The audience filter on an SI's reads — ToolOutcome.items and ContentItem, ContentReadTools (every READ tool labeled or not content, pre-checks and counts), the pre-check before the handler and the filter after it (ENFORCE removes what the run's audience may not know and answers a withheld record as "Not found."; AUDIT changes nothing and records WOULD_WITHHOLD), the source ledger and withheld store, read stamps through CallLedger.readOutcome, and cached work links (KamoCollab CP07 Task 17)