Reaches the issuer once, through the same transport the authentication path uses, and reports a PARTITION of the runtime checks: the ones it exercised and the ones it could not. Without a sample token every runtime check is reported as not exercised and the verdict is REACHABLE_UNVERIFIED, which is deliberately not a green — reachability is not authentication. Supply a token the issuer minted to exercise the rest; it is evaluated and discarded. Nothing about the declaration's trust state changes on either outcome.

Not entitlement-gated. The operator is the party that sells the edition, so refusing them on it would be the platform refusing itself. The tenant's own verdict is readable at ../workload-identity/entitlement (SR-10.6).