EVIDENCE CEILING, REVISION 2 -- both edits absorbed, and the early-print correction taken. THIS SUPERSEDES the block I sent at 22:22; use this one in the plan and the driver, and discard the first so we are never holding two texts. No further scope expansion.

=== BEGIN CEILING BLOCK (rev 2) ===

EVIDENCE CEILING -- what a fully green run of this rig does and does not establish.

REACHABILITY=NOT_TESTED. Printed TWICE, unconditionally:
  (a) BEFORE THE FIRST FALLIBLE PREFLIGHT, so the ceiling is already on the record before anything
      in this run can fail, be killed, or exit early. This print is the one that survives; it does
      not depend on reaching any later step.
  (b) AGAIN in the normal success or failure summary.
No promise is made about terminal output after an uncatchable kill. A SIGKILL leaves print (a) and
the state markers on disk, and nothing else -- that is the guarantee, and it is the whole of it.

This rig makes no connection attempt, from this box or any other. Rule shape is not arrival:
LAN_FIREWALL_RECONCILED means verify() returned Ok(true) over the rule store at that instant, and
the product states the converse itself in LAN_FIREWALL_UNVERIFIED -- "this does not prove the
listener unreachable" (serveverb.rs:310-315).

A fully green local run establishes exactly three things:
  1. OBSERVED ENFORCEMENT-CODE ACCEPTANCE -- the ActiveStore codes the host reported were accepted
     by the repaired comparison.
  2. RECONCILIATION UNDER THE MEASURED RULE-STORE AND CENSUS CONDITIONS -- conditioned on those
     conditions, which are recorded alongside it, not a standing property of the host.
  3. THE REGISTERED CHILD-QUERY TIMINGS FOR COMPLETED TRIALS, WITH THEIR BRACKETS -- wall_ms as
     measured inside the process around the child (bootstrap_firewall.rs:99-109). NOT INTERCHANGEABLE
     WITH END-TO-END INVOCATION WALL TIME.

It establishes NONE of the following, and a green must never be read as any of them:
  - remote connectivity;
  - ACL disposition;
  - end-to-end #297 acceptance.

POPULATED TIMING IS EARNED BY COMPLETED VALID B TRIALS, NEVER BY ADMISSION. Arm B being admitted
supplies no timing at all. Three registered B trials (driver: for n in 1 2 3; do trial b "$n"; done):
  - no completed valid B trial            => POPULATED_TIMING=NOT_TESTED
  - fewer than the registered three       => POPULATED_TIMING=PARTIAL, printed with completed and
                                             required counts, e.g. completed=2 required=3
  - all three completed and valid         => registered populated timing satisfied
It is never inferred from setup timing: the elevated setup's own wall is a different path with a
different child and is not a substitute for a trial that ran against a populated store.

TWO-HOST ACCEPTANCE REMAINS OUTSTANDING. It requires its own plan and its own execution grant.
This local rig does not discharge it and no combination of green results here converts into it.

=== END CEILING BLOCK (rev 2) ===

Two notes on what changed and why, so the edits are visible rather than silently folded in:

- The early print REPLACES my "never omitted from an early exit", which was a promise I could not
  keep: no handler runs after an uncatchable kill, so a line that only prints at the end is absent
  from exactly the runs where its absence misleads. Printing it first makes it a fact on the record
  rather than a commitment about the future. Your correction, and it is a better mechanism than the
  one it replaced.
- PARTIAL now carries completed and required counts inline. A bare "PARTIAL" is the shape that gets
  quoted without its denominator later; a reader must not be able to repeat the word without the
  numbers that qualify it.

The "for n in 1 2 3" count is read from the driver at r5:1268, not remembered.

Noted: perri holds the single-launch window through END and cleanup disposition. I am running no
probe and starting nothing live. Source-only.