docs: revise Stage 0 gate to "useful to me or a friend" (behavioural)

Replaces the original "useful to me, specifically" gate with "me OR a friend
returns unprompted in >=2 separate weeks" — friendly-user signal counts, but the
test stays behavioural (return usage) not feedback-based, to resist politeness
bias. Folds the old Stage 1 ("a trusted user returns") into the new Stage 0 (they
were near-identical), renumbers hardening to Stage 1, and updates the drift
signals (the gate can be softened by mistaking polite feedback for evidence;
multi-user shipping ahead of the gate was a recorded exception per ADR-012, not a
precedent). Rationale recorded in ADR-016.

VISION.md

@@ -44,50 +44,54 @@ fallback — their key, their choice.
 
 ## Who it is for
 
-- **Now (the first customer):** the maintainer — one person, their own subscriptions,
+- **Now (the first customers):** the maintainer and a small number of known, trusted
-  summaries delivered to their own store and brain.
+  friends — each with their own account, isolated data, optional BYO-AI. The maintainer is
-- **Soon (Future B):** a small number of known, trusted users (friends / beta) — each with
+  the first customer; friendly users provide the earliest real-world signal.
-  their own account, isolated data, optional BYO-AI.
 - **Maybe (Future C, explicitly not built yet):** a public multi-tenant service. Deferred
-  until there is evidence of sustained personal use **and** real demand. Building for C
+  until there is evidence of sustained use **and** real demand. Building for C before that
-  before that evidence is a known anti-goal.
+  evidence is a known anti-goal.
 
 ## Definition of Success
 
 Success is staged. Each stage has a single, falsifiable headline test. We do not advance
 to the next stage's ambition until the current stage's test passes.
 
-### Stage 0 — Useful to me (the gate)
+### Stage 0 — Useful to me or a friend (the gate)
 
-> **Headline test:** For four consecutive weeks, the maintainer reads Tapir-produced
+> **Headline test:** Over a 3–4 week window, *either* the maintainer *or* at least one
-> summaries for their own subscriptions at least weekly, and at least once acts on a
+> onboarded friend returns to Tapir **unprompted** and reads/acts on summaries in **≥2
-> summary (watches / skips / saves a video *because of* the summary).
+> separate weeks**. The test is *return usage* (behavioural), not stated approval.
 
-- Captions-first summarization works end-to-end for the maintainer's real subscriptions.
+- Captions-first summarization works end-to-end for real subscriptions (the maintainer's
-- Summaries land in the maintainer's store and (optionally) brain.
+  and onboarded friends').
+- Summaries land in each user's own store and (optionally) brain.
 - Local-first AI produces summaries of acceptable quality without manual intervention
   most of the time.
-- **This is the gate.** Multi-user, BYO-AI-for-others, and any SaaS ambition stay deferred
+- **Why behavioural, not feedback.** Friend *feedback* is gathered and genuinely valuable —
-  until Stage 0 holds. (Ties to the 2026-07-01 self-use check-in.)
+  but it is **not** the gate. Asked-for feedback from friendly users is the least reliable
+  signal in product development (politeness bias); whether they *come back on their own* is
+  the thing we actually care about. So the gate measures returns, not nice words.
+- **Why "me OR a friend".** This replaces the original "useful to *me*, specifically" gate
+  (2026-06-03 decision, recorded in DECISIONS.md ADR-016). Getting signal from friendly
+  users is valuable enough to count — but the bar stays behavioural so it can't be cleared
+  by a polite reaction. (Ties to the 2026-07-01 check-in.)
+- **This is the gate.** Hardening (Stage 1) and any SaaS ambition stay deferred until this
+  behavioural signal exists. Note: multi-user machinery was deliberately built *ahead* of
+  this gate (ADR-012) with isolation enforced — that was an explicit, recorded call, not a
+  sign the gate had passed. The gate is about *evidence of use*, which is still open.
 
-### Stage 1 — Useful to a few (Future B)
+### Stage 1 — Trustworthy at rest (hardening, Future B)
-
-> **Headline test:** At least one trusted user other than the maintainer connects their
-> own account and, within their first month, keeps using it (returns to read summaries in
-> ≥2 separate weeks) without the maintainer hand-holding each summary.
-
-- Multiple users, each with isolated accounts, credentials, and summaries.
-- A new user can self-connect a YouTube/Vimeo account and get summaries with no code change.
-- Optional BYO-AI works per-user.
-- No cross-user data leakage — demonstrable, not assumed.
-
-### Stage 2 — Trustworthy at rest (hardening, still Future B)
 
 > **Headline test:** Credentials (OAuth tokens, BYO-AI keys) are encrypted at rest via the
 > homelab's existing secrets convention; a documented, rehearsed recovery path exists; and
 > a deliberate isolation test (user A cannot read user B's data) passes in CI or a
 > documented manual drill.
 
+- Per-user data isolation is enforced and tested (delivered early via ADR-012 RLS).
+- Per-user credentials are encrypted at rest (ADR-015 envelope encryption; build in infra#89).
+- A new user can self-connect a YouTube/Vimeo account and get summaries with no code change.
+- Optional BYO-AI works per-user.
+
 ### Non-goals (current)
 
 - Public sign-up / billing / a marketing surface.
@@ -98,7 +102,11 @@ to the next stage's ambition until the current stage's test passes.
 
 ## How we will know we are drifting
 
-- We are building Stage 1+ machinery before the Stage 0 gate has passed.
+- We declare the Stage 0 gate "passed" on the strength of polite feedback rather than
+  behavioural return-usage (the politeness-bias trap the gate is designed to resist).
+- We build Stage 1 hardening or Future C machinery while the Stage 0 use-evidence is still
+  absent. (Multi-user machinery already shipped ahead of the gate via ADR-012 — a recorded,
+  deliberate exception, not a precedent for more.)
 - A user's content reaches a third-party model without that user's explicit, per-user opt-in.
 - "Brain ingestion" starts dictating the architecture instead of being one sink behind an
   interface.