Answers whether a candidate declaration would be admitted, and reports the rules it
would be admitted under. Writes nothing, reads nothing from the registry, and
contacts nothing over the network.

The candidate goes through the identical admission expression the real

declare runs, on a candidate built with the same DEPLOYMENT scope. That identity is
the point: a dry run that checked less than the real path is the recorded defect
where a configuration-time self-test passed green and the runtime failed at the
moment that mattered. A green verdict here means the declaration will succeed.

The reported derivedAudience is therefore the deployment

audience — the value a workload bound through this issuer will actually have to
present — and not a tenant-shaped one.

A refused candidate is still a 200. The verdict is the answer to the

question that was asked, not an error; the refusal reason travels in the body.
Whether the issuer can be REACHED is the separate test verb, which is
the one that opens a socket.

Never entitlement-gated. No Edition widens or narrows this plane. These are

the deployment operator's own declarations rather than a tenant's, so there is no
Edition to consult (FR-181.16).