EVIDENCE CEILING, plan wording. I own this per your ruling; hertz lands the same text as the run's terminal summary. Verbatim below so we are quoting one string, not two paraphrases.

=== BEGIN CEILING BLOCK ===

EVIDENCE CEILING -- what a fully green run of this rig does and does not establish.

REACHABILITY=NOT_TESTED. Unconditional. Printed in the terminal summary on SUCCESS AND ON FAILURE
alike, never suppressed by a green and never omitted from an early exit. This rig makes no
connection attempt, from this box or any other. Rule shape is not arrival: LAN_FIREWALL_RECONCILED
means verify() returned Ok(true) over the rule store at that instant, and the product states the
converse itself in LAN_FIREWALL_UNVERIFIED -- "this does not prove the listener unreachable"
(serveverb.rs:310-315).

A fully green local run establishes exactly three things:
  1. OBSERVED ENFORCEMENT-CODE ACCEPTANCE -- the ActiveStore codes the host reported were accepted
     by the repaired comparison.
  2. RECONCILIATION UNDER THE MEASURED RULE-STORE AND CENSUS CONDITIONS -- conditioned on those
     conditions, which are recorded alongside it, not a standing property of the host.
  3. THE REGISTERED CHILD-QUERY TIMINGS FOR COMPLETED TRIALS, WITH THEIR BRACKETS -- wall_ms as
     measured inside the process around the child (bootstrap_firewall.rs:99-109), not comparable
     with an external wall.

It establishes NONE of the following, and a green must never be read as any of them:
  - remote connectivity;
  - ACL disposition;
  - end-to-end #297 acceptance.

POPULATED TIMING IS ARM-B-BOUND. If Arm B is never admitted, POPULATED_TIMING=NOT_TESTED. It is
NOT inferred from setup timing: the elevated setup's own wall is a different path with a different
child and is not a substitute for a trial that ran against a populated store. An unadmitted Arm B
leaves a labelled hole, not a value.

TWO-HOST ACCEPTANCE REMAINS OUTSTANDING. It requires its own plan and its own execution grant.
This local rig does not discharge it and no combination of green results here converts into it.

=== END CEILING BLOCK ===

Three notes on the wording, so the choices are visible rather than buried:

- "on SUCCESS AND ON FAILURE alike, never suppressed by a green and never omitted from an early
  exit" is deliberate. The failure mode for a ceiling line is that it prints only on the unhappy
  path, so the one run people quote -- the green one -- is the run that never showed it.
- Each of the three positives carries its own conditioning clause inline. A bare list of three
  nouns is exactly the shape that gets quoted without its scope later, which is the error I have
  made repeatedly this week; putting the scope in the sentence rather than under it is the fix.
- POPULATED_TIMING and REACHABILITY are named as distinct NOT_TESTED values rather than folded into
  one "not tested" note, so a future reader cannot satisfy one by pointing at the other.

Nothing run. No probe added, none proposed.