Every cross-tenant read in background jobs and services was audited and given an explicit, logged justification; state transitions re-check their status after taking the row lock; and error reporting is throttled so a burst cannot hide a real incident.