Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.

GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

internal/layer/survey_test.go

@@ -48,15 +48,82 @@ func TestSurveyDetectsFormsDisagreeingWithinOneRepo(t *testing.T) {
 	}
 }
 
-// Case is not folded: whether §3 is case-insensitive is the open question, and
-// folding here would hide the finding rather than resolve it.
-func TestSurveyDoesNotFoldCase(t *testing.T) {
+// Case IS folded now. GH-DEC-2026-017 §2 ruled comparison ASCII case-insensitive
+// and requires a run to fold before comparing. This test was the inverse
+// assertion while that was the open question; it is inverted rather than
+// deleted, so the ruling is visible in the place the old behaviour lived.
+func TestSurveyFoldsCaseAfterGHDEC017(t *testing.T) {
 	root := t.TempDir()
 	writeRepo(t, root, "peer", "", "engine")
 
 	rows, _ := layer.SurveyDeclarations(root, []string{"peer"})
-	if rows[0].File.InVocabulary {
-		t.Fatal(`"engine" was accepted into the §3 vocabulary; the survey must not fold case`)
+	if !rows[0].File.InVocabulary {
+		t.Fatal(`"engine" was rejected; a lowercase declaration is conforming, not tolerated`)
+	}
+	if rows[0].File.Canonical != "Engine" {
+		t.Fatalf("Canonical = %q; want the §4 column spelling Engine", rows[0].File.Canonical)
+	}
+}
+
+// The two forms disagreeing only in spelling is still reported — precedence
+// says which value is the repository's answer, it does not say the
+// disagreement did not happen (GH-DEC-2026-017 §1) — but it is not a
+// disagreement about a LAYER.
+func TestSpellingDisagreementIsReportedButIsNotALayerDisagreement(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "peer", "Engine", "engine")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"peer"})
+	if !rows[0].SelfDisagrees() {
+		t.Fatal("the form disagreement was not reported; it is a finding in its own right")
+	}
+	if rows[0].DisagreesOnLayer() {
+		t.Fatal("Engine vs engine was reported as a disagreement about a layer; two spellings of Engine do not describe two boundaries")
+	}
+	if rows[0].Layer() != "Engine" {
+		t.Fatal("INTENT.md governs; the repository's answer is its INTENT.md value")
+	}
+}
+
+// Taxonomy is in the vocabulary, and railiance-master — which declares it and
+// is not a §4 row — is a volunteer, not a non-conformance.
+func TestTaxonomyVolunteerIsInVocabularyAndOutOfScope(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "railiance-master", "Taxonomy", "")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"railiance-master"})
+	if !rows[0].Intent.InVocabulary {
+		t.Fatal("Taxonomy was rejected: §3.1 defines it and §4 catalogues it twice")
+	}
+	if rows[0].InCatalog {
+		t.Fatal("railiance-master was treated as a §4 catalog row")
+	}
+	if got := layer.VolunteerDeclarations(rows); len(got) != 1 || got[0] != "railiance-master" {
+		t.Fatalf("VolunteerDeclarations = %v; want [railiance-master]", got)
+	}
+}
+
+// §11 binds §4, and A11 requires a run to state what it ranged over.
+func TestRunStatesItsScope(t *testing.T) {
+	repos := []string{"flex-auth", "gate-house", "railiance-master"}
+
+	catalog := layer.CatalogScope(repos)
+	if catalog.Statement == "" {
+		t.Fatal("a scope with no statement cannot be acted on")
+	}
+	if len(catalog.Repos) != 2 {
+		t.Fatalf("CatalogScope = %v; want the two §4 rows (flex-auth is the access-engine row)", catalog.Repos)
+	}
+	if !layer.InCatalog("flex-auth") || !layer.InCatalog("access-engine") {
+		t.Fatal("the §4 row resolves under both names until the ruled rename lands")
+	}
+	if layer.InCatalog("railiance-master") {
+		t.Fatal("railiance-master is not a §4 row")
+	}
+
+	estate := layer.EstateScope(repos)
+	if len(estate.Repos) != 3 || estate.Name == catalog.Name {
+		t.Fatal("the estate-wide run and the §4 run must be distinguishable; they answer different questions")
 	}
 }
 
@@ -87,3 +154,21 @@ func TestSurveySingleFormIsNotDisagreement(t *testing.T) {
 		t.Fatal(`"Engine" was rejected from the §3 vocabulary`)
 	}
 }
+
+// A peer's declaration is read for layer and role only. A peer carrying a field
+// flex-auth also uses, in a different shape, must not drop out of the survey.
+func TestPeerWithForeignFieldShapesIsStillSurveyed(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "audit-core")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	body := "layer: engine\nrole: evidence\nemission_guarantee:\n  - id: chain-head-attestation\n"
+	if err := os.WriteFile(filepath.Join(dir, "layer.yaml"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	rows, _ := layer.SurveyDeclarations(root, []string{"audit-core"})
+	if !rows[0].File.Found || rows[0].File.Canonical != "Engine" {
+		t.Fatalf("audit-core's layer.yaml was dropped: %+v", rows[0].File)
+	}
+}