Function command_verdict_at_level 

pub fn command_verdict_at_level(command: &str, level: &'static Level) -> Verdict

Classify command against a named level. Every engine-resolved leaf is decided by Level::admits against level rather than by walking the band; a Denied on any segment dominates. Legacy (unresolved) leaves keep their local-safe SafeWrite-or-below verdict.

A pass returns the band the PROFILE earns (to_legacy), so the caller’s <= ceiling gate still tightens — that is what lets reader (SafeRead) and paranoid (Inert) use this path at all. Upper-band levels have no legacy equivalent and keep the shared SafeWrite.