pinnedTenant

The one tenant every record query matches belongs to, or null when its filter does not pin one. Its filter pins a tenant when it requires a TenantIdFilter: alone, or among the operands of an AND (at any depth of ANDs), as admission ANDs a caller's scope, all of one value. Any other shape (an OR, a NOT, several values) pins none, so a trusted cross-tenant query is never read as one tenant's. A backend whose order breaks ties by the tenant reads that key as a constant under a pinned tenant: it orders nothing and bounds nothing.