Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.

GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tools/survey_layer_declarations.go

@@ -38,9 +38,24 @@ var counterparts = []string{
 	"secrets-engine", "tenant-engine", "user-engine", "zone-engine",
 }
 
+func filterRows(rows []layer.SurveyRow, keep []string) []layer.SurveyRow {
+	in := map[string]bool{}
+	for _, r := range keep {
+		in[r] = true
+	}
+	var out []layer.SurveyRow
+	for _, r := range rows {
+		if in[r.Repo] {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
 func main() {
 	root := flag.String("root", "", "directory holding the repositories (default: home)")
 	jsonOut := flag.String("json", "", "write a receipt to this path")
+	catalogOnly := flag.Bool("catalog-only", false, "range over the §4 catalog rows alone, the set §11's obligations bind")
 	flag.Parse()
 
 	dir := *root
@@ -57,7 +72,19 @@ func main() {
 		fail(err)
 	}
 
-	fmt.Print(layer.FormatSurvey(rows))
+	// §11 as amended by A11: a run MUST state its scope. A run over §4 and a
+	// run over every repository carrying a declaration answer different
+	// questions, and a report that does not say which it did cannot be acted
+	// on. This survey is estate-wide by construction — it was built to disagree
+	// with other repositories' checkers — so it says so and reports
+	// non-catalogued repositories as volunteers rather than as findings.
+	scope := layer.EstateScope(counterparts)
+	if *catalogOnly {
+		scope = layer.CatalogScope(counterparts)
+		rows = filterRows(rows, scope.Repos)
+	}
+
+	fmt.Print(layer.FormatSurvey(scope, rows))
 
 	spellings := layer.Spellings(rows)
 	undeclared := layer.Undeclared(rows)
@@ -86,9 +113,10 @@ func main() {
 		for _, r := range disagree {
 			fmt.Printf("  %-18s INTENT.md=%-8q %s=%q\n", r.Repo, r.Intent.Layer, r.File.Source, r.File.Layer)
 		}
-		fmt.Println("\n§11 accepts \"a layer: key in INTENT.md frontmatter, OR an equivalent")
-		fmt.Println("declaration file\" and does not say which governs when both exist and")
-		fmt.Println("disagree. This is the open question, not a verdict.")
+		fmt.Println("\nRuled (GH-DEC-2026-017 §1): INTENT.md governs; a layer.yaml is a derived")
+		fmt.Println("artifact and MUST agree. The disagreement is still reported, because")
+		fmt.Println("precedence says which value is the answer, not that the disagreement")
+		fmt.Println("did not happen. Rows marked 'spelling only' name the same layer.")
 	}
 
 	var offVocab []string
@@ -100,19 +128,25 @@ func main() {
 		}
 	}
 	if len(offVocab) > 0 {
-		fmt.Printf("\nOutside the §3 vocabulary as written: %s\n", strings.Join(offVocab, ", "))
+		fmt.Printf("\nOutside the closed §3 vocabulary (four tokens, case folded): %s\n", strings.Join(offVocab, ", "))
+	}
+
+	if vol := layer.VolunteerDeclarations(rows); len(vol) > 0 {
+		fmt.Printf("\nDeclared voluntarily, outside §4 catalog scope — welcome, and NOT a §11\nnon-conformance: %s\n", strings.Join(vol, ", "))
 	}
 
 	if *jsonOut != "" {
 		receipt := map[string]any{
-			"derived_at":  "run time",
-			"root":        dir,
-			"rows":        rows,
-			"spellings":   spellings,
-			"undeclared":  undeclared,
-			"off_vocab":   offVocab,
+			"derived_at":       "run time",
+			"scope":            scope,
+			"root":             dir,
+			"rows":             rows,
+			"spellings":        spellings,
+			"undeclared":       undeclared,
+			"off_vocab":        offVocab,
 			"self_disagreeing": disagree,
-			"checks_only": "§3 vocabulary as written; no flex-auth house rules applied to peers",
+			"volunteers":       layer.VolunteerDeclarations(rows),
+			"checks_only":      "the closed four-token §3 vocabulary, ASCII case folded per GH-DEC-2026-017 §2; no flex-auth house rules applied to peers",
 		}
 		b, err := json.MarshalIndent(receipt, "", "  ")
 		if err != nil {