accept and check count as reachable; check requires a check-action rule specifically. SetPolicy rejects failing tests without mutating live state; boot path warns.