@@ -4,6 +4,7 @@
 using System.Text;
 using LearnStack.Api.Common;
 using LearnStack.SharedKernel.Idempotency;
+using LearnStack.SharedKernel.Identifiers;
 using LearnStack.SharedKernel.Localization;
 using LearnStack.SharedKernel.Results;
 using LearnStack.SharedKernel.Tenancy;
@@ -197,11 +198,11 @@ [new LocalizedMessage("lockey_idempotency_key_invalid")],
             return;
         }
 
-        // Value once, here: IIdempotencyStore's key space is (Guid, string) and
-        // that port is not part of this conversion, so the seam is crossed at a
-        // single site rather than at each of its five call sites. Safe — the
-        // IsResolved gate above has already returned.
-        var tenantId = tenantContext.TenantId.Value;
+        // No unwrapping: the port's key space is (TenantId, string) as of Packet 7, which
+        // is what ADR-0037 § What we punted on promised when it said the raw Guid and
+        // ITenantContext.TenantId "both move together". The IsResolved gate above has
+        // already returned, so this id is a real one.
+        var tenantId = tenantContext.TenantId;
         var cancellationToken = context.HttpContext.RequestAborted;
         var fingerprint = await ComputeFingerprintAsync(context.HttpContext, cancellationToken)
             .ConfigureAwait(false);
@@ -266,7 +267,7 @@ await RunAndRecordAsync(context, next, tenantId, key, claim.Token, cancellationT
     private async Task RunAndRecordAsync(
         ResourceExecutingContext context,
         ResourceExecutionDelegate next,
-        Guid tenantId,
+        TenantId tenantId,
         string key,
         Guid token,
         CancellationToken cancellationToken)
@@ -387,7 +388,7 @@ private Outcome Classify(ResourceExecutedContext executed, HttpResponse response
         return Outcome.Record;
     }
 
-    private Task<bool> AbandonAsync(Guid tenantId, string key, Guid token) =>
+    private Task<bool> AbandonAsync(TenantId tenantId, string key, Guid token) =>
         store.AbandonAsync(tenantId, key, token, CancellationToken.None);
 
     /// <summary>
 
@@ -1,3 +1,4 @@
+using LearnStack.SharedKernel.Identifiers;
 using System.Collections.Concurrent;
 using LearnStack.SharedKernel.Idempotency;
 using LearnStack.SharedKernel.Time;
@@ -79,13 +80,13 @@ public sealed class InMemoryIdempotencyStore(IClock clock) : IIdempotencyStore
     /// </summary>
     public const int MaxEntriesPerTenant = 1_000;
 
-    private readonly ConcurrentDictionary<(Guid Tenant, string Key), Entry> _entries = new();
+    private readonly ConcurrentDictionary<(TenantId Tenant, string Key), Entry> _entries = new();
 
     private long _lastSweepTicks;
     private Census _census = Census.Empty;
 
     public Task<IdempotencyClaimResult> TryClaimAsync(
-        Guid tenantId, string key, string fingerprint, CancellationToken cancellationToken)
+        TenantId tenantId, string key, string fingerprint, CancellationToken cancellationToken)
     {
         Guard(tenantId, key);
         ArgumentNullException.ThrowIfNull(fingerprint);
@@ -141,7 +142,7 @@ public Task<IdempotencyClaimResult> TryClaimAsync(
     }
 
     public Task<bool> CompleteAsync(
-        Guid tenantId,
+        TenantId tenantId,
         string key,
         Guid token,
         IdempotentResponse? response,
@@ -176,7 +177,7 @@ current with
     }
 
     public Task<bool> AbandonAsync(
-        Guid tenantId, string key, Guid token, CancellationToken cancellationToken)
+        TenantId tenantId, string key, Guid token, CancellationToken cancellationToken)
     {
         Guard(tenantId, key);
 
@@ -186,23 +187,29 @@ public Task<bool> AbandonAsync(
         if (_entries.TryGetValue((tenantId, key), out var current) && current.Token == token)
         {
             return Task.FromResult(
-                _entries.TryRemove(new KeyValuePair<(Guid, string), Entry>((tenantId, key), current)));
+                _entries.TryRemove(new KeyValuePair<(TenantId, string), Entry>((tenantId, key), current)));
         }
 
         return Task.FromResult(false);
     }
 
-    private static void Guard(Guid tenantId, string key)
+    private static void Guard(TenantId tenantId, string key)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(key);
 
-        // The tenant is the key space. An empty one is not a tenant — it is a
-        // call site that forgot to scope, and accepting it would build exactly
-        // the flat space this store's contract exists to prevent.
-        if (tenantId == Guid.Empty)
+        // The tenant is the key space. An unassigned one is not a tenant — it is a call
+        // site that forgot to scope, and accepting it would build exactly the flat space
+        // this store's contract exists to prevent.
+        //
+        // IsInitialized() first: reading Value on an unset Vogen id throws from inside the
+        // id type, which is neither this guard's contract nor a message a caller can act
+        // on. Both sentinels are refused, because a struct nobody assigned and one
+        // assigned the all-zero Guid are the same mistake.
+        if (!tenantId.IsInitialized() || tenantId.Value == Guid.Empty)
         {
             throw new ArgumentException(
-                "An idempotency key is scoped to a tenant; Guid.Empty is not one.", nameof(tenantId));
+                "An idempotency key is scoped to a tenant; an unassigned id is not one.",
+                nameof(tenantId));
         }
     }
 
@@ -238,7 +245,7 @@ private void Sweep(DateTimeOffset now)
             return;
         }
 
-        var counts = new Dictionary<Guid, int>();
+        var counts = new Dictionary<TenantId, int>();
         var total = 0;
 
         foreach (var pair in _entries)
@@ -274,11 +281,11 @@ private void Sweep(DateTimeOffset now)
     /// claims — a soft ceiling, which is what a ceiling that must never evict a
     /// live record has to be.
     /// </remarks>
-    private sealed record Census(IReadOnlyDictionary<Guid, int> PerTenant, int Total)
+    private sealed record Census(IReadOnlyDictionary<TenantId, int> PerTenant, int Total)
     {
-        public static readonly Census Empty = new(new Dictionary<Guid, int>(), 0);
+        public static readonly Census Empty = new(new Dictionary<TenantId, int>(), 0);
 
-        public bool IsFull(Guid tenantId) =>
+        public bool IsFull(TenantId tenantId) =>
             Total >= MaxEntries || PerTenant.GetValueOrDefault(tenantId) >= MaxEntriesPerTenant;
     }
 
 
@@ -1,3 +1,4 @@
+using LearnStack.SharedKernel.Identifiers;
 namespace LearnStack.SharedKernel.Idempotency;
 
 /// <summary>
@@ -121,7 +122,7 @@ public interface IIdempotencyStore
     /// </param>
     /// <param name="cancellationToken">Cancellation.</param>
     Task<IdempotencyClaimResult> TryClaimAsync(
-        Guid tenantId,
+        TenantId tenantId,
         string key,
         string fingerprint,
         CancellationToken cancellationToken);
@@ -144,7 +145,7 @@ Task<IdempotencyClaimResult> TryClaimAsync(
     /// silence.
     /// </returns>
     Task<bool> CompleteAsync(
-        Guid tenantId,
+        TenantId tenantId,
         string key,
         Guid token,
         IdempotentResponse? response,
@@ -162,5 +163,5 @@ Task<bool> CompleteAsync(
     /// </remarks>
     /// <returns><c>true</c> when the key was released by this caller.</returns>
     Task<bool> AbandonAsync(
-        Guid tenantId, string key, Guid token, CancellationToken cancellationToken);
+        TenantId tenantId, string key, Guid token, CancellationToken cancellationToken);
 }
@@ -343,7 +343,11 @@ INSERT INTO tenant_settings
     }
 
     /// <summary>The registry-assigned actor; every seeded row is attributed to it.</summary>
-    private static readonly Guid Actor = Guid.Parse("00000000-0000-7000-8000-000000000001");
+    /// <remarks>
+    /// Read from <see cref="UserId.SystemActor"/> rather than repeating the literal. The
+    /// value already has a home, and a second copy is a second thing to keep true.
+    /// </remarks>
+    private static readonly Guid Actor = UserId.SystemActor.Value;
 
     /// <summary>A client whose requests arrive on <paramref name="host"/>.</summary>
     /// <remarks>
@@ -437,6 +441,12 @@ public sealed record ForeignWriteRequest(Guid TenantId);
 }
 
 /// <summary>What the probe reads.</summary>
+/// <remarks>
+/// The unresolved-context read is a separate request type rather than a third member here,
+/// and the asymmetry is deliberate: what distinguishes it is not which rows it wants but
+/// which marker it carries, and a marker is a property of the type. Folding it in would
+/// mean one request type wearing two ceilings.
+/// </remarks>
 public enum ProbeSubject
 {
     Organizations,
@@ -558,8 +568,7 @@ INSERT INTO tenant_settings
             VALUES (uuidv7(), @tenant, NULL, 'smuggled', '"x"', now(), @actor, 0)
             """;
         command.Parameters.AddWithValue("tenant", request.TenantId);
-        command.Parameters.AddWithValue(
-            "actor", Guid.Parse("00000000-0000-7000-8000-000000000001"));
+        command.Parameters.AddWithValue("actor", UserId.SystemActor.Value);
 
         try
         {
 
@@ -1,3 +1,4 @@
+using System.Data.Common;
 using FluentAssertions;
 using LearnStack.Api.Composition;
 using LearnStack.Application.Pipeline;
@@ -946,6 +947,63 @@ await unitOfWork.SetTenantContextAsync(
         }
     }
 
+    [Fact]
+    public async Task A_reset_tenant_context_reads_nothing_rather_than_everything()
+    {
+        // The case the Phase Exit Decision names: a read with `app.tenant_id` RESET
+        // rather than merely unset. The distinction is the whole reason the policies are
+        // written with NULLIF.
+        //
+        // Never-set and reset are different values. `current_setting(name, true)` returns
+        // NULL for a variable that was never set, and the EMPTY STRING for one that was
+        // set and then reset — which is the state a pooled connection is in after
+        // DISCARD ALL, and the state every request leaves behind. `''::uuid` raises
+        // 22P02, so a policy that cast without NULLIF would not filter: it would error
+        // on the first read of every reused connection. With NULLIF the empty string
+        // becomes NULL, the predicate is NULL, and NULL is false for both USING and
+        // WITH CHECK — the table returns nothing.
+        //
+        // Driven on one physical connection, because that is the only way the two states
+        // are distinguishable: set a real tenant, observe rows, reset, observe none.
+        var builder = new NpgsqlDataSourceBuilder(_schema.Postgres.AppConnectionString);
+        builder.ConnectionStringBuilder.MaxPoolSize = 1;
+        builder.ConnectionStringBuilder.NoResetOnClose = true;
+        await using var dataSource = builder.Build();
+
+        await using var connection = await dataSource.OpenConnectionAsync();
+
+        await ExecuteOnAsync(connection,
+            $"SELECT set_config('app.tenant_id', '{SchemaFixture.TenantA}', false)");
+
+        (await ScalarOnAsync(connection, "SELECT count(*) FROM organizations"))
+            .Should().NotBe("0", "the tenant is set, so its rows are visible");
+
+        // RESET, not "never set" — the variable exists and now holds ''.
+        await ExecuteOnAsync(connection, "RESET app.tenant_id");
+
+        (await ScalarOnAsync(connection, "SELECT current_setting('app.tenant_id', true)"))
+            .Should().BeEmpty(
+                "a reset GUC reads back as the empty string, which is exactly the value "
+                + "NULLIF exists to turn into NULL");
+
+        (await ScalarOnAsync(connection, "SELECT count(*) FROM organizations"))
+            .Should().Be("0",
+                "and the read fails closed — it returns nothing rather than everything, "
+                + "and does not raise 22P02 on the way");
+    }
+
+    private static async Task ExecuteOnAsync(DbConnection connection, string sql)
+    {
+        await using var command = new NpgsqlCommand(sql, (NpgsqlConnection)connection);
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static async Task<string?> ScalarOnAsync(DbConnection connection, string sql)
+    {
+        await using var command = new NpgsqlCommand(sql, (NpgsqlConnection)connection);
+        return (await command.ExecuteScalarAsync())?.ToString();
+    }
+
     // ── Helpers ──────────────────────────────────────────────────────────────
 
     private ServiceProvider BuildProvider(NpgsqlDataSource? dataSource = null)
 
@@ -1,6 +1,7 @@
 using FluentAssertions;
 using LearnStack.Infrastructure.Idempotency;
 using LearnStack.SharedKernel.Idempotency;
+using LearnStack.SharedKernel.Identifiers;
 using LearnStack.SharedKernel.Time;
 using Xunit;
 
@@ -22,8 +23,14 @@ public sealed class InMemoryIdempotencyStoreTests
     private static readonly DateTimeOffset Origin =
         new(2026, 8, 20, 9, 0, 0, TimeSpan.Zero);
 
-    private static readonly Guid Tenant = Guid.Parse("018f4d40-0000-7000-8000-00000000000a");
-    private static readonly Guid OtherTenant = Guid.Parse("018f4d40-0000-7000-8000-00000000000b");
+    // Typed, as of Packet 7: the port's key space is (TenantId, string), which is what
+    // ADR-0037 promised when it said the raw Guid and ITenantContext.TenantId "both move
+    // together". A raw Guid no longer compiles here, which is the point of the change.
+    private static readonly TenantId Tenant =
+        TenantId.From(Guid.Parse("018f4d40-0000-7000-8000-00000000000a"));
+
+    private static readonly TenantId OtherTenant =
+        TenantId.From(Guid.Parse("018f4d40-0000-7000-8000-00000000000b"));
 
     private const string Key = "01HXIDEMPOTENT0001";
     private const string Fingerprint = "fingerprint-a";
@@ -94,10 +101,19 @@ public async Task An_Unscoped_Tenant_Is_Refused()
     {
         var (store, _) = NewStore();
 
-        var claim = async () => await store.TryClaimAsync(Guid.Empty, Key, Fingerprint, default);
+        // default(TenantId) does not compile — Vogen's VOG009 analyzer prohibits it — so
+        // the unassigned value comes from an array element, which the analyzer cannot see
+        // and the runtime leaves zeroed. That is also how one reaches production: a struct
+        // field nobody assigned, a default(T) in a generic, a deserializer that skipped a
+        // member. Typing the port did not remove this guard's job; it changed the shape of
+        // the sentinel it has to refuse.
+        var slot = new TenantId[1];
+        var unassigned = slot[0];
+
+        var claim = async () => await store.TryClaimAsync(unassigned, Key, Fingerprint, default);
 
         await claim.Should().ThrowAsync<ArgumentException>(
-            "Guid.Empty is not a tenant — it is a call site that forgot to scope");
+            "an unassigned id is not a tenant — it is a call site that forgot to scope");
     }
 
     // ---- fingerprint -------------------------------------------------------
 
@@ -568,6 +568,37 @@ Neither changes what this ADR decides. `PostgresIdempotencyStore` does not exist
 yet — it is demand-gated on the trigger Amendment 1 names — so both land while the
 table has no rows and the constraint validates instantly.
 
+### Amendment 4 — the port takes `TenantId`, one packet later than promised (2026-09-03)
+
+§ What we punted on said of the raw `Guid` tenant: "The strongly-typed `TenantId`
+lands with the tenancy schema in Packet 6, **and both move together**." They did
+not. Packet 6 typed `ITenantContext.TenantId`; `IIdempotencyStore` kept the raw
+`Guid` through Packet 6 and most of Packet 7, and `IdempotentAttribute` carried a
+comment naming the seam it crossed at a single call site. Nothing recorded the
+divergence, which is how a promise like this is usually discovered — three packets
+later, by someone who trusted it.
+
+**What ships.** `TryClaimAsync`, `CompleteAsync` and `AbandonAsync` take
+`TenantId`; the store's internal key becomes `(TenantId, string)` and its census
+`Dictionary<TenantId, int>`. The single unwrapping site in `IdempotentAttribute`
+is gone, so the port is now what [Standards 02](../standards/02-backend-coding.md)
+requires of a public surface rather than the exception the original text
+acknowledged.
+
+**What changed in the guard, and why it is not cosmetic.** The refusal was
+`tenantId == Guid.Empty`. A typed id has two ways to be unassigned — a Vogen value
+nobody constructed, and one constructed from the all-zero `Guid` — and reading
+`.Value` on the first throws from inside the id type, which is neither this
+guard's contract nor a message a caller can act on. The guard now tests
+`IsInitialized()` first and both sentinels after, matching `AuditInput.EnsureValid`
+and `NpgsqlUnitOfWork`'s setter. Its test drives the unassigned value from an array
+element, because `default(TenantId)` does not compile — Vogen's VOG009 analyzer
+prohibits it — and an array slot is also how the value reaches production.
+
+**What did not change.** The key space, the contract's states, the fingerprint
+rule, and Amendment 1's gating of the durable store. This is the type of one
+parameter, not a change to what the port does.
+
 ## References
 
 - [ADR-0035: Demand-Gated Infrastructure](0035-demand-gated-infrastructure.md)