Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.

GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

internal/layer/survey.go

@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
+
+	"gopkg.in/yaml.v3"
 )
 
 // Form is one of the two shapes §11 accepts for a declaration: a layer: key in
@@ -15,10 +17,14 @@ type Form struct {
 	Layer  string // the layer: value exactly as written
 	Role   string
 	Found  bool
-	// InVocabulary reports whether Layer is in the §3 vocabulary as written.
-	// Deliberately case-sensitive: whether §3 is case-insensitive is the open
-	// question (FLEX-WP-0030 B1), and folding case here would hide it.
+	// InVocabulary reports whether Layer is in the §3 vocabulary after ASCII
+	// case folding. GH-DEC-2026-017 §2 ruled comparison case-insensitive and
+	// requires a run to fold before comparing, so a lowercase declaration is
+	// conforming rather than tolerated. The earlier field was deliberately
+	// case-sensitive while that was the open question; it is now answered.
 	InVocabulary bool
+	// Canonical is the §4 column spelling of Layer, empty when out of vocabulary.
+	Canonical string
 }
 
 // SurveyRow is one repository's declaration as observed from outside. It holds
@@ -28,20 +34,37 @@ type SurveyRow struct {
 	Repo   string
 	Intent Form // INTENT.md frontmatter
 	File   Form // layer.yaml or equivalent
+	// InCatalog reports whether this repository is a §4 row. §11 binds §4, so a
+	// row that is false can be a volunteer but cannot be a §11 non-conformance.
+	InCatalog bool
 }
 
 // Declared reports whether any machine-readable form was found.
 func (r SurveyRow) Declared() bool { return r.Intent.Found || r.File.Found }
 
 // SelfDisagrees reports a repository whose two §11 forms state different layer
-// values. Case counts: that is the point of the finding, not an artifact of it.
+// values as written. Under GH-DEC-2026-017 §1 a disagreement between the two
+// forms is a finding IN ITS OWN RIGHT and MUST be reported rather than resolved
+// away by precedence: precedence says which value is the repository's answer,
+// it does not say the disagreement did not happen. So case still counts here.
 func (r SurveyRow) SelfDisagrees() bool {
 	return r.Intent.Found && r.File.Found && r.Intent.Layer != r.File.Layer
 }
 
-// Layer returns the value to report, preferring INTENT.md, which §11 names
-// first. The preference is this survey's, not a ruling — which form governs is
-// exactly what FLEX-WP-0030 B1 asks.
+// DisagreesOnLayer reports the stronger case: the two forms name different
+// LAYERS, not merely different spellings of one. Case-folded per A9. Nine of
+// the estate's nine self-disagreements are spelling only, and none of them is
+// this.
+func (r SurveyRow) DisagreesOnLayer() bool {
+	return r.Intent.Found && r.File.Found && r.Intent.Canonical != r.File.Canonical
+}
+
+// Layer returns the repository's answer. INTENT.md governs: GH-DEC-2026-017 §1
+// rules that a layer.yaml or equivalent is a DERIVED artifact under §11's own
+// derived-artifact rule — marked derived, naming INTENT.md, required to agree —
+// and that the declaration-form paragraph gave the declaration a machine-readable
+// FORM, not a second AUTHORITY. That is now a ruling, no longer this survey's
+// preference.
 func (r SurveyRow) Layer() string {
 	if r.Intent.Found {
 		return r.Intent.Layer
@@ -51,6 +74,74 @@ func (r SurveyRow) Layer() string {
 
 var declarationFiles = []string{"layer.yaml", "layer.yml"}
 
+// catalogRows are §4's layer-catalog repositories. §11's obligations attach to
+// estate-authored repositories IN §4; a repository outside it may declare
+// voluntarily, and a run that grades a volunteer is over-scoped
+// (GH-DEC-2026-017 §4, amendment A11). `OpenBao` is a §4 row but is not
+// estate-authored, so no declaration is owed there.
+var catalogRows = map[string]bool{
+	"info-tech-canon": true, "net-kingdom": true, "key-cape": true,
+	"user-engine": true, "tenant-engine": true, "zone-engine": true,
+	"secrets-engine": true, "audit-core": true, "access-engine": true,
+	"approval-engine": true, "maturity-engine": true, "gate-house": true,
+	"ops-mason": true, "ops-warden": true, "kings-guard": true,
+	"whitehat-security": true,
+}
+
+// catalogAliases maps a checkout directory to the §4 row it is. The rename to
+// access-engine is ruled and sequenced (FLEX-DEC-2026-013, FLEX-WP-0020) and
+// has not landed; §4's own note says both names denote the same authority until
+// it does.
+var catalogAliases = map[string]string{"flex-auth": "access-engine"}
+
+// InCatalog reports whether a checkout directory is a §4 catalog row.
+func InCatalog(repo string) bool {
+	if alias, ok := catalogAliases[repo]; ok {
+		repo = alias
+	}
+	return catalogRows[repo]
+}
+
+// Scope is what a conformance run ranged over.
+//
+// §11 as amended by A11 requires a run to STATE its scope: a run over §4 and a
+// run over every repository carrying a declaration answer different questions,
+// and a report that does not say which it did cannot be acted on. That is the
+// same defect as a survey that did not record which file a value came from —
+// the defect this survey was built to remove — one level up.
+type Scope struct {
+	Name      string
+	Statement string
+	Repos     []string
+}
+
+// CatalogScope is a run over the §4 catalog: the set §11's obligations bind.
+func CatalogScope(repos []string) Scope {
+	var in []string
+	for _, r := range repos {
+		if InCatalog(r) {
+			in = append(in, r)
+		}
+	}
+	return Scope{
+		Name:      "§4 catalog",
+		Statement: "estate-authored repositories catalogued in §4. §11's obligations attach here, and only here.",
+		Repos:     in,
+	}
+}
+
+// EstateScope is a run over every repository asked, catalogued or not. It
+// answers a different question from CatalogScope and says so: a repository
+// outside §4 that declares is reported as a volunteer, never as a §11
+// non-conformance.
+func EstateScope(repos []string) Scope {
+	return Scope{
+		Name:      "estate-wide",
+		Statement: "every repository surveyed, catalogued or not. Repositories outside §4 are reported as declared voluntarily, outside catalog scope — never as §11 non-conformances.",
+		Repos:     append([]string(nil), repos...),
+	}
+}
+
 // SurveyDeclarations reads both §11 forms for every repository under root.
 //
 // It checks ONE property: whether each layer: value sits in the §3 vocabulary
@@ -71,6 +162,7 @@ func SurveyDeclarations(root string, repos []string) ([]SurveyRow, error) {
 				break
 			}
 		}
+		row.InCatalog = InCatalog(repo)
 		rows = append(rows, row)
 	}
 	sort.Slice(rows, func(i, j int) bool { return rows[i].Repo < rows[j].Repo })
@@ -86,25 +178,45 @@ func readForm(root, rel string) Form {
 	if err != nil || strings.TrimSpace(decl.Layer) == "" {
 		return Form{}
 	}
+	canon, ok := CanonicalLayer(decl.Layer)
 	return Form{
 		Source:       rel,
 		Layer:        decl.Layer,
 		Role:         decl.Role,
 		Found:        true,
-		InVocabulary: validLayers[decl.Layer],
+		InVocabulary: ok,
+		Canonical:    canon,
 	}
 }
 
+// peerDeclaration is the ONLY shape the survey reads from another repository:
+// layer and role. Decoding a peer into flex-auth's own Declaration applied
+// flex-auth's field types to someone else's file — and when flex-auth's
+// emission_guarantee became a path string, audit-core's list-shaped
+// emission_guarantee failed to decode and its layer.yaml silently vanished
+// from the survey. A surveyor's schema is a house rule too.
+type peerDeclaration struct {
+	Layer string `yaml:"layer"`
+	Role  string `yaml:"role"`
+}
+
 // loadAnyDeclaration reads INTENT.md frontmatter or a bare declaration file.
-func loadAnyDeclaration(path string) (Declaration, error) {
-	if strings.HasSuffix(path, ".md") {
-		return LoadDeclaration(path)
-	}
+func loadAnyDeclaration(path string) (peerDeclaration, error) {
 	body, err := os.ReadFile(path)
 	if err != nil {
-		return Declaration{}, err
+		return peerDeclaration{}, err
 	}
-	return parseDeclarationYAML(string(body))
+	doc := string(body)
+	if strings.HasSuffix(path, ".md") {
+		if doc, err = splitFrontmatter(doc); err != nil {
+			return peerDeclaration{}, err
+		}
+	}
+	var decl peerDeclaration
+	if err := yaml.Unmarshal([]byte(doc), &decl); err != nil {
+		return peerDeclaration{}, fmt.Errorf("parse layer declaration %s: %w", path, err)
+	}
+	return decl, nil
 }
 
 // Spellings groups every observed layer: value across both forms, so the spread
@@ -149,17 +261,38 @@ func SelfDisagreeing(rows []SurveyRow) []SurveyRow {
 	return out
 }
 
-// FormatSurvey renders the survey as a stable, diffable report.
-func FormatSurvey(rows []SurveyRow) string {
+// VolunteerDeclarations lists repositories outside §4 that declared anyway. The
+// correct report for them is "declared voluntarily, outside catalog scope"
+// (GH-DEC-2026-017 §4): treating a volunteer's declaration as a non-conformance
+// is both wrong about who §11 binds and the fastest way to stop getting
+// volunteers.
+func VolunteerDeclarations(rows []SurveyRow) []string {
+	var out []string
+	for _, r := range rows {
+		if !r.InCatalog && r.Declared() {
+			out = append(out, r.Repo)
+		}
+	}
+	return out
+}
+
+// FormatSurvey renders the survey as a stable, diffable report. It leads with
+// the scope because §11 requires a run to state what it ranged over.
+func FormatSurvey(scope Scope, rows []SurveyRow) string {
 	var b strings.Builder
+	fmt.Fprintf(&b, "Scope: %s — %s\n\n", scope.Name, scope.Statement)
 	fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", "REPO", "INTENT.md", "DECL FILE", "NOTE")
 	for _, r := range rows {
 		note := ""
 		switch {
+		case !r.Declared() && !r.InCatalog:
+			note = "no declaration; outside §4 — none owed"
 		case !r.Declared():
 			note = "NO DECLARATION (§11)"
+		case r.DisagreesOnLayer():
+			note = "forms name DIFFERENT LAYERS; INTENT.md governs"
 		case r.SelfDisagrees():
-			note = "forms disagree"
+			note = "forms disagree on spelling only; INTENT.md governs, still a finding"
 		case !r.Intent.Found:
 			note = "declaration file only"
 		case !r.File.Found:
@@ -167,9 +300,12 @@ func FormatSurvey(rows []SurveyRow) string {
 		}
 		for _, f := range []Form{r.Intent, r.File} {
 			if f.Found && !f.InVocabulary {
-				note += "; outside §3 vocabulary as written"
+				note += "; " + f.Layer + " is outside the closed §3 vocabulary"
 			}
 		}
+		if r.Declared() && !r.InCatalog {
+			note += "; declared voluntarily, outside §4 catalog scope"
+		}
 		fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", r.Repo, dash(r.Intent.Layer), dash(r.File.Layer), note)
 	}
 	return b.String()