[gael-obin]

A collection reader can read content directly but cannot use that same read standing in a consuming module's delegated request. This fix adds an explicit read-only mode to existing installed operation bindings. The host admits the person's bounded parent through that binding and exchanges it into an authentic Core child; existing human grants still decide which records are readable.

Classification: owner fix. Reuses Core Child attenuation, the current node-permission resolver, installed module authority and witnessed envelope updates. Binding identity includes existing monotonic envelope, manifest and installation lifetimes, so withdrawing and restoring identical policy cannot revive an old child. Existing actor/source/headless parents, reference exchanges and child remint/renewal cannot bypass this boundary. Ordinary bindings retain their current behavior.

Validation: failing-before/passing-after owner regressions; affected adapter/business race suites; real PostgreSQL lifecycle tests through signed delivery, envelope writes, installation changes and served authority/read checks. Independent platform review found and closed actor-parent and reference-arm bypasses. The final mode-removal regression distinguishes revoked authority from an outage.

Qualification limit: the native composition intentionally has no policy-log witness, so its existing envelope cannot migrate to this restrictive mode. The attempted public update refuses and leaves the revision unchanged. Full live delegated evidence and subsequent live revocation are not qualified by this PR. The supported witness/client/composition owner work must be available before installation; no private database edit or local witness substitute is included.

Concrete activation dependency: the existing witness client supports mesh/in-cluster transport, not native local admission. The native composition needs an owner-supported transport and independently provisioned durable witness, plus the client safety corrections. Supported grant/binding revocation needs that same witness even without this mode migration. An ambiguous append can leave the persistent host refusing service until authorized recovery; recovery absence is an availability gap, distinct from unsafe chain/head/configuration-loss behavior. No native infrastructure, recovery protocol or migration is added by this PR.

Supersedes the broader earlier candidate; its branch and history are preserved. No Core wire change, new grant store, broader member rights or content ownership change.

CI is awaiting repository-admin approval of fork workflows; approval attempted by the publishing actor returned403. This is distinct from local test results. Consumer integration and deployment qualification remain tracked separately.

Review follow-up at dc3635e5e81cd3d9a408a6c99d2883cea8efec2f: correct the flagged boundary terminology and persist installed content-read actor hops through the existing journalActorHop helper before returning the child. A journal append failure returns an error and no issued capability. This answers the journaling question raised by the stacked module-actor extension; no second journal or new public interface is added.

The new four-case invoke/lookup regression fails on the preceding implementation and passes with the three-line production fix. Complete adapter/business race suites pass on the follow-up (5.771s/66.017s); boundary, naming and whitespace checks pass. The follow-up changes three files: implementation, regression coverage and authorization documentation. The earlier approval covers b50c42ad; fresh review of this follow-up remains pending. The activation and live-qualification limits above remain unchanged.

Stack integration: a non-checkout merge inspection against the module-actor extension at 17e1a050 reports one overlap in installed_content_read.go. When that extension incorporates this follow-up, its generalized exchange should call journalActorHop once for both installed modes, preserving the new content-read regression and its module-actor tests. The extension branch was not modified, and combined runtime qualification is not claimed.

CI follow-up

The immutable-package authority guard check requires the existing deferred release variable to be named releaseAuthority; the binding resolver already acquired and deferred the guard, and now follows that convention. Applied the CI formatter to five authored Go files. No authorization behavior changed and no gate was weakened. The complete module/tools suite and immutable-package validation pass locally; all six touched files are goimports-clean. Hosted checks must rerun on the follow-up commit.

[lukazhupa]

Approving. A follow-up builds on this seam, and GOWORK=off go test ./pkg/adapters ./pkg/business passes locally on this branch merged with current main. It reuses Core's Child, the existing binding seal and the module-hop revision check rather than adding a mechanism, which is the right shape.

Two things before merge:

1. scripts/check-boundaries.sh fails on module/services/accounts/AUTHZ.md:163: "Model invocation" reads as naming something outside this repo's boundary. Rewording it (for example "model inference") clears it.
2. CI hasn't run yet; it needs a maintainer to approve the workflow run.

The follow-up adds a second binding mode on this seam, so a module can be recorded as the actor on an ordinary operation exchange (part of #1200).

[lukazhupa]

Re-approving at ee97a8a: the authority-use guard and import formatting are fixed, and CI is green.