X_TENANCY_CROSS_DENIED

a cross-tenant read was entered without the capability

crossTenant() called by an actor lacking tenancy:cross, or outside every request context — the capability is re-checked on every plan built inside the scope, so an actor swapped in by withChildContext() does not inherit the reach

mint the actor with the scope — serviceActor({ id: 'reconciler', scopes: ['tenancy:cross'] }) — run inside runWithContext(ctxOf({ actor }), fn), and wrap the reads in crossTenant('<why this spans tenants>', fn); the reason is required and non-blank, because it is what the next reader greps for