := body(t, do(t, app, get("/uploads/"+id+"/status")))
 	assert.Contains(t, b, "berget/kb-whisper",
 		"which backend served a transcript is a quality fact, and berget means the audio left the homelab")
 	assert.True(t, strings.Contains(b, "45 min"), "the audio length is shown")
 }
 func markHadVideo(t *testing.T, id string) {
 	t.Helper()
 	_, err := rawPool(t).Exec(context.Background(), `UPDATE uploaded_transcripts SET had_video = TRUE WHERE id = $1`, id)
 	require.NoError(t, err)
 }
 func TestUploadPost_AFileWithAVideoTrackIsAcceptedAndTheRowRemembersIt(t *testing.T) {
 	// A Teams meeting with the camera off is still an .mp4 with a video track.
 	app, sub := newUploadApp(t, uploads.Probe{Duration: 62 * time.Minute, HasAudio: true, HasVideo: true}, 200<<20)
 	rec := do(t, app, uploadReq(t, "Project notes", "Teams meeting.mp4", []byte("synthetic bytes")))
 	require.Equal(t, http.StatusSeeOther, rec.Code, "it must be accepted, not rejected as video")
 	var hadVideo bool
 	require.NoError(t, rawPool(t).QueryRow(context.Background(),
 		`SELECT had_video FROM uploaded_transcripts WHERE user_id = $1`, userID).Scan(&hadVideo))
 	assert.True(t, hadVideo)
 	assert.Len(t, sub.jobs, 1)
 }
 func TestUploadPost_AudioOnlyIsNotMarkedAsHavingHadVideo(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	do(t, app, uploadReq(t, "Voice memo", "memo.m4a", []byte("x")))
 	var hadVideo bool
 	require.NoError(t, rawPool(t).QueryRow(context.Background(),
 		`SELECT had_video FROM uploaded_transcripts WHERE user_id = $1`, userID).Scan(&hadVideo))
 	assert.False(t, hadVideo)
 }
 func TestUploadStatus_TellsTheUserTheVideoWasIgnoredInEveryStateAndOnlyWhenItWas(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	states := []struct{ status, content string }{
 		{"queued", ""}, {"transcribing", ""}, {"done", "Synthetic transcript."}, {"failed", "interrupted"},
 	}
 	for _, st := range states {
 		t.Run(st.status, func(t *testing.T) {
 			withVideo := seedUpload(t, userID, "camera off "+st.status, st.status, st.content)
 			markHadVideo(t, withVideo)
 			audioOnly := seedUpload(t, userID, "voice only "+st.status, st.status, st.content)
 			notice := body(t, do(t, app, get("/uploads/"+withVideo+"/status")))
 			plain := body(t, do(t, app, get("/uploads/"+audioOnly+"/status")))
 			assert.Contains(t, notice, "video track")
 			assert.Contains(t, notice, "Only its audio was used", "say what happened, not just that something did")
 			assert.Contains(t, notice, "discarded")
 			assert.NotContains(t, plain, "video track", "no notice when there was no video")
 		})
 	}
 }
 func TestUploadPage_AlsoCarriesTheVideoNotice(t *testing.T) {
 	app, _ := newUploadApp(t, audioOK, 200<<20)
 	id := seedUpload(t, userID, "camera off", "done", "Synthetic transcript.")
 	markHadVideo(t, id)
 	assert.Contains(t, body(t, do(t, app, get("/uploads/"+id))), "Only its audio was used")
 }
 func TestUploadPost_ARejectionIsLoggedWithItsReasonAndNeverTheFilenameOrTitle(t *testing.T) {
 	// Rejections are synchronous and leave no row, so without a log line an operator
 	// cannot tell "the user never retried" from "the page refused it". The reason is
 	// operational; the filename and title are the user's private content.
 	var buf bytes.Buffer
 	app, _ := newUploadApp(t, uploads.Probe{Duration: time.Minute, HasVideo: true}, 1<<20)
 	app.Log = slog.New(slog.NewTextHandler(&buf, nil))
 	rec := do(t, app, uploadReq(t, "Secret project notes", "client-acme-roadmap.mp4", []byte("x")))
 	require.Equal(t, http.StatusUnprocessableEntity, rec.Code)
 	logged := buf.String()
 	assert.Contains(t, logged, "upload rejected")
 	assert.Contains(t, logged, "reason=no_audio")
 	assert.NotContains(t, logged, "Secret project notes", "the title is private content")
 	assert.NotContains(t, logged, "client-acme-roadmap", "the filename is private content")
 }
@@ -0,0 +1,542 @@
 // Code generated by templ - DO NOT EDIT.
 // templ: version: v0.3.1020
 package web
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
 import "github.com/a-h/templ"
 import templruntime "github.com/a-h/templ/runtime"
 import (
 	"fmt"
 	"time"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 // UploadsPage is the upload form plus the caller's own uploads (ADR-033).
 func UploadsPage(v uploadsView) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
 			return templ_7745c5c3_CtxErr
 		}
 		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 		if !templ_7745c5c3_IsBuffer {
 			defer func() {
 				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 				if templ_7745c5c3_Err == nil {
 					templ_7745c5c3_Err = templ_7745c5c3_BufErr
 				}
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
 		templ_7745c5c3_Var1 := templ.GetChildren(ctx)
 		if templ_7745c5c3_Var1 == nil {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		templ_7745c5c3_Var2 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
 				defer func() {
 					templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 					if templ_7745c5c3_Err == nil {
 						templ_7745c5c3_Err = templ_7745c5c3_BufErr
 					}
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<article class=\"account\"><h1>Upload a recording</h1><p class=\"muted\">Audio only. Up to ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var3 string
 			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d MB", v.Limits.MaxBytes>>20))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 17, Col: 67}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, " and ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var4 string
 			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(uploads.FormatDuration(v.Limits.MaxDuration))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 18, Col: 50}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, ". The transcript is private to you; the audio is deleted once it has been transcribed.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if v.Error != "" {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<div class=\"flash flash-error\" role=\"alert\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var5 string
 				templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(v.Error)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 22, Col: 57}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<form method=\"post\" action=\"/uploads\" enctype=\"multipart/form-data\"><p><label>Title (optional) <input type=\"text\" name=\"title\" maxlength=\"200\"></label></p><p><input type=\"file\" name=\"file\" accept=\"audio/*,.m4a,.mp3,.wav,.opus,.ogg,.mp4\" required></p><p><button type=\"submit\">Upload and transcribe</button></p></form>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if len(v.Rows) > 0 {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "<section><h2>Your recordings</h2><ul>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for _, u := range v.Rows {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "<li><a href=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var6 templ.SafeURL
 					templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL("/uploads/" + u.ID))
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 35, Col: 51}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var7 string
 					templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(u.Title)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 35, Col: 63}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</a> <span class=\"chip\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var8 string
 					templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(string(u.Status))
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 36, Col: 45}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</span></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</ul></section>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
 		templ_7745c5c3_Err = Layout("Tapir — Upload a recording").Render(templ.WithChildren(ctx, templ_7745c5c3_Var2), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		return nil
 	})
 }
 // UploadPage is one upload's page: its title and the polling status region.
 func UploadPage(u domain.UploadedTranscript, chatEnabled bool) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
 			return templ_7745c5c3_CtxErr
 		}
 		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 		if !templ_7745c5c3_IsBuffer {
 			defer func() {
 				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 				if templ_7745c5c3_Err == nil {
 					templ_7745c5c3_Err = templ_7745c5c3_BufErr
 				}
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
 		templ_7745c5c3_Var9 := templ.GetChildren(ctx)
 		if templ_7745c5c3_Var9 == nil {
 			templ_7745c5c3_Var9 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		templ_7745c5c3_Var10 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
 				defer func() {
 					templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 					if templ_7745c5c3_Err == nil {
 						templ_7745c5c3_Err = templ_7745c5c3_BufErr
 					}
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<article class=\"account\"><h1>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var11 string
 			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(u.Title)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 50, Col: 16}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</h1>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = uploadStatus(u, chatEnabled).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<p><a href=\"/uploads\">All recordings</a></p></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
 		templ_7745c5c3_Err = Layout("Tapir — "+u.Title).Render(templ.WithChildren(ctx, templ_7745c5c3_Var10), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		return nil
 	})
 }
 // uploadStatus is the region HTMX polls. Unfinished states carry hx-trigger so the
 // page re-asks; done and failed render without it, so nothing polls forever.
 func uploadStatus(u domain.UploadedTranscript, chatEnabled bool) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
 			return templ_7745c5c3_CtxErr
 		}
 		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 		if !templ_7745c5c3_IsBuffer {
 			defer func() {
 				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 				if templ_7745c5c3_Err == nil {
 					templ_7745c5c3_Err = templ_7745c5c3_BufErr
 				}
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
 		templ_7745c5c3_Var12 := templ.GetChildren(ctx)
 		if templ_7745c5c3_Var12 == nil {
 			templ_7745c5c3_Var12 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		switch u.Status {
 		case domain.UploadDone:
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "<div class=\"upload-status upload-done\" role=\"status\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = videoNotice(u.HadVideo).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<p>Transcribed ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var13 string
 			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(uploads.FormatDuration(time.Duration(u.AudioSeconds * float64(time.Second))))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 65, Col: 95}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, " of audio by <span class=\"chip\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var14 string
 			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(u.Endpoint)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 66, Col: 48}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</span>.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if chatEnabled {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<p><a class=\"btn\" href=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var15 templ.SafeURL
 				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL("/uploads/" + u.ID + "/chat"))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 69, Col: 73}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\">Ask about this recording</a></p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<details open><summary>Transcript</summary><pre class=\"transcript\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var16 string
 			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(u.Content)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 73, Col: 40}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</pre></details></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		case domain.UploadFailed:
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<div class=\"upload-status upload-failed flash flash-error\" role=\"alert\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = videoNotice(u.HadVideo).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var17 string
 			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(uploadFailureMessage(u.ErrorKind))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 79, Col: 42}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		default:
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<div class=\"upload-status upload-working\" role=\"status\" hx-get=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var18 string
 			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue("/uploads/" + u.ID + "/status")
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 85, Col: 43}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\" hx-trigger=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var19 string
 			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue("every " + uploadPollEvery)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 86, Col: 43}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\" hx-swap=\"outerHTML\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = videoNotice(u.HadVideo).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if u.Status == domain.UploadTranscribing {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<p>Transcribing… a long recording takes a few minutes.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<p>Queued — waiting for its turn to be transcribed.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		return nil
 	})
 }
 // UploadChatPage is the no-JS full page for chatting with an uploaded transcript:
 // the same chat panel as a video's (ADR-027), scoped to this recording.
 func UploadChatPage(u domain.UploadedTranscript, v chatView) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
 			return templ_7745c5c3_CtxErr
 		}
 		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 		if !templ_7745c5c3_IsBuffer {
 			defer func() {
 				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 				if templ_7745c5c3_Err == nil {
 					templ_7745c5c3_Err = templ_7745c5c3_BufErr
 				}
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
 		templ_7745c5c3_Var20 := templ.GetChildren(ctx)
 		if templ_7745c5c3_Var20 == nil {
 			templ_7745c5c3_Var20 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		templ_7745c5c3_Var21 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
 				defer func() {
 					templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 					if templ_7745c5c3_Err == nil {
 						templ_7745c5c3_Err = templ_7745c5c3_BufErr
 					}
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<article class=\"account\"><h1>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 string
 			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(u.Title)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 104, Col: 16}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</h1><section id=\"chat-section\" class=\"chat-dock chat-dock-open\"><h2 class=\"chat-heading\">Ask about this recording</h2><p class=\"chat-scope muted\">Answers come only from this recording's transcript, which is private to you.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = chatPanel(v).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</section><p><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var23 templ.SafeURL
 			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL("/uploads/" + u.ID))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/uploads.templ`, Line: 110, Col: 49}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\">Back to the transcript</a></p></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
 		templ_7745c5c3_Err = Layout("Tapir — Ask about "+u.Title).Render(templ.WithChildren(ctx, templ_7745c5c3_Var21), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		return nil
 	})
 }
 // videoNotice tells the user a video track was present and what became of it. A
 // Teams meeting with the camera off is still a video file; it is accepted, only the
 // audio is transcribed, and the picture is thrown away — so say so, in every state,
 // instead of leaving the user to wonder (ADR-033).
 func videoNotice(hadVideo bool) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
 			return templ_7745c5c3_CtxErr
 		}
 		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 		if !templ_7745c5c3_IsBuffer {
 			defer func() {
 				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
 				if templ_7745c5c3_Err == nil {
 					templ_7745c5c3_Err = templ_7745c5c3_BufErr
 				}
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
 		templ_7745c5c3_Var24 := templ.GetChildren(ctx)
 		if templ_7745c5c3_Var24 == nil {
 			templ_7745c5c3_Var24 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		if hadVideo {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<p class=\"muted video-notice\">This file contained a video track. Only its audio was used; the video was discarded and nothing from it was kept.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		return nil
 	})
 }
 var _ = templruntime.GeneratedTemplate
@@ -583,7 +583,7 @@ templ chatPanel(v chatView) {
 				</div>
 			}
 			if v.Truncated {
-				<p class="chat-note muted">Working from a bounded portion of a long transcript — answers about the end of the video may be incomplete.</p>
+				<p class="chat-note muted">Working from a bounded portion of a long transcript — answers about the end of the { v.subject() } may be incomplete.</p>
 			}
 			if v.Error != "" {
 				<p class="chat-error" role="alert">{ v.Error }</p>
@@ -591,8 +591,8 @@ templ chatPanel(v chatView) {
 			<form
 				class="chat-form"
 				method="post"
-				action={ chatURL(v.VideoID) }
+				action={ v.postURL() }
-				hx-post={ string(chatURL(v.VideoID)) }
+				hx-post={ string(v.postURL()) }
 				hx-target="#chat-panel"
 				hx-swap="outerHTML"
 			>
@@ -609,7 +609,7 @@ templ chatPanel(v chatView) {
 					</select>
 					<span class="chat-model-hint muted">Switch models to compare answers on the same transcript.</span>
 				</label>
-				<textarea name="question" rows="3" placeholder="Ask a question about this video…" required aria-label="Your question"></textarea>
+				<textarea name="question" rows="3" placeholder={ "Ask a question about this " + v.subject() + "…" } required aria-label="Your question"></textarea>
 				<button type="submit" class="btn">Ask</button>
 				<span class="htmx-indicator chat-thinking">thinking…</span>
 			</form>
@@ -5,8 +5,10 @@ package web
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
-import "github.com/a-h/templ"
+import (
-import templruntime "github.com/a-h/templ/runtime"
+	"github.com/a-h/templ"
 	templruntime "github.com/a-h/templ/runtime"
 )
 import (
 	"fmt"
@@ -292,7 +294,7 @@ func flashBanner(code string) templ.Component {
 		}
 		ctx = templ.ClearChildren(ctx)
 		if f, ok := flashFor(code); ok {
-			var templ_7745c5c3_Var9 = []any{"flash", "flash-" + f.Kind}
+			templ_7745c5c3_Var9 := []any{"flash", "flash-" + f.Kind}
 			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var9...)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
@@ -824,7 +826,7 @@ func VideoCard(r store.SummaryRow) templ.Component {
 			templ_7745c5c3_Var25 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		var templ_7745c5c3_Var26 = []any{"card", templ.KV("card-pending", !r.Summarized)}
+		templ_7745c5c3_Var26 := []any{"card", templ.KV("card-pending", !r.Summarized)}
 		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var26...)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
@@ -2152,148 +2154,174 @@ func chatPanel(v chatView) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if v.Truncated {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 173, "<p class=\"chat-note muted\">Working from a bounded portion of a long transcript — answers about the end of the video may be incomplete.</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 173, "<p class=\"chat-note muted\">Working from a bounded portion of a long transcript — answers about the end of the ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 174, " ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if v.Error != "" {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 175, "<p class=\"chat-error\" role=\"alert\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var88 string
-				templ_7745c5c3_Var88, templ_7745c5c3_Err = templ.JoinStringErrs(v.Error)
+				templ_7745c5c3_Var88, templ_7745c5c3_Err = templ.JoinStringErrs(v.subject())
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 589, Col: 48}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 586, Col: 129}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var88))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 176, "</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 174, " may be incomplete.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 177, " <form class=\"chat-form\" method=\"post\" action=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 175, " ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var89 templ.SafeURL
+			if v.Error != "" {
-			templ_7745c5c3_Var89, templ_7745c5c3_Err = templ.JoinURLErrs(chatURL(v.VideoID))
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 176, "<p class=\"chat-error\" role=\"alert\">")
 				if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 594, Col: 31}
+					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var89 string
 				templ_7745c5c3_Var89, templ_7745c5c3_Err = templ.JoinStringErrs(v.Error)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 589, Col: 48}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var89))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 178, "\" hx-post=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 177, "</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			var templ_7745c5c3_Var90 string
 			templ_7745c5c3_Var90, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(chatURL(v.VideoID)))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 595, Col: 40}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var90)
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 178, " <form class=\"chat-form\" method=\"post\" action=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 179, "\" hx-target=\"#chat-panel\" hx-swap=\"outerHTML\">")
+			var templ_7745c5c3_Var90 templ.SafeURL
 			templ_7745c5c3_Var90, templ_7745c5c3_Err = templ.JoinURLErrs(v.postURL())
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 594, Col: 24}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var90))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			for _, t := range v.History {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 179, "\" hx-post=\"")
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 180, "<input type=\"hidden\" name=\"hq\" value=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var91 string
-				templ_7745c5c3_Var91, templ_7745c5c3_Err = templ.ResolveAttributeValue(t.Question)
+			templ_7745c5c3_Var91, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(v.postURL()))
 			if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 600, Col: 54}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 595, Col: 33}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var91)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 181, "\"> <input type=\"hidden\" name=\"ha\" value=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 180, "\" hx-target=\"#chat-panel\" hx-swap=\"outerHTML\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for _, t := range v.History {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 181, "<input type=\"hidden\" name=\"hq\" value=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var92 string
-				templ_7745c5c3_Var92, templ_7745c5c3_Err = templ.ResolveAttributeValue(t.Answer)
+				templ_7745c5c3_Var92, templ_7745c5c3_Err = templ.ResolveAttributeValue(t.Question)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 601, Col: 52}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 600, Col: 54}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var92)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 182, "\"> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 182, "\"> <input type=\"hidden\" name=\"ha\" value=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 183, "<label class=\"chat-model\">Model <select name=\"model\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for _, m := range v.Models {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 184, "<option value=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var93 string
-				templ_7745c5c3_Var93, templ_7745c5c3_Err = templ.ResolveAttributeValue(m)
+				templ_7745c5c3_Var93, templ_7745c5c3_Err = templ.ResolveAttributeValue(t.Answer)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 607, Col: 24}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 601, Col: 52}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var93)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 185, "\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 183, "\"> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if m == v.Selected {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 186, " selected")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 187, ">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 184, "<label class=\"chat-model\">Model <select name=\"model\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for _, m := range v.Models {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 185, "<option value=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var94 string
-				templ_7745c5c3_Var94, templ_7745c5c3_Err = templ.JoinStringErrs(m)
+				templ_7745c5c3_Var94, templ_7745c5c3_Err = templ.ResolveAttributeValue(m)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 607, Col: 24}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var94)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 186, "\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if m == v.Selected {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 187, " selected")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 188, ">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var95 string
 				templ_7745c5c3_Var95, templ_7745c5c3_Err = templ.JoinStringErrs(m)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 607, Col: 60}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var94))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var95))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 188, "</option>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 189, "</option>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 189, "</select> <span class=\"chat-model-hint muted\">Switch models to compare answers on the same transcript.</span></label> <textarea name=\"question\" rows=\"3\" placeholder=\"Ask a question about this video…\" required aria-label=\"Your question\"></textarea> <button type=\"submit\" class=\"btn\">Ask</button> <span class=\"htmx-indicator chat-thinking\">thinking…</span></form>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 190, "</select> <span class=\"chat-model-hint muted\">Switch models to compare answers on the same transcript.</span></label> <textarea name=\"question\" rows=\"3\" placeholder=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var96 string
 			templ_7745c5c3_Var96, templ_7745c5c3_Err = templ.ResolveAttributeValue("Ask a question about this " + v.subject() + "…")
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 612, Col: 103}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var96)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 191, "\" required aria-label=\"Your question\"></textarea> <button type=\"submit\" class=\"btn\">Ask</button> <span class=\"htmx-indicator chat-thinking\">thinking…</span></form>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 190, "</div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 192, "</div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2320,12 +2348,12 @@ func RegisterPage(email, errMsg string) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var95 := templ.GetChildren(ctx)
+		templ_7745c5c3_Var97 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var95 == nil {
+		if templ_7745c5c3_Var97 == nil {
-			templ_7745c5c3_Var95 = templ.NopComponent
+			templ_7745c5c3_Var97 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Var96 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_Var98 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
@@ -2337,59 +2365,59 @@ func RegisterPage(email, errMsg string) templ.Component {
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 191, "<article class=\"register\"><h1>Complete your registration</h1>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 193, "<article class=\"register\"><h1>Complete your registration</h1>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if email != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 192, "<p class=\"meta\">Signed in as ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 194, "<p class=\"meta\">Signed in as ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var97 string
+				var templ_7745c5c3_Var99 string
-				templ_7745c5c3_Var97, templ_7745c5c3_Err = templ.JoinStringErrs(email)
+				templ_7745c5c3_Var99, templ_7745c5c3_Err = templ.JoinStringErrs(email)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 628, Col: 40}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var97))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var99))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 193, ".</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 195, ".</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 194, "<p>Choose a display name to finish setting up your Tapir account.</p>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 196, "<p>Choose a display name to finish setting up your Tapir account.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if errMsg != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 195, "<p class=\"error\" role=\"alert\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 197, "<p class=\"error\" role=\"alert\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var98 string
+				var templ_7745c5c3_Var100 string
-				templ_7745c5c3_Var98, templ_7745c5c3_Err = templ.JoinStringErrs(errMsg)
+				templ_7745c5c3_Var100, templ_7745c5c3_Err = templ.JoinStringErrs(errMsg)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 632, Col: 42}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var98))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var100))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 196, "</p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 198, "</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 197, "<form method=\"post\" action=\"/register\" class=\"register-form\"><label>Display name <input type=\"text\" name=\"display_name\" required autofocus></label> <button type=\"submit\" class=\"btn\">Register</button></form></article>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 199, "<form method=\"post\" action=\"/register\" class=\"register-form\"><label>Display name <input type=\"text\" name=\"display_name\" required autofocus></label> <button type=\"submit\" class=\"btn\">Register</button></form></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
-		templ_7745c5c3_Err = Layout("Tapir — Register").Render(templ.WithChildren(ctx, templ_7745c5c3_Var96), templ_7745c5c3_Buffer)
+		templ_7745c5c3_Err = Layout("Tapir — Register").Render(templ.WithChildren(ctx, templ_7745c5c3_Var98), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2417,12 +2445,12 @@ func AccountPage(displayName, email string, conns []store.Connection, autoSummar
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var99 := templ.GetChildren(ctx)
+		templ_7745c5c3_Var101 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var99 == nil {
+		if templ_7745c5c3_Var101 == nil {
-			templ_7745c5c3_Var99 = templ.NopComponent
+			templ_7745c5c3_Var101 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Var100 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_Var102 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
@@ -2438,34 +2466,16 @@ func AccountPage(displayName, email string, conns []store.Connection, autoSummar
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 198, " <article class=\"account\"><h1>Account</h1><dl class=\"account-meta\"><dt>Display name</dt><dd>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 200, " <article class=\"account\"><h1>Account</h1><dl class=\"account-meta\"><dt>Display name</dt><dd>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var101 string
+			var templ_7745c5c3_Var103 string
-			templ_7745c5c3_Var101, templ_7745c5c3_Err = templ.JoinStringErrs(displayNameOr(displayName))
+			templ_7745c5c3_Var103, templ_7745c5c3_Err = templ.JoinStringErrs(displayNameOr(displayName))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 656, Col: 36}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var101))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var103))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 199, "</dd>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if email != "" {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 200, "<dt>Signed in as</dt><dd>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var102 string
 				templ_7745c5c3_Var102, templ_7745c5c3_Err = templ.JoinStringErrs(email)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 659, Col: 16}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var102))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -2473,8 +2483,26 @@ func AccountPage(displayName, email string, conns []store.Connection, autoSummar
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if email != "" {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 202, "<dt>Signed in as</dt><dd>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 202, "</dl><section><h2>Summarization</h2><p class=\"muted\">Automatic summarizes new videos from about the last week as they are discovered. Older videos stay browsable — summarize them on demand. Manual lets you pick which videos to summarize — every new video appears in your list with a Summarize button.</p>")
+				var templ_7745c5c3_Var104 string
 				templ_7745c5c3_Var104, templ_7745c5c3_Err = templ.JoinStringErrs(email)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 659, Col: 16}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var104))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 203, "</dd>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 204, "</dl><section><h2>Summarization</h2><p class=\"muted\">Automatic summarizes new videos from about the last week as they are discovered. Older videos stay browsable — summarize them on demand. Manual lets you pick which videos to summarize — every new video appears in your list with a Summarize button.</p>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -2482,178 +2510,178 @@ func AccountPage(displayName, email string, conns []store.Connection, autoSummar
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 203, "</section>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 205, "</section>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if len(channelErrors) > 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 204, "<section class=\"channel-errors\"><h2>Unavailable channels</h2><p class=\"muted\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 206, "<section class=\"channel-errors\"><h2>Unavailable channels</h2><p class=\"muted\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var103 string
 				templ_7745c5c3_Var103, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d channel(s) returned errors on the last discovery pass.", len(channelErrors)))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 676, Col: 100}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var103))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 205, " These may have been deleted or made private on YouTube.</p><ul class=\"channel-error-list\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for _, ce := range channelErrors {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 206, "<li><span class=\"channel-error-name\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var104 string
 					templ_7745c5c3_Var104, templ_7745c5c3_Err = templ.JoinStringErrs(ce.ChannelName)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 682, Col: 57}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var104))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 207, "</span> <span class=\"chip chip-warn\">unavailable</span> <span class=\"muted channel-error-since\">since ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var105 string
-					templ_7745c5c3_Var105, templ_7745c5c3_Err = templ.JoinStringErrs(ce.FirstSeen.Format("2006-01-02"))
+				templ_7745c5c3_Var105, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d channel(s) returned errors on the last discovery pass.", len(channelErrors)))
 				if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 684, Col: 89}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 676, Col: 100}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var105))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 208, "</span></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 207, " These may have been deleted or made private on YouTube.</p><ul class=\"channel-error-list\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				}
+				for _, ce := range channelErrors {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 209, "</ul></section>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 208, "<li><span class=\"channel-error-name\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 210, "<section><h2>Connected accounts</h2>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if len(conns) == 0 {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 211, "<p class=\"muted\">No connected video accounts yet.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 212, "<ul class=\"conn-list\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for _, c := range conns {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 213, "<li class=\"conn\"><div class=\"conn-main\"><span class=\"conn-provider\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var106 string
-					templ_7745c5c3_Var106, templ_7745c5c3_Err = templ.JoinStringErrs(providerLabel(c.Provider))
+					templ_7745c5c3_Var106, templ_7745c5c3_Err = templ.JoinStringErrs(ce.ChannelName)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 699, Col: 64}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 682, Col: 57}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var106))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 214, "</span> ")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 209, "</span> <span class=\"chip chip-warn\">unavailable</span> <span class=\"muted channel-error-since\">since ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					if c.ProviderAccount != "" {
 						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 215, "<span class=\"muted\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var107 string
-						templ_7745c5c3_Var107, templ_7745c5c3_Err = templ.JoinStringErrs(c.ProviderAccount)
+					templ_7745c5c3_Var107, templ_7745c5c3_Err = templ.JoinStringErrs(ce.FirstSeen.Format("2006-01-02"))
 					if templ_7745c5c3_Err != nil {
-							return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 701, Col: 49}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 684, Col: 89}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var107))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 210, "</span></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 211, "</ul></section>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 212, "<section><h2>Connected accounts</h2>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if len(conns) == 0 {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 213, "<p class=\"muted\">No connected video accounts yet.</p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 214, "<ul class=\"conn-list\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for _, c := range conns {
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 215, "<li class=\"conn\"><div class=\"conn-main\"><span class=\"conn-provider\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var108 string
 					templ_7745c5c3_Var108, templ_7745c5c3_Err = templ.JoinStringErrs(providerLabel(c.Provider))
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 699, Col: 64}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var108))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 216, "</span> ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					}
+					if c.ProviderAccount != "" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 217, "<span class=\"chip\">")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 217, "<span class=\"muted\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var108 string
 					templ_7745c5c3_Var108, templ_7745c5c3_Err = templ.JoinStringErrs(c.Status)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 703, Col: 38}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var108))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 218, "</span></div><div class=\"conn-meta muted\">connected ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 						var templ_7745c5c3_Var109 string
-					templ_7745c5c3_Var109, templ_7745c5c3_Err = templ.JoinStringErrs(c.ConnectedAt.Format("2006-01-02"))
+						templ_7745c5c3_Var109, templ_7745c5c3_Err = templ.JoinStringErrs(c.ProviderAccount)
 						if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 705, Col: 83}
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 701, Col: 49}
 						}
 						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var109))
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 219, "</div><form method=\"post\" action=\"")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 218, "</span> ")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-					var templ_7745c5c3_Var110 templ.SafeURL
+					}
-					templ_7745c5c3_Var110, templ_7745c5c3_Err = templ.JoinURLErrs(disconnectURL(c.Provider))
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 219, "<span class=\"chip\">")
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 706, Col: 62}
+						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var110 string
 					templ_7745c5c3_Var110, templ_7745c5c3_Err = templ.JoinStringErrs(c.Status)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 703, Col: 38}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var110))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 220, "\"><button type=\"submit\" class=\"btn-secondary\">Disconnect</button></form></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 220, "</span></div><div class=\"conn-meta muted\">connected ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var111 string
 					templ_7745c5c3_Var111, templ_7745c5c3_Err = templ.JoinStringErrs(c.ConnectedAt.Format("2006-01-02"))
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 705, Col: 83}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var111))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 221, "</div><form method=\"post\" action=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var112 templ.SafeURL
 					templ_7745c5c3_Var112, templ_7745c5c3_Err = templ.JoinURLErrs(disconnectURL(c.Provider))
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 706, Col: 62}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var112))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 222, "\"><button type=\"submit\" class=\"btn-secondary\">Disconnect</button></form></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 221, "</ul>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 223, "</ul>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 			if !hasYouTube(conns) {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 222, "<p><a class=\"btn\" href=\"/oauth/youtube/connect\">Connect YouTube</a></p>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 224, "<p><a class=\"btn\" href=\"/oauth/youtube/connect\">Connect YouTube</a></p>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 223, "</section><section class=\"danger-zone\"><h2>Delete account</h2><p class=\"muted\">Permanently remove your Tapir account and all of its data — summaries, watch/skip/save actions, and connected accounts. This cannot be undone.</p><details class=\"confirm-delete\"><summary class=\"btn-danger\">Delete account…</summary><div class=\"confirm-body\"><p>This permanently deletes your account and all data. Are you sure?</p><form method=\"post\" action=\"/account/delete\"><button type=\"submit\" class=\"btn-danger\">Yes, permanently delete my account</button></form></div></details></section></article>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 225, "</section><section class=\"danger-zone\"><h2>Delete account</h2><p class=\"muted\">Permanently remove your Tapir account and all of its data — summaries, watch/skip/save actions, and connected accounts. This cannot be undone.</p><details class=\"confirm-delete\"><summary class=\"btn-danger\">Delete account…</summary><div class=\"confirm-body\"><p>This permanently deletes your account and all data. Are you sure?</p><form method=\"post\" action=\"/account/delete\"><button type=\"submit\" class=\"btn-danger\">Yes, permanently delete my account</button></form></div></details></section></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
-		templ_7745c5c3_Err = Layout("Tapir — Account").Render(templ.WithChildren(ctx, templ_7745c5c3_Var100), templ_7745c5c3_Buffer)
+		templ_7745c5c3_Err = Layout("Tapir — Account").Render(templ.WithChildren(ctx, templ_7745c5c3_Var102), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2681,51 +2709,51 @@ func summarizeModeControl(auto bool) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var111 := templ.GetChildren(ctx)
+		templ_7745c5c3_Var113 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var111 == nil {
+		if templ_7745c5c3_Var113 == nil {
-			templ_7745c5c3_Var111 = templ.NopComponent
+			templ_7745c5c3_Var113 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 224, "<div id=\"summarize-mode\" class=\"summarize-mode\"><p>Current mode: <strong>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 226, "<div id=\"summarize-mode\" class=\"summarize-mode\"><p>Current mode: <strong>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var112 string
 		templ_7745c5c3_Var112, templ_7745c5c3_Err = templ.JoinStringErrs(summarizeModeLabel(auto))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 743, Col: 53}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var112))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 225, "</strong></p><form method=\"post\" action=\"/account/summarize-mode\" hx-post=\"/account/summarize-mode\" hx-target=\"#summarize-mode\" hx-swap=\"outerHTML\"><input type=\"hidden\" name=\"enabled\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var113 string
 		templ_7745c5c3_Var113, templ_7745c5c3_Err = templ.ResolveAttributeValue(boolStr(!auto))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 751, Col: 61}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var113)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 226, "\"> <button type=\"submit\" class=\"btn-secondary\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var114 string
-		templ_7745c5c3_Var114, templ_7745c5c3_Err = templ.JoinStringErrs(summarizeModeToggleLabel(auto))
+		templ_7745c5c3_Var114, templ_7745c5c3_Err = templ.JoinStringErrs(summarizeModeLabel(auto))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 752, Col: 79}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 743, Col: 53}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var114))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 227, "</button></form></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 227, "</strong></p><form method=\"post\" action=\"/account/summarize-mode\" hx-post=\"/account/summarize-mode\" hx-target=\"#summarize-mode\" hx-swap=\"outerHTML\"><input type=\"hidden\" name=\"enabled\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var115 string
 		templ_7745c5c3_Var115, templ_7745c5c3_Err = templ.ResolveAttributeValue(boolStr(!auto))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 751, Col: 61}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var115)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 228, "\"> <button type=\"submit\" class=\"btn-secondary\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var116 string
 		templ_7745c5c3_Var116, templ_7745c5c3_Err = templ.JoinStringErrs(summarizeModeToggleLabel(auto))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 752, Col: 79}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var116))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 229, "</button></form></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2753,38 +2781,38 @@ func ActionButtons(videoID string, active map[string]bool) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var115 := templ.GetChildren(ctx)
+		templ_7745c5c3_Var117 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var115 == nil {
+		if templ_7745c5c3_Var117 == nil {
-			templ_7745c5c3_Var115 = templ.NopComponent
+			templ_7745c5c3_Var117 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 228, "<form id=\"action-buttons\" class=\"actions\" method=\"post\" action=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 230, "<form id=\"action-buttons\" class=\"actions\" method=\"post\" action=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var116 templ.SafeURL
+		var templ_7745c5c3_Var118 templ.SafeURL
-		templ_7745c5c3_Var116, templ_7745c5c3_Err = templ.JoinURLErrs(actionURL(videoID))
+		templ_7745c5c3_Var118, templ_7745c5c3_Err = templ.JoinURLErrs(actionURL(videoID))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 766, Col: 29}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var116))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var118))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 229, "\" hx-post=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 231, "\" hx-post=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var117 string
+		var templ_7745c5c3_Var119 string
-		templ_7745c5c3_Var117, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(actionURL(videoID)))
+		templ_7745c5c3_Var119, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(actionURL(videoID)))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 767, Col: 38}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var117)
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var119)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 230, "\" hx-target=\"#action-buttons\" hx-swap=\"outerHTML\"><span class=\"segmented\" role=\"group\" aria-label=\"Watched or skipped\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 232, "\" hx-target=\"#action-buttons\" hx-swap=\"outerHTML\"><span class=\"segmented\" role=\"group\" aria-label=\"Watched or skipped\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2796,7 +2824,7 @@ func ActionButtons(videoID string, active map[string]bool) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 231, "</span>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 233, "</span>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2804,7 +2832,7 @@ func ActionButtons(videoID string, active map[string]bool) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 232, "</form>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 234, "</form>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -2830,81 +2858,81 @@ func actionButton(verb string, isActive bool) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var118 := templ.GetChildren(ctx)
+		templ_7745c5c3_Var120 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var118 == nil {
+		if templ_7745c5c3_Var120 == nil {
-			templ_7745c5c3_Var118 = templ.NopComponent
+			templ_7745c5c3_Var120 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		var templ_7745c5c3_Var119 = []any{"action", templ.KV("active", isActive)}
+		templ_7745c5c3_Var121 := []any{"action", templ.KV("active", isActive)}
-		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var119...)
+		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var121...)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 233, "<button type=\"submit\" name=\"action\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 235, "<button type=\"submit\" name=\"action\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var120 string
 		templ_7745c5c3_Var120, templ_7745c5c3_Err = templ.ResolveAttributeValue(verb)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 788, Col: 14}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var120)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 234, "\" class=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var121 string
 		templ_7745c5c3_Var121, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var119).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var121)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 235, "\" aria-pressed=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var122 string
-		templ_7745c5c3_Var122, templ_7745c5c3_Err = templ.ResolveAttributeValue(ariaPressed(isActive))
+		templ_7745c5c3_Var122, templ_7745c5c3_Err = templ.ResolveAttributeValue(verb)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 790, Col: 38}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 788, Col: 14}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var122)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 236, "\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 236, "\" class=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var123 string
 		templ_7745c5c3_Var123, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var121).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var123)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 237, "\" aria-pressed=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var124 string
 		templ_7745c5c3_Var124, templ_7745c5c3_Err = templ.ResolveAttributeValue(ariaPressed(isActive))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 790, Col: 38}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var124)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 238, "\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if isActive {
-			var templ_7745c5c3_Var123 string
+			var templ_7745c5c3_Var125 string
-			templ_7745c5c3_Var123, templ_7745c5c3_Err = templ.JoinStringErrs("✓ " + actionLabel(verb))
+			templ_7745c5c3_Var125, templ_7745c5c3_Err = templ.JoinStringErrs("✓ " + actionLabel(verb))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 793, Col: 31}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var123))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var125))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			var templ_7745c5c3_Var124 string
+			var templ_7745c5c3_Var126 string
-			templ_7745c5c3_Var124, templ_7745c5c3_Err = templ.JoinStringErrs(actionLabel(verb))
+			templ_7745c5c3_Var126, templ_7745c5c3_Err = templ.JoinStringErrs(actionLabel(verb))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `internal/web/views.templ`, Line: 795, Col: 22}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var124))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var126))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 237, "</button>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 239, "</button>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -101,6 +101,27 @@ var scenarioCoverage = map[string]string{
 	"A multi-turn conversation is ephemeral":                     "TestChatMultiTurnHistoryIsEphemeral",
 	"Chat is reachable only from my own summary view":            "TestChatOnlyReachableForOwnVideo",
 	// audio_upload.feature (ADR-033, #33)
 	"The upload form states the limits up front":                                "TestUploadsPage_ShowsAMultipartFormWithAFileField",
 	"An accepted recording is queued and I am taken to its page":                "TestUploadPost_AcceptedAudioQueuesARowAndRedirectsToIt",
 	"A recording with no title is named after its file":                         "TestUploadPost_WithoutATitleUsesTheFilenameMinusItsExtension",
 	"A file with a video track is accepted and I am told the video was ignored": "TestUploadStatus_TellsTheUserTheVideoWasIgnoredInEveryStateAndOnlyWhenItWas",
 	"A video file with no audio is rejected for having no audio":                "TestUploadPost_RejectionsAreSynchronousWithAMessageAndNoRow",
 	"A recording over the length limit is rejected with both lengths":           "TestUploadPost_RejectionsAreSynchronousWithAMessageAndNoRow",
 	"A file over the size limit is rejected as too large":                       "TestUploadPost_RejectionsAreSynchronousWithAMessageAndNoRow",
 	"Cover art on an audio file is not a video track":                           "TestParseProbe",
 	"A file that is not media is rejected as unreadable":                        "TestAccept_UnreadableFileIsARejectionButAProberFaultIsAnError",
 	"A broken ffprobe is reported as our fault, not as a bad file":              "TestAccept_UnreadableFileIsARejectionButAProberFaultIsAnError",
 	"A recording becomes a transcript and the audio is deleted":                 "TestWorkerProcess_SuccessConvertsTranscribesStoresAndDeletesTheAudio",
 	"The endpoint that served a transcript is recorded and shown":               "TestUploadStatus_DoneNamesTheEndpointThatServedIt",
 	"The local endpoint is tried first and the fallback only on failure":        "TestChain_AnyPrimaryFailureFallsBackAndRecordsTheFallbackEndpoint",
 	"A failed transcription ends in a message, never a spinner":                 "TestUploadStatus_UnfinishedStatesKeepPollingTerminalStatesStop",
 	"A restart fails the jobs it interrupted":                                   "TestFailInterruptedUploads_FailsOnlyUnfinishedRowsForEveryUser",
 	"Only one recording is transcribed at a time":                               "TestWorkerRun_ProcessesOneJobAtATime",
 	"My uploads are invisible to other users":                                   "TestUploadChat_AnotherUsersUploadIs404AndNoModelIsCalled",
 	"I can ask about my recording and get a grounded answer":                    "TestUploadChatPost_SendsTheOwnersTranscriptWithTheUploadBudget",
 	"A long recording is not cut to its first third":                            "TestAnswerMaxCharsOverridesTheServiceCap",
 	// summarize_new_video.feature
 	"A subscribed channel posts a video that has captions":         "TestSubscribedVideoWithCaptionsIsSummarizedAndDelivered",
 	"A subscribed channel posts a video with no usable transcript": "TestVideoWithNoTranscriptIsSkipped",
		`@@ -0,0 +1 @@`
							`ALTER TABLE uploaded_transcripts DROP COLUMN had_video;`