Record the GH-DEC-2026-020 round and the detector divergence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/assessments/2026-09-21-layer-declaration-boundaries.md

@@ -245,3 +245,18 @@ disk. The repositories' own reports had suggested a 3–3 split on the versioned
   its deploy manifests. TEN-IN-0005; this needs an operator credential path.
 - **secrets-engine** surfaced a question: the service JWT design names
   `tenant:coulomb`, but the approval chain resolved to `tenant:platform`.
+
+## Third round, 2026-09-21: GH-DEC-2026-020
+
+gate-house ruled what A12 reaches (GH-DEC-2026-020, A12 r2):
+- **Reached:** a version in the `standard:` path, and `companion_version`.
+- **Not reached:** stance, claims and classification maps.
+- **Checkers:** a re-runnable checker is sufficient if every run prints the version it checked against and its scope. kings-guard's `VALIDATED_AGAINST` pattern is the reference.
+
+It is applied in eleven repositories. whitehat-security, which never received GH-DEC-2026-017 and which the custodian's rounds had also missed, applied both rulings.
+
+The round produced the same failure a third time, now in the checkers: each wrote its own version detector, and they disagree. Measured:
+- **Prose citations:** eight declarations carry a prose version citation, including gate-house's own. Seven carry the same inherited sentence, "Outside §5 by the v0.5 scope rule". The repositories split four ways on handling it while gate-house's ruling is pending.
+- **`VALIDATED_AGAINST`:** five checkers name the v0.7 text in force; tenant-engine and flex-auth name the held v0.8.
+
+ops-warden wrote one reference detector into its playbook (0f9ada0). All of this went to gate-house, with a proposed additional v0.8 flip condition.