docs(data-model): progress, progress_at, alive_at, and every judged spot stored (ADR-035)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/data-model.md

@@ -153,7 +153,10 @@ erDiagram
         float audio_seconds
         text error_kind "typed: interrupted | transcription_failed — never a provider string"
         bool had_video "the file carried a video track; only its audio was used (migration 018)"
-        jsonb reconciliation "NULL for a single engine; else status, exact counts and a bounded list of contested spots (migration 019, ADR-034)"
+        jsonb reconciliation "NULL for a single engine; else status, exact counts and a bounded list of every judged spot (migration 019, ADR-034; all spots stored, ADR-035)"
+        jsonb progress "the job's ordered phases: key, label, state, times, done/total; NULL until the job starts (migration 020, ADR-035)"
+        timestamptz progress_at "when a phase last really changed or advanced (migration 020)"
+        timestamptz alive_at "heartbeat from the running job, every ~10 s; not progress (migration 020)"
         timestamptz created_at
         timestamptz finished_at
     }
@@ -225,7 +228,7 @@ mechanism.
   grounds that it holds only public caption content, and a recorded meeting is the opposite.
   `user_id NOT NULL ... ON DELETE CASCADE`, FORCE RLS'd. `status` runs `queued → transcribing →
   done | failed`; `done` requires `content`, `failed` requires a typed `error_kind` (CHECK
-  constraints). `reconciliation` (migration 019, ADR-034) is NULL when one engine produced the text, so the page can never claim a second opinion that was not there; otherwise it holds the status (`reconciled` / `single_engine` / `skipped`), exact counts (differences, settled automatically, decided by the model, changed, uncertain, model errors) and up to 200 contested spots (each a position in seconds, both readings and which was used). The spots hold fragments of the private transcript, which is why they live in this RLS-scoped row. `had_video` (migration 018) records that the file carried a video track — a Teams meeting with the camera off is still a video file — so the page can say only its audio was used and the video was discarded. `endpoint` records which backend served it — `berget/...` means the audio left the
+  constraints). `reconciliation` (migration 019, ADR-034) is NULL when one engine produced the text, so the page can never claim a second opinion that was not there; otherwise it holds the status (`reconciled` / `single_engine` / `skipped`), exact counts (differences, settled automatically, decided by the model, changed, uncertain, model errors) and up to 2,000 judged spots (ADR-035: every one the model decided, kept or changed or unsure, each a position in seconds, both readings, which was used, and the few words before it; the page lists only the changed and uncertain ones). `progress`, `progress_at` and `alive_at` (migration 020, ADR-035) let the page show the job's phases and tell a running job from a quiet one from a lost service: `alive_at` is a heartbeat from a goroutine independent of any engine call, `progress_at` moves only when work really moved; the saved `segments` carry the reconciled words with the base engine's timing. The spots hold fragments of the private transcript, which is why they live in this RLS-scoped row. `had_video` (migration 018) records that the file carried a video track — a Teams meeting with the camera off is still a video file — so the page can say only its audio was used and the video was discarded. `endpoint` records which backend served it — `berget/...` means the audio left the
   homelab. The audio itself is never stored. `segments` keeps the timestamps (re-transcribing 90
   minutes costs ~7). Unlike `summary_actions`/`login_events` it **does** cascade on user deletion.
 - **LOGIN_EVENTS** (migration 010) — throttled one-row-per-(user, date) login stamp. Used by the