Each broker is kept apart
- Every broker runs on its own deployment with its own database, on its own domain.
- Brokers never share a table. No query path runs from one broker's data to another's.
- One codebase runs every broker, and fixes reach each broker as a tested update.