Prepare independent deployed cadence acceptance verifier

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/CadenceObserverAdmission.md

@@ -120,3 +120,79 @@ artifacts and records the config digest. The historical Taxonomy draft
 fixture remains a historical worked example. Live admission must supply the
 actual configured frame/interval and preserve per-class scope; the source
 fixture cannot prove that a deployed process emits hourly heartbeats.
+
+## Deployed-capture verifier — 2026-10-16
+
+`kings_guard.acceptance` is an offline consumer of runtime/evidence-owner
+artifacts. It opens no network, cluster, database, or credential client. Run
+from this repository after the runtime owner has delivered all four inputs:
+
+```bash
+PYTHONPATH=src python3 -m kings_guard.acceptance \
+  --events /path/to/source-instance.jsonl \
+  --snapshot /path/to/source-snapshot.json \
+  --receiver /path/to/receiver-reconciliation.json \
+  --receipts /path/to/collector-accepted.jsonl \
+  --source qonto-assistant --tenant '<owner-approved-exact-tenant>' \
+  --frame-seconds 3600 --now '<actual-observation-time-with-timezone>'
+```
+
+The output hashes its exact inputs. Exit0 means the supplied bounded capture
+passes; exit1 means failure or invalid evidence. The verifier does not attest
+input provenance, signatures, deployed image pins, or the operational matrix
+below. A fixture passing the command remains fixture evidence.
+
+Input contract:
+
+- Raw JSONL contains exactly one source instance, startup sequence1 through
+  the source snapshot's last sequence, a real deny, and at least one periodic
+  heartbeat emitted at least f after startup. The source snapshot is the
+  unmodified `AuditLogger.reconciliation_snapshot()` response from that instance.
+- Receiver JSON is the actual `/v1/reconciliation` response with exact source,
+  tenant, instance, and explicit acceptance-time since/until. Its counts must
+  equal the capture's allow/deny counts plus heartbeat transport records.
+- Collector JSONL contains one durable original accepted receipt per source
+  sequence with `event_id`, `status_code`, `accepted_at`, `source`, `tenant`,
+  `stream_instance_id`, `stream_sequence`, `type`, and
+  `covered_event_classes`. The reviewed mapping is one source heartbeat to
+  one `audit-core.heartbeat` covering only `audit.deny`; it preserves original
+  source fields. This mapping does not claim separate receiver admission of
+  audit.allow or audit.heartbeat obligations.
+- `accepted_at` records collector response receipt time, an upper bound on
+  acceptance. Original202 receipts can bound delivery lag; a duplicate200
+  receipt alone cannot establish when the event first entered custody. The
+  verifier requires original202 for timing. Preserve earliest successful
+  receipts across retries, and supply a receiver window enclosing them.
+  Sequence/snapshot bounds are source occurrence coordinates, not receiver
+  acceptance times. Receipt correlation bridges those coordinates.
+
+The runtime owner must keep the authorized candidate active during the real
+hour-long capture (for example authorized health polling) while retaining its
+configured scale-to-zero behavior. Do not silently change minScale to obtain
+heartbeats. Capture restart and scale-to-zero separately: a shutdown heartbeat
+is a lifecycle claim, not proof the process remains alive; never present its
+later absence as an unexpected omission when shutdown was intended. Resume
+with a new instance and sequence1, then reconcile each instance separately.
+
+`assess_class_silence` independently computes class deadlines from owner-supplied
+registered waits and explicit per-class receiver last-seen timestamps, then
+compares the exact missing classes with the receiver's sanitized findings.
+Use wait2f and grace1.5 (deadline3f). An explicit None is a receiver-observed
+never-seen class; an omitted last-seen entry is refused. An unrelated fresh
+class cannot conceal a stale rare class. Supply actual observations and their
+owner/source/window pins; local projected times are algorithm tests only.
+
+Before T03 can close, collect independent operational receipts for quiet-active,
+deny, periodic timing, bounded per-instance reconciliation, class-specific
+missing heartbeat, sequence gap, source/accepted divergence, lag distinguished
+from persistent divergence, failed cross-source/tenant reads, restart, and
+scale-to-zero. Negative injection must use an owner-approved isolated lane;
+do not suppress production evidence or change source registry bounds to make
+a test finish sooner. The existing full-frame wait remains necessary.
+
+Validation: 144 tests pass, including16 new acceptance/correlation tests and
+existing class-coverage regressions; changed-file Ruff passes. No live capture
+or receiver finding was produced by this source delivery. Knowledge package
+0.2.6 digest8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02
+returned start/evidence withheld, orientation-only; current source cards and
+Staff-layer owner boundary were read directly. This is not a readiness grant.