Apply GH-DEC-2026-020: checker prints version and scope, A12 r2 by content.

The layer conformance checker now prints VALIDATED_AGAINST and SCOPE on every
run, including the PASS line (kings-guard pattern), and enforces A12 r2 over
every key and value of INTENT.md frontmatter and layer.yaml: a versioned
standard: path and a companion_version are caught, schema_version and comments
are not reached, pep-stance.yaml is outside the run. Tests guard both returns.
The playbook carries the adopter change set and confirms the section 5
citation is canonical. WARDEN-WP-0034's open 4220413a note is closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

wiki/playbooks/netkingdom-layer-declaration.md

@@ -51,8 +51,10 @@ anyone else's files.
    property that does not change when the standard is revised, and a version in
    the declaration makes every revision read as though it invalidated every
    declaration. Keeping it "for information" was declined explicitly — a field
-   that is present will be branched on. Version-scoped state belongs in the
-   derived conformance record. If your checker lists `standard_version` as a
+   that is present will be branched on. Version-scoped state belongs to the
+   conformance *run* (see the 2026-09-21 `GH-DEC-2026-020` section below; the
+   "derived conformance record" this line used to name was a defect in §5 and
+   nobody is required to emit one). If your checker lists `standard_version` as a
    required key, or prints it in a report line, it will now **reject a conforming
    declaration** — fix the checker in the same commit.
 2. **Add `derived: true` and `derived_from: INTENT.md`.** The sidecar is a derived
@@ -82,6 +84,49 @@ ops-warden's applied instance of this change set is commit-local: `INTENT.md`,
 `layer.yaml`, `scripts/check_layer_conformance.py`, `tests/test_layer_conformance.py`.
 Read those four together rather than the sidecar alone.
 
+## Reach and run-version change set — 2026-09-21 (`GH-DEC-2026-020`, A12 r2)
+
+**If you copied ops-warden's checker before this change, it enforces A12 by key
+name only, and prints no version.** Both are now defects. `GH-DEC-2026-020`
+refines A12 as A12 r2; verify it in `gate-house` `decisions/decisions.md` and
+`docs/amendments/v0.8-section-11-declaration-amendments.md` (§ "A12 r2"), not
+from this page.
+
+1. **A version anywhere in the declaration counts.** The declaration is every key
+   and value of your `INTENT.md` frontmatter and of your derived sidecar. No key
+   or value carries a version of the standard **or of its companion**, including
+   a version-bearing path: `standard: .../security-layer-model_v0.7.md` becomes
+   `standard: .../security-layer-model` (`GH-DEC-2026-020` §1). A de-versioned
+   path was a required change, not a voluntary one.
+2. **`companion_version` counts** and comes out of the declaration (§2).
+3. **Not reached:** comments, and a file's own `schema_version`. Keeping or
+   removing them is equally fine; do not edit them just to tidy.
+4. **Not a declaration, not checked:** stance maps (`pep-stance.yaml`), claims
+   maps, evidence classifications. Their version is what makes them re-readable
+   when clause text changes; keep it. Your checker **MUST NOT** apply A12 to
+   them (§3).
+5. **The version belongs to the run.** A re-runnable checker is sufficient —
+   not "for now" — if **every** run prints the standard version or commit it
+   checks against and the scope it ranged over, including the PASS line (§4).
+   No repository must emit a durable conformance record; whoever retains a run's
+   output owes that copy's version. The pattern is kings-guard's: a
+   `VALIDATED_AGAINST` constant in the checker, printed on every run.
+6. **Widen your checker from key name to content.** ops-warden's
+   `scripts/check_layer_conformance.py` now carries `VALIDATED_AGAINST`, `SCOPE`
+   and `find_version_pins()`, which walks every parsed key and value, skips
+   `schema_version`, and flags any key naming a standard/companion version and
+   any value carrying a versioned file name or path. It prints version and scope
+   before loading anything, so even a MALFORMED run states them. Copy that, set
+   `VALIDATED_AGAINST` to what *your* run checks against, and add tests that fail
+   if a versioned `standard:` path or a `companion_version` comes back
+   (`tests/test_layer_conformance.py` has the reference set). Change declaration,
+   checker and tests in the same commit, and re-spell no layer value.
+
+**Citation.** Cite the ruling by the decision's body section: `GH-DEC-2026-017`
+§5, statute A12 (now A12 r2). This page's "§5" is canonical
+(`GH-DEC-2026-020`); the decision's `rationale:` part numbers are a summary and
+are not cited.
+
 ## Ownership boundary
 
 `gate-house` owns what the model requires. Each repository owns the truth of its