The gateway's reaches applies only the declared half of accounts' readiness rule; accounts should publish the derived reached set on a read the gateway makes #1286

From #1285: reaches on the registry snapshot lists the modules a record's manifest invokes on the viewer's behalf (declared half). Accounts' readiness rule (installation_readiness.go readinessFor) also requires the binding to be in grant.OperationAudiences (the request narrowed by the module envelopes); that derived registry lives only in accounts, so the gateway cannot apply it and a page can be told it reaches a module whose calls an envelope withheld (the module then refuses with its reason; readiness reports the binding as omitted). Fix at the owner: accounts publishes the derived reached set on a read the gateway already makes (one field on an existing answer), and the gateway builds reaches from it.

🤖 Generated with Claude Code