The over-cap guard moved from _process_one into process_audio ahead of backend dispatch, so an audio file longer than the 300-second confidential service limit now raises ConfidentialTranscribeDeferral("confidential_audio_too_long") and exits EXIT_PROVIDER_BLOCKED instead of silently re-routing to a local backend the supervisor deliberately keeps stopped. The input is retained with no .jsonl, .npz, or processing record written, so scan_unprocessed re-picks it. The confidential_audio_too_long reason is registered in the failure-and-telemetry reason table.