X_JOB_TENANT_REQUIRED

the job declares no tenant

the field was omitted — normally a compile error, checked again at declaration, and reached through backfill() too, which forwards its tenant to job() verbatim. A job body runs with no request behind it, and @ultimat3/entity's tenant guard derives from the ambient context, so a job that declared nothing ran with no tenant at all: a row naming another org was refused over HTTP as X_TENANCY_ACTOR_MISMATCH and accepted through the queue. A boot-supplied service actor would close the same hole with one identity for every job, which is the cross-tenant read the declaration exists to prevent. 'none' declares no org either way, but it reads differently on each side of the factory: on a job() it means the body touches no tenant-scoped table, because every scoped read then fails closed as X_TENANCY_ACTOR_ORG_REQUIRED; on a backfill() it is how a sweep says it spans every tenant, and the pass — never the author — opens the cross-tenant scope for it

add tenant: (input) => input.orgId to the job; use tenant: 'none' for a job that touches no tenant-scoped table, or for a backfill() that sweeps every tenant