docs(canon): reconcile workload and tenant grouping semantics

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

canon/standards/security-zones_v0.1.md

@@ -1,10 +1,21 @@
 ---
-id: security-zones_v0.1
+id: netkingdom-security-zones-v0.1
 type: standard
+title: "NetKingdom Security Zones v0.1"
+domain: netkingdom
 status: proposed
+version: "0.1"
 owner: zone-engine
 publication_owner: net-kingdom
-date: "2026-08-22"
+created: "2026-08-22"
+updated: "2026-08-22"
+last_reviewed: "2026-08-22"
+review_interval: 3m
+source_revision: "zone-engine@a510393"
+standard_token: security-zones_v0.1
+related:
+  - canon/standards/tenancy-posture_v0.1.md
+  - repo-manager/docs/adr-004-authoritative-workload-declarations.md
 ---
 
 # NetKingdom Security Zones v0.1
@@ -313,8 +324,8 @@ conformant.
 
 ## 9. Time-boxed exceptions
 
-The normative lifecycle is the T04 decision in
-`docs/exception-lifecycle-2026-08-22.md`: only the control owner's designated
+The normative lifecycle is the ZONE-WP-0001-T04 decision in
+`zone-engine/docs/exception-lifecycle-2026-08-22.md`: only the control owner's designated
 authority grants a named-workload, named-zone, named-control relaxation within a
 declared maximum duration. Enforcement applies it only for
 `not_before <= now < not_after`; invalid or unevaluable records are inactive,