Exactly - "invisible until a second tenant" is what makes it so dangerous: the test suite is green because it only ever runs against one tenant's data. You've drawn the layering the way I'd argue for it too - ragmoat catches the structural case (a missing filter) at build time, cheaply and with zero infra, but it can't reason about behavior. A cross-tenant recall eval in CI is the other half: it catches the cases the static pass can't see - a filter on the wrong field that still clears RM001, a home-grown retriever ragmoat doesn't recognize, dynamically-built SQL. Static gate for the shape, eval for the truth. Thanks for sharing the write-up - a concrete CI recipe for the eval side is exactly what this needs, and I'll point people to it.