Per-user-isolated entities (no global cross-tenant video table per the S5/grill correction), secrets stored by reference only (ESO/1Password, never the token), brain delivery modelled as a sink_delivery row rather than brain-specific tables. fallback_used recorded per summary as the Stage 0 quality signal. Future C dedup and sharding explicitly out of scope.