The new error code is fully wired through the request/response and terminate-reason enums, but at present it surfaces only on initial-request failures. Mid-session token rotations that hit the org-disabled response still get classified as a generic authentication_failed. Expect mid-session detection to follow.
Evidence
Enum expansion only (search for "oauth_org_not_allowed" in the enum but not in the in-flight refresh paths).
Strings lifted out of the shipped bundle, so the claim above can be checked against them.