Fail-closed gate for tenant-scoped routes (global-tenancy §9.3 / FR-5, seed of the
data-isolation boundary). It only asserts that an active tenant has been resolved for
the request (by TenantIsolationMiddleware into AsyncLocalStorage); the actual row filtering is
enforced centrally in the repository adapter, so no handler scatters where tenant_id
by hand.
租户作用域路由的 fail-closed 闸门（global-tenancy §9.3 / FR-5·数据隔离边界种子）。
Remarks
Fail-closed gate for tenant-scoped routes (global-tenancy §9.3 / FR-5, seed of the data-isolation boundary). It only asserts that an active tenant has been resolved for the request (by
TenantIsolationMiddlewareinto AsyncLocalStorage); the actual row filtering is enforced centrally in the repository adapter, so no handler scatterswhere tenant_idby hand.S11 · 高危#4 复合全局：本守卫经
TenantIsolationModule注册为全局APP_GUARD（deny-by-default 租户墙）， 运行于全局会话墙之后（AppModule中AuthModule先于TenantIsolationModule→ 401 先于 403）。所有 路由默认要求已绑定 active 租户；唯显式旁路可豁免：@Public()（无会话=无租户·认证面/webhook） 或@TenantIsolationExempt()（需会话但合法无租户·建租申请/跨租治理/个人 PIPL/用户级 storage·payment）。 元数据经Reflector.getAllAndOverride读回（handler 优先 class·同AuthorizationGuard口径）。 逐路由@UseGuards(TenantIsolationGuard)仍可与全局并存（幂等·无短路冲突）。