Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Return-rate SQL groups by SKU without tenant_id; order-rate stage joins by order_id alone; final tenant MERGE cannot undo pooled inputs [R8]. Finding is from generated-SQL inspection, not BigQuery execution. Files: services/net-yield/compute.py, bq.py, test_compute.py. Fix: carry tenant_id through every CTE, join, group-by, and maturity window. Acceptance: two-tenant invariance test against a real BigQuery test dataset: replacing tenant B's rows changes nothing in tenant A's output. Generated SQL snapshot test asserts tenant_id in every GROUP BY / JOIN ON. Depends on: WO-00.