docs: mark the unknown cell, measure the coverage we asked to publish

gate-house ruled the v0.8 assent round (GH-DEC-2026-011, net-kingdom@64394e9):
ask 1 declined, ask 2 adopted.

Ask 1's refusal is accepted without reservation and the reason is better than
the ask -- a sanctioned transitional fail_open is indistinguishable at runtime
from the stance the rule forbids, and would make the rule optional at the only
moment it costs anything.

Ask 2 gave §13.1 a Coverage column with this repo's figures as its first
entries. Since we asked for the column, we owe it accuracy:
scripts/report_coverage.py measures both populations from the artifacts the
runtime uses (reusing the workload-join build rather than re-deriving it), and
a test asserts pep-stance.yaml's published block equals what it measures.
A hand-counted number in a register that explicitly does not recompute it
decays silently, and a stale figure beside a marked cell is worse than the
blank the other four rows carry.

pep-stance.yaml marks the unknown cell inline as a declared gap -- assent, the
measured reason for not flipping, the declined ask, WARDEN-WP-0040 as route --
and a second test keeps it marked while it is fail_open, failing when it is
flipped. standard_version stays 0.7 because that is what binds; v0.8 is
proposed, so it gains standard_version_reviewed rather than pre-adopting.

Separately, gate-house corrected GH-DEC-2026-008: the claim/decision digest
comparison it originally required is unimplementable and a fail-closed
consumer obeying it would have denied permanently. We had never copied the
wording, so nothing to unwind -- but everything they have sent about this lane
was living in an inbox thread, a bad home for a correction that only matters
when someone finally wires the consume. Now wiki/ApprovalConsumption.md,
leading with "nothing is wired", carrying the corrected target and the
attribution gap that digest matching does not discharge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

history/2026-09-09-layer-model-v08-review.md

@@ -117,3 +117,59 @@ catalog stage is an accurate statement about their control, and making them
 assert a zone they cannot know would trade a real fact for a conformant fiction.
 The unavailability of cross-axis aggregation is better recorded than papered
 over, and §13.1 now says so.
+
+---
+
+## Ruling — GH-DEC-2026-011, 2026-09-09
+
+gate-house closed the assent round the same day: **ask 1 declined, ask 2
+adopted**, standard amended at `net-kingdom@64394e9`, dispositioned in
+`gate-house/docs/conformance/2026-09-06-v08-assent-round.md`.
+
+**Ask 1 (a dated transitional `unknown: fail_open`) — declined**, and the reason
+is better than the ask. A sanctioned transitional `fail_open` is
+*indistinguishable at runtime* from the stance the rule forbids, and it would make
+the rule optional at the moment of adoption — the only moment it costs anything.
+Dating an intention to stop being permissive does not make `unknown` any more
+expensive for an attacker to induce while the transition runs. Accepted without
+reservation; the argument defeats the ask on its own terms.
+
+**Ask 2 (coverage published beside stance) — adopted.** §13.1 now carries a
+Coverage column and this repo's figures are its first entries: *signing targets
+0/3 resolved; routing lanes 3/21 resolved (2026-09-09, self-measured)*. Three
+guards came with it, all of which we would have wanted: coverage does not soften
+the stance, does not gate it, and never makes a non-conformant cell conformant; a
+blank means "not reported" and never "complete"; and the decision carries an
+explicit reversal condition — if a row is ever argued to be conformant *because*
+its coverage is low, the column is doing harm and comes out.
+
+That reversal condition is the right shape and it binds us first, since the column
+exists because we asked. Our row reads non-conformant **and** low-coverage; those
+are two facts, and the second is not a defence of the first.
+
+**The deadlock was recorded rather than routed around.** §6.4 obligation 3 now
+states that a stricter stance is not a licence to manufacture the membership that
+makes it survivable — where a scope is unknown because another repository has
+published no workload-identity declaration, the consumer MUST NOT infer one. That
+is `ADR-0009` rule 3 promoted into the standard at exactly the point where the
+pressure lands, which is more than we asked for.
+
+### What we did in response
+
+- `pep-stance.yaml` marks the `unknown` cell as a **declared gap** inline, with
+  the assent, the measured reason for not flipping, the declined ask, and
+  `WARDEN-WP-0040` as its route. The stance value is unchanged — v0.8 is still
+  `proposed` and v0.7 remains in force, so `standard_version` stays `0.7` with a
+  new `standard_version_reviewed: 0.8`.
+- The coverage figures are published in `pep-stance.yaml` and, because we asked
+  for the column, **measured rather than hand-counted**:
+  `scripts/report_coverage.py` derives both populations from the artifacts the
+  runtime uses, reusing `report_workload_join.build` rather than re-deriving the
+  join. `tests/test_layer_conformance.py` asserts the published block equals the
+  measured one, and asserts the cell stays marked while it is `fail_open`.
+
+  A hand-counted figure in a register that explicitly does not recompute it would
+  decay silently, and a stale number beside a marked cell is worse than the blank
+  the other four rows carry — a blank at least reads as "not reported".
+- `WARDEN-WP-0040` T04 is closed; T01–T03 stand unchanged. gate-house confirmed
+  they are not asking for the cell to be flipped before coverage exists.