diff --git a/docs/assessments/2026-09-21-layer-declaration-boundaries.md b/docs/assessments/2026-09-21-layer-declaration-boundaries.md
index a83afbf..7d4ab44 100644
--- a/docs/assessments/2026-09-21-layer-declaration-boundaries.md
+++ b/docs/assessments/2026-09-21-layer-declaration-boundaries.md
@@ -260,3 +260,28 @@ The round produced the same failure a third time, now in the checkers: each wrot
 - **`VALIDATED_AGAINST`:** six checkers name the v0.7 text in force; tenant-engine and flex-auth name the held v0.8.
 
 ops-warden wrote one reference detector into its playbook (0f9ada0). All of this went to gate-house, with a proposed additional v0.8 flip condition.
+
+## Fourth round, 2026-09-21: GH-DEC-2026-021 and B2 closed
+
+gate-house ruled the third round's findings in GH-DEC-2026-021:
+- **Prose citations:** the narrow reading. A12 reaches only a version carried as a pin, so no declaration changes. The ruling notes that this reading benefits gate-house. The wording is drafted as A12 r3 and sent for assent.
+- **VALIDATED_AGAINST:** checkers name the accepted v0.7 plus the gate-house decisions they enforce. tenant-engine and flex-auth re-point now.
+- **Detector:** ops-warden's playbook detector is the estate reference. Each copy converges on it when next edited, and no later than the post-flip commit.
+- **Flip:** not added to GH-DEC-2026-019, because it would be circular as a precondition. Instead it is a post-flip task, GH-WP-0004-T11, and the flip notice must name all eight checkers.
+- **A11 r2:** permits a single-repository conformance run.
+
+B2 is closed. All four undeclared repositories declared their own layer:
+
+| Repository | Layer |
+|---|---|
+| gate-house | Staff |
+| key-cape | Tooling |
+| ops-mason | Staff, pep-shaped |
+| net-kingdom | Taxonomy |
+
+Each reading agrees with §4, and GH-DEC-2026-019's third closing condition is met. Three things surfaced:
+- **key-cape:** its token endpoint has the shape of a PIP, and its authentication enforcement sits where §3.3 places enforcement boundaries. It read both as Tooling behaviour.
+- **ops-mason:** it writes OpenBao policies and auth roles, creates secret_ids and runs `kubectl apply`, gated by the founder approving the plan rather than by an access-engine decision. Its own earlier review note said otherwise. These are declared as dated gaps to 2026-12-21.
+- **net-kingdom:** the canon repository carries runtime material, `identity-provisioner/` and `sso-mfa/k8s/`.
+
+Still open: A11 r2 and A12 r3 assent, INFD-IN-0007 (the §3 cut, outside the §11 hold), and the role vocabulary after A9.