Give the playbook one reference version detector and a VALIDATED_AGAINST rule.

Reference practice, not a ruling: copies diverged on key matching and on prose,
and on naming v0.7 versus the held v0.8. Prose citations under A12 are marked
pending with gate-house.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

wiki/playbooks/netkingdom-layer-declaration.md

@@ -122,6 +122,53 @@ from this page.
    (`tests/test_layer_conformance.py` has the reference set). Change declaration,
    checker and tests in the same commit, and re-spell no layer value.
 
+### Reference detector and `VALIDATED_AGAINST` — practice, not a ruling
+
+The estate's checkers each wrote their own version detector in the 020 round, and
+they diverge: some flag any key *ending* in `version`, some any key *containing*
+it, one flags `vN.N` anywhere in prose while the others ignore prose. The
+checkers also disagree on what `VALIDATED_AGAINST` names. Neither point is
+ruled by `GH-DEC-2026-020`. What follows is the reference form to copy so the
+copies stop diverging; it is steward's practice, and a gate-house ruling wins
+over it.
+
+**One detector.** Copy this from ops-warden's checker as-is:
+
+```python
+VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I)
+VERSION_IN_VALUE = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I)
+NOT_REACHED_KEYS = {"schema_version"}
+
+def find_version_pins(node, where=""):  # walk every parsed key and value
+    ...  # see scripts/check_layer_conformance.py
+```
+
+- **Keys:** flag a key that names a *standard or companion* version
+  (`standard_version`, `companion_version`, `standard_version_reviewed`) — not
+  every key containing `version`. `schema_version` is the file's own schema and
+  is skipped (A12 r2).
+- **Values:** flag a version carried in a *file name or path* (`_v0.7`,
+  `-v0.8.md`, `@0.7`) — the `standard: …_v0.7.md` case §1 rules on.
+- **Comments:** never read; the detector runs on parsed YAML, so they are gone.
+- **Prose citations in a value** (e.g. a rationale string saying "the v0.5 scope
+  rule"): **pending.** Whether A12 reaches them is an open question to
+  gate-house. The reference detector deliberately does not flag a bare `vN.N`
+  preceded by a space, so it neither enforces nor waives an answer that has not
+  been given. Do not widen or narrow this in your copy until gate-house rules.
+
+**Name the text in force.** While v0.8's acceptance flip is held
+(`GH-DEC-2026-019`), `VALIDATED_AGAINST` names the **accepted** text —
+`security-layer-model_v0.7.md`, with a net-kingdom commit — plus the decision
+records whose amendments already govern (`GH-DEC-2026-017`, `GH-DEC-2026-020`),
+with a gate-house commit. Naming the proposed v0.8 states a check against text
+that does not yet govern. Change it in the same commit that follows the flip.
+ops-warden's constant is the example:
+
+```text
+net-kingdom/canon/standards/security-layer-model_v0.7.md (net-kingdom@66dc491)
+as amended by GH-DEC-2026-017 and GH-DEC-2026-020 (A9-A13, A12 r2; gate-house@d8c82a8)
+```
+
 **Citation.** Cite the ruling by the decision's body section: `GH-DEC-2026-017`
 §5, statute A12 (now A12 r2). This page's "§5" is canonical
 (`GH-DEC-2026-020`); the decision's `rationale:` part numbers are a summary and