Reaches the issuer once, through the same transport the authentication path uses, and reports a PARTITION of the runtime checks: the ones it exercised and the ones it could not. Without a sample token every runtime check is reported as not exercised and the verdict is REACHABLE_UNVERIFIED, which is deliberately not a green — reachability is not authentication. Supply a token the issuer minted to exercise the rest; it is evaluated and discarded. Nothing about the declaration's trust state changes on either outcome.

Entitlement-gated. It is the only verb on this surface that leaves the deployment, and egress on a tenant's behalf is a capability the edition sells. Asked AFTER the tenant boundary and BEFORE any socket, so an unentitled caller never causes a packet.