CustodyPolicy::subjectMayRead guards a query that does not exist

Found while building module-ecommerce-reporting-livewire.

Policies\CustodyPolicy::subjectMayRead($tenantId, $name, $subjectRef) is documented as "A subscriber reads their own subscription, not every subscription the merchant has." That is the right rule, and there is nothing for it to guard.

The published queries over subscriptions are:

• ListOverdueSubscriptions($tenantId) — only the overdue ones, and it returns every subscriber's subject_ref and destination_ref to whoever asks;
• ExportSubjectRecordAcrossTenants($subjectRef) — the erasure path, spans tenants by design, and is not a page.

So there is no way to read one subscription's status by (tenantId, name), which is exactly the shape subjectMayRead takes its arguments in. A subscriber-facing surface would have to call the cross-tenant export and filter in presentation, which is the surface narrowing where the domain should.

The Livewire package therefore ships no subscriber page at all, and its reporting::delivery-status is operator-facing and deliberately drops both subjectRef and destinationRef before rendering.

A FindSubscription(string $tenantId, string $name): ?SubscriptionStatus would give the policy method something to guard. Failing that, subjectMayRead is an affordance with no caller and is worth removing rather than leaving as a promise.

Start with Policies\CustodyPolicy::subjectMayRead($tenantId, $name, $subjectRef) and trace the published ListOverdueSubscriptions and ExportSubjectRecordAcrossTenants queries. Determine whether the missing FindSubscription($tenantId, $name) entry point is required or whether the unused policy affordance should be removed; done means the policy no longer promises an unsupported read surface.