Exact-record canaries when a legacy tool lacks a tenant filter
A destructive workflow that lacks a tenant or entity filter can still be previewed safely only when its ordering and cursor semantics permit exact-record isolation: resolve the target record from authoritative relational ownership, find its immediate predecessor under the tool’s …