fix: expose safe organization lookup error codes in session responses

tests/org-context.test.js

@@ -180,11 +180,35 @@ test('upstream failure preserves existing profile and emits only a safe error co
   try {
     const result = await enrichUserOrganization(user, env(), { fetchImpl: async () => { throw new Error('Secret header: private-contact'); } });
     assert.equal(result.orgContextStatus, 'unavailable');
+    assert.equal(result.orgContextError, 'org_context_request_failed');
     assert.equal(result.company, user.company);
     assert.deepEqual(logs, [['org_context_request_failed']]);
   } finally { console.error = saved; }
 });
 
+test('error diagnostics reject arbitrary upstream messages even when prefixed with org_context', async () => {
+  const original = console.error;
+  const logs = [];
+  console.error = (...args) => logs.push(args);
+  try {
+    const result = await enrichUserOrganization(user, env(), { fetchImpl: async () => {
+      throw new Error('org_context_private_header_fixture_secret');
+    } });
+    assert.equal(result.orgContextStatus, 'unavailable');
+    assert.equal(result.orgContextError, 'org_context_unavailable');
+    assert.deepEqual(logs, [['org_context_unavailable']]);
+    assert.ok(!JSON.stringify(result).includes('fixture_secret'));
+  } finally { console.error = original; }
+});
+
+test('successful organization resolution clears previous failure diagnostics', async () => {
+  const result = await enrichUserOrganization({ ...user, orgContextStatus: 'unavailable', orgContextError: 'org_context_timeout' }, env(), { fetchImpl: async () => response(payload()) });
+  assert.equal(result.orgContextStatus, 'resolved');
+  assert.equal(result.company, '실제 회사');
+  assert.equal(result.department, '설계부');
+  assert.equal(result.orgContextError, undefined);
+});
+
 test('a failing root is not accepted as a partial complete directory', async () => {
   const config = env({ ORG_CONTEXT_TENANT_IDS: JSON.stringify([ROOT, OTHER]) });
   await assert.rejects(getOrgDirectory(config, { fetchImpl: async (url) => {