fix: preserve upload recovery and harden speech indexing

tests/test_uploads_and_storage.py

@@ -221,6 +221,11 @@ def test_upload_cancel_is_consistent_and_commit_window_returns_conflict(tmp_path
         job_state = conn.execute("SELECT status FROM jobs WHERE id=?", (job_id,)).fetchone()
     assert upload_state["status"] == "cancelled"
     assert job_state["status"] == "cancelled"
+    with app.state.services.db.read() as conn:
+        retained_path = Path(
+            conn.execute("SELECT temp_path FROM uploads WHERE id=?", (upload["id"],)).fetchone()[0]
+        )
+    assert retained_path.read_bytes() == b"data"
 
     committed = app.state.services.uploads.create(source_id, "", "committed.mp4", 4)
     with app.state.services.db.transaction() as conn:
@@ -239,6 +244,30 @@ def test_upload_cancel_is_consistent_and_commit_window_returns_conflict(tmp_path
     asyncio.run(scenario())
 
 
+def test_cancelled_upload_requires_explicit_discard_to_delete_recovery_copy(tmp_path: Path):
+    app, _, source_id, headers = _app(tmp_path)
+    uploads = app.state.services.uploads
+    upload = uploads.create(source_id, "", "recoverable.mp4", 4)
+    uploads.receive_chunk(upload["id"], 0, b"data")
+    with uploads.db.read() as conn:
+        staging = Path(conn.execute("SELECT temp_path FROM uploads WHERE id=?", (upload["id"],)).fetchone()[0])
+    uploads.cancel(upload["id"])
+    assert staging.is_file()
+
+    async def scenario():
+        transport = httpx.ASGITransport(app=app)
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+            response = await client.delete(
+                f"/api/v1/uploads/{upload['id']}/recovery", headers=headers
+            )
+            assert response.status_code == 204
+
+    asyncio.run(scenario())
+    assert not staging.exists()
+    with uploads.db.read() as conn:
+        assert conn.execute("SELECT 1 FROM uploads WHERE id=?", (upload["id"],)).fetchone() is None
+
+
 def test_upload_catalog_failure_retries_without_retransmitting(tmp_path: Path, monkeypatch):
     app, media, source_id, _ = _app(tmp_path)
     uploads = app.state.services.uploads