Admit source evidence snapshots and harden stream completeness

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e89-93a2-7aa2-82b3-ce5ccd2682e6

layer.yaml

@@ -4,7 +4,7 @@
 # Assent:    decisions/decisions.md KG-DEC-2026-001 (kings-guard's own voice, §11)
 # Validate:  python3 scripts/check_layer_conformance.py
 #
-# §11 (v0.6) requires a machine-readable declaration: prose cannot distinguish a
+# §11 (v0.7) requires a machine-readable declaration: prose cannot distinguish a
 # declaration from a transcribed review. Form adapted from ops-warden's
 # reference implementation, offered under §11.
 #
@@ -109,10 +109,12 @@ unowned_capabilities:
       Lease, revocation, mount and rotation metadata exposed as an engine
       surface, for secret-abuse posture.
     intended_owner: secrets-engine
-    owner_status: proposed
+    owner_status: "snapshot parsing admitted; posture admission pending"
     blocked_on: >-
-      No engine exposes secret-use evidence. OpenBao is Tooling; same reasoning
-      as above.
+      secrets-engine now exposes `secret-use snapshot`, a non-secret local
+      evidence surface with a 1d heartbeat declaration. Envelope and scoped lane
+      parsing are admitted under KG-WP-0006; event provenance, heartbeat evidence
+      and posture admission remain pending under KG-IN-0005.
     review: "2026-11-28"
     consequence: "secret-abuse posture lane stays fixture-driven"