diff --git a/crates/ourios-server/tests/rfc0003_16_served_binary.rs b/crates/ourios-server/tests/rfc0003_16_served_binary.rs
new file mode 100644
index 00000000..6086c02f
--- /dev/null
+++ b/crates/ourios-server/tests/rfc0003_16_served_binary.rs
@@ -0,0 +1,27 @@
+//! RFC0003.16 — Served binary: both transports bind, a client export
+//! round-trips, graceful shutdown.
+//!
+//! Red gate (`specified → red`): `#[ignore]`'d until the served
+//! `ourios-server` receiver role lands (the §9 process-model
+//! resolution). Per `docs/verification.md` §3 this is the ignored-stub
+//! first loop; the implementation flips it to a real-socket integration
+//! test (spawn the binary on `127.0.0.1:0`, export over real gRPC + HTTP
+//! clients, signal shutdown, then `Wal::replay` after the handle frees).
+
+/// Scenario RFC0003.16 — Served binary: both transports bind, a client
+/// export round-trips, graceful shutdown.
+/// See `docs/rfcs/0003-otlp-receiver.md` §5.
+#[ignore = "RFC 0003 red gate — served ourios-server receiver role pending (RFC0003.16)"]
+#[test]
+fn rfc0003_16_served_binary_binds_round_trips_and_shuts_down() {
+    unimplemented!(
+        "RFC0003.16 — boot the ourios-server receiver role bound on \
+         127.0.0.1:0 (gRPC + HTTP, ports read back from the process), \
+         export a non-empty batch over each transport with a real tonic \
+         client and a real HTTP client, assert transport success only \
+         after the batch is durable, then signal shutdown and wait for a \
+         clean exit (releasing the single Wal handle); a subsequent \
+         Wal::replay recovers each OtlpBatch frame with no acked batch \
+         lost. Also: a non-POST to /v1/logs returns 405."
+    );
+}
diff --git a/docs/rfcs/0003-otlp-receiver.md b/docs/rfcs/0003-otlp-receiver.md
index 6277a0fa..a401f9f9 100644
--- a/docs/rfcs/0003-otlp-receiver.md
+++ b/docs/rfcs/0003-otlp-receiver.md
@@ -555,8 +555,8 @@ concurrency).
 > - **Given** `ourios-server` started with the receiver role
 >   enabled (config-toggled per the §9 resolution), the gRPC
 >   listener bound on its configured port (default 4317) and
->   the HTTP listener on its (default 4318), both sharing one
->   `IngestPipeline` over a single `Wal`
+>   the HTTP listener bound on its configured port (default
+>   4318), both sharing one `IngestPipeline` over a single `Wal`
 > - **When** a real OTLP client exports a non-empty batch
 >   (resolvable tenant) over each bound socket — gRPC `Export`
 >   and HTTP `POST /v1/logs` (`application/x-protobuf`) — and
@@ -570,9 +570,8 @@ concurrency).
 >   socket**, not just in-process
 > - **And** the shutdown signal stops the listeners and exits
 >   the process cleanly, releasing the single `Wal` handle —
->   without dropping it mid-fsync or losing a batch that was
->   already acked (no in-flight, already-fsync'd batch is lost
->   on the way out)
+>   without dropping it mid-fsync, and no already-acked batch is
+>   lost on the way out
 > - **And** *after* that clean exit frees the single-writer
 >   handle (RFC 0008 §3.1), opening the WAL and running
 >   `Wal::replay` recovers each batch's `OtlpBatch` frame — the