[patcon]

Real human words: this add an indexDB outbox that stores raw chunks of audio, persists them through refreshes and even to the next visit, and then sends them to the site after. this survives page refreshes and phone restarts. This means that it will essentially be impossible to lose participant recording chunks. (it stores it up to 7 days, and sends in the background when someone visits the portal while connected.

This worked for full chunks before (created only at 30s intervals or stop button presses), but it would only keep these in memory and retry for 8 minutes on same page. This will store every 1s "slice" interval, gather them into chunks, and send them not just in the tab session, but after page refresh, or even system restart.

small UX fixes, so it reassures that recording works offline, and tells status of upload parts.

Note: I did make the offline waveform brighter yellow (to connect it more clearly to the yellow call-out message), but I can revert that.

Before	After
Screen.Recording.2026-10-14.at.4.15.46.PM.mov	Screen.Recording.2026-10-14.at.4.12.53.PM.mov

Still working on this, as I'd like to have assurances down to 1 second that no audio will ever be lost from a phone.

---

Stacked on #1259. Review that one first; this PR's diff is only the 12 commits on top of it. When #1259 merges, GitHub retargets this one.

Draft: phases 1–2 of the audio outbox. The recorder doesn't write 1s slices yet (T6), so the crash-recovery code is in place but has nothing to recover until then.

A participant's recorded audio now stays on their device, in IndexedDB, until the server has confirmed it. Before, every chunk lived only in memory: React Query gave up after 20 upload / 5 confirm retries, and Finish waited 30s and then finished anyway (portal_uploads_incomplete_on_finish). A long offline stretch or a reload lost whatever hadn't been sent.

The outbox

• Store (outbox/outboxStore.ts): chunks as ArrayBuffer (older iOS Safari loses Blobs in IndexedDB), plus 1s slices of the chunk being recorded, sealed into one chunk in a single transaction.
• Drain loop (outbox/drainOutbox.ts): sends in order within a conversation, with backoff per conversation (2s doubling to 60s, no limit), so one failing conversation never holds up another. 403/404/410 drop the item; a chunk S3 already has is only re-confirmed; anything over 7 days is purged.
• Crash recovery: at start, a slice group whose recording lock no tab holds is sealed into a recovered chunk. Live once T6 writes slices.
• Provider (outbox/OutboxProvider.tsx, mounted in ParticipantLayout): one tab drains under a Web Lock. It wakes on new chunks, on coming back online (which skips the backoff), when the tab becomes visible, and when other tabs post on a BroadcastChannel. If IndexedDB can't be used, chunks fall back to the old in-memory upload.

Finish

• Finish stops the recorder, waits for its last chunk to be handed over (no more 100ms grace), then waits on outbox.settled() with no timeout, then calls finish().
• No finish item in the queue. A first cut queued the finish behind the chunks (54d08cbb); 2ae4a5d5 takes that back out. The backend already finishes abandoned conversations: conversations.finish-idle runs every 2 minutes and finishes anything with no chunk in the last 5 minutes. A chunk that lands on a finalized conversation reopens it. So if the tab closes mid-wait, the audio still sends later and the sweep finishes the conversation.
• Resume stays enabled while finishing and calls the finish off. Finish (and Skip on the verify reminder) is disabled while offline.
• Reconnect after an interruption no longer waits on uploads; queued audio sends after the reload.

What participants see

• Pause / finish modal: one progress line, counted over the whole page session.
  • "Uploading audio: 7 of 8 parts sent" (spinner)
  • "Awaiting connection: 7 of 8 parts sent" (spinner), under a yellow banner: "Connection lost. Your audio will continue to be saved on device."
  • "Upload complete: 8 of 8 parts sent" (check), which stays up rather than flashing by.
• Recording screen banners: the "Something went wrong… try refreshing the page" banner is gone, since a refresh never helps now. Offline gets "You seem to be offline, but keep going…". If the server stops answering while the device is online, a separate banner says so. Text mode keeps its plain offline warning, since typed text isn't saved on the device.
• Meter: a connection warning draws in amber (#e9bd5c, a new warningMark role) rather than the dark brown meant for text.

Telemetry

• New: portal_outbox_enqueued, portal_outbox_delivered, portal_outbox_dropped, portal_outbox_recovered and portal_outbox_store_failed.
• Replacing portal_uploads_incomplete_on_finish:
  • portal_finish_slow fires after 30s of waiting, the old give-up point.
  • portal_finish_cancelled fires when Resume calls a finish off.
  • conversation_finished gains finish_wait_ms and pending_uploads_at_start.
  • portal_abandoned also fires when the tab closes mid-finish.
• Gap: a conversation the idle sweep finishes has no conversation_finished event.

Testing

• src/portal: 18 files, 168 tests passing; tsc clean; Biome adds no new findings.
• Store and drain loop: tested against fake-indexeddb (new devDependency), with a fake API and a fake clock.
• New tests checked against the old code: a session-wide count test was dropped after it passed against the old code anyway. React batching hides the double count it was meant to catch.
• Not run: the full frontend suite, pnpm build, check-portal-bundle.mjs, and a manual pass in Chrome or on iOS Safari.

Not in this PR

• T6: the recorder writes 1s slices.
• T7: crash recovery end to end on Chrome and iOS Safari.
• T8: cleanup and device pass. enqueueFinish, the drainer's finish item type and ConnectionHealthStatus.tsx are unused now.
• Translations: the new strings aren't translated outside English yet.
• Backend follow-up: confirm-upload creates a new row per confirm, so a retried confirm duplicates the chunk. React Query already retried confirms, so this isn't new. The fix is one line: pass chunkId.
• Idle sweep and offline backlogs: the sweep goes by each chunk's client timestamp, so a backlog sent after a long offline stretch can be finished and reopened between uploads. That costs extra merges and summaries, but no audio is lost.

🤖 Generated with Claude Code (code and ~850 words of PR description from ~500 words of human prompts across this session)