Function command_verdict_ceilinged 

pub fn command_verdict_ceilinged(
    command: &str,
    threshold: SafetyLevel,
    engine_level: Option<&'static Level>,
) -> Verdict

The ceilinged verdict: classify command at (threshold, engine_level), gating the projected level <= threshold. The single seam both the CLI (--level) and the hook (configured level) funnel through. engine_level = Some classifies via Level::admits (the fine per-level model); None uses the 3-band projection. Either way the result is gated to threshold, so a legacy leaf that bypasses the engine (a redirect write → SafeWrite) is still held under a lower ceiling.