Record the application of GH-DEC-2026-017 across four repositories.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/assessments/2026-09-21-layer-declaration-boundaries.md

@@ -199,3 +199,25 @@ both: `railiance-master` supplied the §3 citations, `informed-decision`
 narrowed its own request rather than re-litigating, and gate-house's scope rule
 names the defect generally. The custodian's contribution that survived is the
 §3-`Engines`/§4-`Engine` disagreement, which became amendment A9.
+
+## Application, 2026-09-21
+
+- **ops-warden** applied GH-DEC-2026-017 to the reference form after verifying
+  it at `gate-house@def0af2`. Its conformance checker listed `standard_version`
+  as required, so any repository that copied the checker must drop the key from
+  the checker's required list in the same commit, or a conforming declaration
+  fails `MALFORMED`. Change set: `ops-warden/wiki/playbooks/netkingdom-layer-declaration.md`.
+- **flex-auth** fixed its validator (four tokens, ASCII fold, §4 spelling, scope
+  stated per run), published per-class emission guarantees in `cadence.yaml`,
+  and holds G2 as a dated declared gap to 2026-10-19 under FLEX-WP-0031.
+  FLEX-DEC-2026-015: `resource.system` follows the runtime, not the repository.
+- **informed-decision** declares `Staff`/`pep-shaped` and asked for a §4 row with
+  its guarantee reported as owed. The §3.4 fit — Staff is defined as
+  non-deterministic; this repository is deterministic by test — stays open as
+  INFD-IN-0007.
+- **secrets-engine** established that its exec reads the ungoverned legacy path
+  `secret/coulomb/whynot-design/npm/publish` (field `npm_token`), while ops-warden's
+  runbook rotates the governed path (field `NPM_AUTH_TOKEN`). A rotation per the
+  runbook would not reach the live publish path. Held for the operator.
+
+Ten repositories still carry the pre-ruling sidecar form.