Polling a timing test can drop its upper bound: check with a late-timer mutant

A flaky test sampled state at a fixed time (limit + 500 ms). It was rewritten to poll until the state appears, with a long timeout, and to assert elapsed >= limit. That removes the tick flake, but it also removes the implied upper bound: a mutant that fires the timer 1.2 s late passed every rewritten check. When converting fixed-time samples to polling, record the elapsed time and assert a generous upper bound (e.g. limit + 2-3 timer ticks). Run a late-timer mutant to prove the bound bites. Separately: when a harness exits on the first failed assertion, evaluate every predicate from the printed results to see which checks each mutant kills.