Make the B1 survey a command, which immediately falsified B1.

B1 was found with a shell pipeline and published as a finding. The review it
appeared in had already argued that a mechanical check nobody can re-run is an
assertion, and §11's entire claim is mechanical checkability — so asserting B1
unmechanically was that defect committed by the repository reporting it.

tools/survey_layer_declarations.go reads both §11 forms per repository, reports
intra-repository disagreement, and writes a receipt. Run once, it showed the
published B1 was wrong: the estate does not spell layer: three ways across
repositories. The original pipeline took the first ^layer: match per repository
without recording which file it came from, reporting one value where there were
two.

The corrected finding is stronger. Nine of nine repositories carrying both §11
forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml
says engine/staff. The disagreement is within each repository, between the two
forms §11 permits, and it is universal rather than careless — two generators, two
conventions. Nobody is inconsistent with anybody else.

That relocates the question from casing to precedence: §11 accepts either form
and does not say which governs when both exist and disagree, so a conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories while both follow §11. flex-auth is the only declared repository
that cannot exhibit this, and only because it never wrote the second file.

The correction is recorded in the review rather than edited away: a published
review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no
exception for the reviewer.

Four tests cover the disagreement case, the refusal to fold case, a missing
declaration, and the single-form shape that must not read as self-disagreement.
The survey checks only the §3 vocabulary and never applies flex-auth's house
rules to peers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

workplans/FLEX-WP-0030-boundary-declaration-cleanup.md

@@ -153,23 +153,36 @@ state_hub_task_id: "70786e6d-02f2-5a90-8640-247ba377d9a4"
 
 Owner: `flex-auth` to raise; the named owner resolves each.
 
-### B1 — `layer:` case is inconsistent, and §11 calls the check mechanical
+### B1 — nine of nine repositories disagree with themselves across the two §11 forms
 
-| Value written | Repositories |
+**Corrected 2026-09-21.** The first version of this finding said the estate
+spelled `layer:` three ways across repositories and named eight as non-conformant
+on casing. That was wrong, from an ad-hoc shell survey that took the first
+`^layer:` match per repository without recording which file it came from.
+
+Re-run mechanically (`tools/survey_layer_declarations.go`, receipt at
+`docs/evidence/2026-09-21-layer-declaration-survey.json`):
+
+| Repositories carrying both §11 forms | 9 |
 | --- | --- |
-| `Engine` | `flex-auth`, `maturity-engine` |
-| `engine` | `secrets-engine`, `approval-engine`, `user-engine`, `tenant-engine`, `zone-engine`, `audit-core` |
-| `staff` | `ops-warden`, `kings-guard` |
+| Of those, forms that disagree | **9 of 9** |
+| Shape | `INTENT.md`: `Engine` / `Staff`. `layer.yaml`: `engine` / `staff` |
+| Only one form | `flex-auth` — no `layer.yaml`, which is why it cannot exhibit this |
 
-flex-auth's own validator rejects anything outside `{Staff, Engine, Tooling}`
-(`internal/layer/conformance.go:86`), so run across the estate it would fail
-eight of ten declarations on casing alone. Either the §3 vocabulary is
-case-insensitive and every checker MUST fold case, or it is not and eight
-declarations are non-conformant. Today each repository's checker only reads its
-own file, so the disagreement is invisible by construction.
+The disagreement is **within** each repository, not across the estate, and it is
+universal rather than careless: two generators, two conventions, no repository
+mixing them. Nobody is inconsistent with anybody else.
 
-Owner: `gate-house`. This is the §11 mechanical-checkability claim meeting its
-first cross-repository run.
+§11 accepts *"a `layer:` key in the `INTENT.md` frontmatter, **or** an equivalent
+declaration file"* and does not say which governs when both exist and disagree. A
+conformance run reading `INTENT.md` and one reading `layer.yaml` reach different
+answers for nine repositories, and both follow §11. That is the finding: not
+casing, but an unruled precedence between two permitted forms.
+
+Owner: `gate-house`. Two things would resolve it — which form governs, and
+whether the §3 vocabulary is case-sensitive. If it is case-insensitive, the
+casing half evaporates and flex-auth's validator is what changes; the precedence
+half does not.
 
 ### B2 — four security-relevant repositories carry no layer declaration
 
@@ -249,6 +262,11 @@ since no repository could have discovered it from inside its own checker.
 Task stays `progress`: every finding is open until its owner answers. None is
 closed by silence.
 
+2026-09-21 (later): **B1 was sent wrong and corrected the same day.** See T05.
+Corrections went to `gate-house` and the five engine repositories that received
+the original, plus `ops-warden`, `kings-guard` and `audit-core`, who are affected
+by the corrected finding and had not been told of the first.
+
 ## Out of scope
 
 - Bumping flex-auth to declare v0.8. v0.8 is `status: proposed`; T01 removes the
@@ -257,3 +275,39 @@ closed by silence.
 - Grading any peer repository's conformance. flex-auth reports what it can
   observe and names the owner; §9.3's two-owner split cuts here too.
 - `FLEX-WP-0029`'s stance-register second edition. Adjacent, separately owned.
+
+## 5. Make the survey reproducible
+
+```task
+id: FLEX-WP-0030-T05
+status: done
+priority: high
+```
+
+Owner: `flex-auth`.
+
+B1 was found with a shell pipeline and published as a finding. The review it
+appeared in had already argued that a mechanical check nobody can re-run is an
+assertion — and §11's whole claim is mechanical checkability. Asserting B1
+unmechanically was that defect committed by the repository reporting it.
+
+`tools/survey_layer_declarations.go` reads **both** §11 forms for every
+security-relevant counterpart, reports intra-repository disagreement, and writes
+a JSON receipt. `internal/layer` carries four tests covering the disagreement
+case, the refusal to fold case, a missing declaration, and the single-form shape
+that must not be reported as disagreeing with itself.
+
+It checks exactly one property — the `layer:` value against the §3 vocabulary as
+written — and deliberately does **not** apply flex-auth's own declaration rules
+(`pep_stance`, `tooling_contacts`, `conformance_record`) to any other repository.
+Grading peers by the surveyor's house rules would be §11's own defect wearing a
+tool for a hat.
+
+Running it immediately falsified the finding it was built to reproduce, which is
+the argument for building it.
+
+Gate: B1 is reproducible by command, with a receipt, and the correction is
+recorded rather than edited away.
+
+2026-09-21: done. Receipt at
+`docs/evidence/2026-09-21-layer-declaration-survey.json`.