The caller's own visibility bounds the answer: a context the caller cannot read answers exactly as one that does not exist (uniform 404, no existence oracle). The resolution is [context_service::resolve_context_ref] — the same one every ref-accepting route uses — so each ref form keeps the refusal it has everywhere else.