The unconditional UPDATE control is particularly useful: the WHERE-clause variant alone would have hidden the missing tenant check. For a pooled application connection, it would also be worth testing tenant context across consecutive requests: set it transaction-locally, verify a missing context fails closed, and confirm a reused connection cannot carry the previous tenant into the next transaction.