DL-336
The delivery consumer splits its DB role once each event carries an explicit ref.Tenant (OQ-3 part 1): the inherently cross-tenant background sweeps/drains keep WithSystemRole (BYPASSRLS), but per-event processing runs under store.WithTenant(baseCtx, ref.Tenant) for the MessageByID re-read and the whole onMessagePosted chain — and heldEntry gains a tenant field so the fireHeld re-read is tenant-scoped too. Fail-closed: a forged/corrupted ref whose row belongs to another tenant reads zero rows under RLS instead of cross-tenant-delivering under BYPASSRLS. Whole-loop system-role (ref.Tenant routing-only) rejected — forfeits the stamped ref’s isolation dividend
Status: Active (Matt, 2026-09-05)