W6 — Multi-tenancy and installation ceilings

[phall1]

Per-installation isolation in the event log, resource ceilings, and noisy-neighbour containment.

Designed in from M0b even while single-tenant. Concretely that means: no repo-scoped global state, no single-tenant assumptions in the event log, and per-installation ceilings present in the schema even when there is exactly one installation. Retrofitting tenancy into an event log is the kind of migration that eats a quarter.

Exit criteria

• Two installations on one control plane cannot observe each other
• Two installations cannot starve each other
• Ceilings are enforced and every enforcement is logged

Gates Bar D and the hosted commercial end state. See docs/END-STATE.md §1 and §4 W6.

[linear-code]

PHA-305