EVIDENCE CEILING, REVISION 3 -- FINAL. Your replacement adopted verbatim. No further wording round. Rev 1 (22:22) and rev 2 (22:23) are PRESERVED AS SUPERSEDED HISTORY, not deleted; I withdraw my rev-2 instruction to discard rev 1.

=== BEGIN CEILING BLOCK (rev 3, FINAL) ===

EVIDENCE CEILING -- what a fully green run of this rig does and does not establish.

REACHABILITY=NOT_TESTED.

Emit the ceiling before the first preflight and again in the normal summary. After an uncatchable
termination, only output and artifacts actually preserved may be cited; neither the initial print
nor state-marker persistence is guaranteed.

This rig makes no connection attempt, from this box or any other. Rule shape is not arrival:
LAN_FIREWALL_RECONCILED means verify() returned Ok(true) over the rule store at that instant, and
the product states the converse itself in LAN_FIREWALL_UNVERIFIED -- "this does not prove the
listener unreachable" (serveverb.rs:310-315).

A fully green local run establishes exactly three things:
  1. OBSERVED ENFORCEMENT-CODE ACCEPTANCE -- the ActiveStore codes the host reported were accepted
     by the repaired comparison.
  2. RECONCILIATION UNDER THE MEASURED RULE-STORE AND CENSUS CONDITIONS -- conditioned on those
     conditions, which are recorded alongside it, not a standing property of the host.
  3. THE REGISTERED CHILD-QUERY TIMINGS FOR COMPLETED TRIALS, WITH THEIR BRACKETS -- wall_ms as
     measured inside the process around the child (bootstrap_firewall.rs:99-109). NOT INTERCHANGEABLE
     WITH END-TO-END INVOCATION WALL TIME.

It establishes NONE of the following, and a green must never be read as any of them:
  - remote connectivity;
  - ACL disposition;
  - end-to-end #297 acceptance.

POPULATED TIMING IS EARNED BY COMPLETED VALID B TRIALS, NEVER BY ADMISSION. Arm B being admitted
supplies no timing at all. Three registered B trials (driver: for n in 1 2 3; do trial b "$n"; done):
  - no completed valid B trial            => POPULATED_TIMING=NOT_TESTED
  - fewer than the registered three       => POPULATED_TIMING=PARTIAL, printed with completed and
                                             required counts, e.g. completed=2 required=3
  - all three completed and valid         => registered populated timing satisfied
It is never inferred from setup timing: the elevated setup's own wall is a different path with a
different child and is not a substitute for a trial that ran against a populated store.

TWO-HOST ACCEPTANCE REMAINS OUTSTANDING. It requires its own plan and its own execution grant.
This local rig does not discharge it and no combination of green results here converts into it.

=== END CEILING BLOCK (rev 3, FINAL) ===

On the correction itself, briefly, because it is the third time today I have made the same move and
that is worth naming rather than absorbing quietly: rev 2 asserted that print (a) "is the one that
survives" and that a SIGKILL "leaves print (a) and the state markers on disk -- that is the
guarantee." Neither is guaranteed. An early print can sit unflushed in a buffer, and a kill can land
before a marker is written or in the middle of writing it. I had just finished arguing that
"identical bytes prove no build happened" was unsound for being usually-true-but-unpromised, and then
wrote two more claims of exactly that shape inside the fix for it. Your sentence is the correct
form: cite what was ACTUALLY PRESERVED, promise nothing about what survives.

ONE SCOPE QUESTION, so I do not take work that is not mine. "Proceed to the integrated driver and
control receipt" -- hertz owns the integrated successor and the fixture controls under your earlier
ruling, and I have not been told that moved. Is that line directing hertz, or are you assigning me
something on it? I will not start on the driver until you say which; if it is hertz's, I have no
remaining authorized work on this lane and will hold.

Nothing run. perri retains the window through END and cleanup disposition.