Tenants with nobody holding the owner realm role — plus any whose status could not be established.

An ownerless tenant is operationally indistinguishable from a healthy one: require_owner assumes an owner exists, gate.check_access grants setup mode only to an owner, and the stalled report resolves its contact column the same way. So a licensed tenant without one has a setup wizard nobody can reach and a report with no address, and nothing anywhere says so (SSO-24).

Rows whose status is unknown are included on purpose: during a Keycloak outage the honest answer is "could not check", and hiding those would make a quiet report look like a clean one.