Pin that an organization the resolver cannot load is UNKNOWN and refused (SP97 T12)

Shipped

October 11, 2026 at 2:48 PM UTC

Author

Kamo

Commit

bffb6b4

PhiTenantResolver had no test of its own. The SI router (OrgPhiStatusCache) and the Tool Plane (OrgFactsService) read every org's PHI status through it, so a missing row read as NOT_PHI would open every cloud model and tool to an unclassified tenant.