Gap: cross-tenant access is untested. Add actor tenant A + record tenant B and assert denial with no mutation. This test should kill the surviving equality-removal mutant.
