Readiness

The DMARC enforcement-readiness verdict for one of the caller's domains.

Token required. domain must be a verified domain the token's account owns — anything else is the same opaque 404 the rest of the surface gives, whether it belongs to another account or to nobody (the gate is the SHARED api/monitor.py::require_owned_verified_row, so this read and the dashboard's own answer the ownership question from one definition). A malformed domain is a 422 from normalize_domain, consistent with every other v1 path.

The body is the session-authed /rua/domains/{id}/readiness body, field for field: the same readiness_service.readiness_for_domain computation and the same serialize_readiness mapping, so the agent and the human can never be told different things about the same window. next_record is ReadinessVerdict.next_record VERBATIM — only ever build_upgrade_record output, never composed here and never the LLM (the invariant) — and it is null while blocked, which is an ANSWER: the blockers say why, and a caller must never compose a stronger record to fill the gap.

Read-only, and it takes no plan gate: D42 read-only-degrade keeps a lapsed account's own data readable. Lapsing stops scans, alerts and new RUA ingestion; the verdict over already-ingested reports is not new ingestion. The one live read it can perform is the bounded DMARC TXT fallback inside current_dmarc_record (only when no stored scan carries the record), which is a read of the caller's own published DNS.