Function command_verdict_at_level 

pub fn command_verdict_at_level(command: &str, level: &'static Level) -> Verdict

Classify command against an UPPER-band level (local-admin/network-admin/yolo), which has no 3-value legacy ceiling. Every engine-resolved leaf is decided by Level::admits against level instead of the lower-band projection; a Denied on any segment dominates. Legacy (unresolved) leaves keep their local-safe SafeWrite-or-below verdict, which every upper level admits. The result is Allowed(SafeWrite) (accepted by the shared upper ceiling) or Denied.