- Shipped
- November 15, 2026 at 6:38 AM UTC
- Author
- Kamo
- Commit
- 9faaaf7
OrgHostResolver.resolveByDomain **************** host → org, and recovery's mailbox/work-address scope) checked active rows but not ownership_verified, with an unordered LIMIT 1 — so on a domain several organizations NAME, the credential check could pick an org that merely typed it in while the unknown-host gate (OrgResolutionService.byHost: verified only) had admitted the request for the verified owner. Now the same predicate and order as OrgResolutionService.byDomain. No sign-in moves: the gate already refuses a host whose only row is unverified, so this path only ever saw hosts with a verified owner.