The tenant a token claims, before its signature can be checked

The tenant a token claims, before its signature can be checked Delivery cannot scope its reads from the verified claim alone, because for connector-signed tokens the lookup and the verification are circular: the token names a connector, `connectors` is a tenant table, and the connector's own secret is what verifies the token — so the tenant must be known before the signature can be checked, and the tenant is inside the signature. `key_id_of` already solved the same shape for the same reason, and its doc explains why reading an unverified field is unavoidable rather than sloppy: verification needs a key before it can decide anything, and naming the wrong key produces a signature that does not match. The tenant is the same argument — naming the wrong one finds either no connector or one whose secret does not verify. So `tenant_id_of` sits beside it with the reasoning spelled out, including the part that matters more than the function: the value must not survive verification. It scopes one lookup, and everything after reads the tenant from the verified claim.