-
resolveFk had no sBrandsId predicate, so a staged create/update could bind another tenant's customer/product sId into this tenant's document (and doubled as a cross-tenant existence oracle). Tables without a tenant column stay global. docs/audit-agent-main-20260728.md is the external audit this and the previous commit answer.
