A dry run. It answers whether this deployment would accept the declaration, and
reports the canonical issuer URL and the effective rules it would resolve to.

Nothing is written and nothing is contacted: no row, no DNS lookup, no discovery document, no key set. Whether the issuer is actually REACHABLE is the separate test verb, whose egress is why the platform gates it. Both verbs

nevertheless demand the same .test scope: the distinction drawn here is
about EGRESS, not about the scope assignment, and sharing the scope is the
conservative direction at the cost of an operator holding only .write
being unable to dry-run before declaring.

🔴 It runs exactly the admission the declaration runs — the same

expression, not an equivalent one. That is the recorded §117 defect stated in
reverse: there, a configuration-time self-test checked one endpoint while the
runtime path checked four, so a provider passed green and returned 503 at sign-in. A
green verdict here therefore means createTenantTrustedIssuer will
succeed, including the platform token-lifetime ceiling and the derived audience,
both of which are properties of this deployment rather than of the descriptor. The
visible consequence, stated rather than hidden: on a deployment with no public edge
base URL configured, this refuses too — truthfully, because the declaration would
not succeed either.

A refusal is a 200 carrying admitted: false and the

rule's own sentence, not a 400. The operator asked a question and got
an answer; a console renders the reason inline as they type. A body that is
structurally malformed — a missing required field, an unknown key — is still a
400, because that is not a candidate to have an opinion about.

Ungated. A tenant that has not bought the edition can still find out

whether its descriptor is well-formed before it does.