Reports the entitlement verdict together with the required edition, this tenant's
effective edition, and resolution — HOW that effective edition was
arrived at.

resolution is required, not decorative. It lets the

console distinguish "your edition does not include this"
(LICENSED) from "we could not confirm your edition"
(FLOORED) — two states that route the operator to two different
people. On FLOORED the effective edition is the fail-closed floor and
the licence is never assumed upward.

FLOORED does not imply
entitled: false, and the two axes must be read separately. On a SaaS

deployment it does, because there the verdict IS the edition. On a
customer-operated deployment the verdict does not come from the edition at all
(see below), so a licence-read failure floors the REPORTED edition while
entitled stays true — the honest pair, since flooring

the verdict too would deny a plane that is not licence-gated on that deployment
class.

On a customer-operated deployment (private cloud, on-premise) the tenant is
entitled unconditionally and no edition gates this plane: the operator runs the
platform and owns the directory, and the edition-assignment endpoint is SaaS-only,
so gating here would be a lock with no key.

This READ is deliberately more forthcoming than the write refusal. It answers an
already-scoped, in-boundary tenant admin asking about their own tenant; the 403 on
declare answers a write attempt and never discloses a licence-read failure.

Required scope: admin.tenant.idp.override (existing — §136 introduces no scope).