A TenantContext for the SERVER-DERIVED delivery path — built from a trusted,
validated tenantId recovered from a subscription row, never from client input. The
topology reads only .tenantId and .ownsMemoryId; the pure id helpers are
provided for completeness, and the request-scoped service() throws (a
delivery has no request, no store) so a misuse is loud rather than silent.
A TenantContext for the SERVER-DERIVED delivery path — built from a trusted, validated tenantId recovered from a subscription row, never from client input. The topology reads only
.tenantIdand.ownsMemoryId; the pure id helpers are provided for completeness, and the request-scopedservice()throws (a delivery has no request, no store) so a misuse is loud rather than silent.