docs(data-model): reconciliation column

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/data-model.md

@@ -153,6 +153,7 @@ erDiagram
         float audio_seconds
         text error_kind "typed: interrupted | transcription_failed — never a provider string"
         bool had_video "the file carried a video track; only its audio was used (migration 018)"
+        jsonb reconciliation "NULL for a single engine; else status, exact counts and a bounded list of contested spots (migration 019, ADR-034)"
         timestamptz created_at
         timestamptz finished_at
     }
@@ -224,7 +225,7 @@ mechanism.
   grounds that it holds only public caption content, and a recorded meeting is the opposite.
   `user_id NOT NULL ... ON DELETE CASCADE`, FORCE RLS'd. `status` runs `queued → transcribing →
   done | failed`; `done` requires `content`, `failed` requires a typed `error_kind` (CHECK
-  constraints). `had_video` (migration 018) records that the file carried a video track — a Teams meeting with the camera off is still a video file — so the page can say only its audio was used and the video was discarded. `endpoint` records which backend served it — `berget/...` means the audio left the
+  constraints). `reconciliation` (migration 019, ADR-034) is NULL when one engine produced the text, so the page can never claim a second opinion that was not there; otherwise it holds the status (`reconciled` / `single_engine` / `skipped`), exact counts (differences, settled automatically, decided by the model, changed, uncertain, model errors) and up to 200 contested spots (each a position in seconds, both readings and which was used). The spots hold fragments of the private transcript, which is why they live in this RLS-scoped row. `had_video` (migration 018) records that the file carried a video track — a Teams meeting with the camera off is still a video file — so the page can say only its audio was used and the video was discarded. `endpoint` records which backend served it — `berget/...` means the audio left the
   homelab. The audio itself is never stored. `segments` keeps the timestamps (re-transcribing 90
   minutes costs ~7). Unlike `summary_actions`/`login_events` it **does** cascade on user deletion.
 - **LOGIN_EVENTS** (migration 010) — throttled one-row-per-(user, date) login stamp. Used by the