#1015 Tenant-reachable tools: unverified static findings from the #1005 tools.* sweep

STATIC claims from a read-only subagent sweep during #1005. None reproduced; each needs a live repro before fixing. (1) enterprise/tools/datashard_logger_write.py ~306-308 _cleanup_workflow_state: WHERE ... AND state_value ? 'stdout' OR state_value ? 'stderr' has no parentheses, so the UPDATE may hit every workflow_state row with a stderr key across all tenants. It runs on an unscoped connection, and tenant_id/original_workflow_run_id are taken from tool params (line ~170-173). datashard_logger_base.py _get_partitioned_path interpolates tenant_id into a path (traversal). (2) engine/tools/database/pool.py _get_pool_key = host:port/db:user, with no password and no tenant; pools are process-global, so another tenant's open pool may be reused without the password. (3) tools.http.request allow_internal is a tenant argument that disables the SSRF check, and redirects are not re-validated per hop. Agent dispatch (agent_react.py ~357, multi_agent_leaf.py ~316) lets LLM args override fixed kwargs such as allow_internal=False, and falls back to raw registry names for unknown functions (name_map.get(fname, fname)). (4) durable_cron schedule_id uuid5(job:target:cron) and the dedup query ignore tenant, so one tenant can overwrite or stop another tenant's schedule; target_queue may be highway_internal, and the same applies to scriptplan.scheduler. (5) POST /workflows accepts queue=highway_internal from tenants (validate_queue_name checks only a regex). (6) Test and demo primitives are tenant-callable: tools.long_running.* (unbounded worker hold), tools.chaos.mark (global table), tools.testing.*, tools.workflow.execute_and_emit and execute_branch (inline definitions). Since #1005 the internal.* escalations via (3), (4) and (6) fail at execution; the other effects remain.