CLAUDE.md

@@ -100,7 +100,7 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
 - Adapters present under `internal/adapters/`: `youtube` (captions-first `VideoSource`,
   timedtext/InnerTube acquisition per ADR-010), `summarizer` + `llm` (the copied AI router,
   now a resilient endpoint chain — local primary → local fallback → external worst-case,
-  parse-failure-aware, ADR-004 + ADR-022), `store` (Postgres, golang-migrate migrations 001–017),
+  parse-failure-aware, ADR-004 + ADR-022), `store` (Postgres, golang-migrate migrations 001–019),
   `secrets` (file-backed `SecretStore`). The brain HTTP sink (ADR-005) is the remaining
   optional sink.
 - Stage 1 is open (ADR-012): multi-user with **DB-enforced** isolation — Postgres RLS `FORCE`d
@@ -118,6 +118,11 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
   in `uploaded_transcripts`; the audio is never retained; chat reuses `chat.Service`. The
   isolation test pins the **exact set** of non-RLS tables (`TestRowSecurityOffTablesAreExactlyTheKnownSet`).
   The runtime image does not yet contain ffmpeg — that is a pending decision recorded in ADR-033.
+  Two-engine reconciliation (ADR-034, migration 019, off unless `TAPIR_RECONCILE_BASE_MODEL`):
+  `internal/reconcile` (word diff, disputes, a local-model adjudicator) and
+  `transcribe.Ensemble`; every model must be a local alias, enforced at start-up.
+  **Lint caveat:** `task check` does not fail on lint (#41: the Taskfile `|| echo` swallows
+  findings) — run `golangci-lint run ./...` yourself until that is fixed.
 - `cmd/tapir` subcommands: `list`, `show`, `auth` (interactive host-side OAuth), `run` (batch
   watch→summarize), `serve` (the HTMX+Templ web reader/writer under `internal/web`, a new
   transport over the unchanged engine/ports — ADR-003). `tapir env` prints config.