isolation belongs to the storage boundary

Serving many independent businesses from one store gives you a choice about where isolation lives. It can live in every query, politely: each read filters for the business it is serving. That works exactly as long as every author, on every surface, forever, remembers. The alternative is to move the requirement into the storage boundary and let the store refuse.

The change did the second thing. The columns that identify the owning business became mandatory, and uniqueness became per business, which overnight made a filterless write impossible to ship. Then came the interesting part. Every staff-side write path broke at once, loudly, because not one of the insert helpers had ever named the business it was writing for. Rejections, en masse, and not one silent cross-business write. That is the whole point of the move — the failure mode changed from wrong data discovered later to no data discovered now.

The cheap fix was available: relax the constraint until the writes went through. It was refused. Instead every write path took an explicit resolver, and every case where the business could not be resolved became a rejection rather than a guess. Seeding resolves deliberately or skips noisily. And the contract tests now create their own business instead of sharing one, so a test can no longer pass by leaning on rows another test left behind.

The cost is real: a required parameter threaded through every writer, and a review of every path that had quietly been global.

What it proves: the team will choose an impossible write over an ambiguous one.