Withhold uncommitted decision effects and pin accepted layer canon

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

workplans/FLEX-WP-0031-decision-record-emission.md

@@ -14,7 +14,7 @@ related_workplans:
   - FLEX-WP-0030
   - FLEX-WP-0019
 created: "2026-09-21"
-updated: "2026-10-04"
+updated: "2026-10-10"
 state_hub_workstream_id: "84f5d9fe-b4c9-584a-b964-efe3e48af095"
 ---
 
@@ -279,3 +279,43 @@ implementation and its native acceptance. See
 preparation no longer wait on another repository, but admission, statutory
 ruling, valid reconciliation time basis and approved native acceptance do.
 `cadence.yaml` remains `declared-not-yet-emitting` and G2 remains open.
+
+## 9. Enforce the accepted mandatory-emission ruling in source
+
+```task
+id: FLEX-WP-0031-T09
+status: done
+priority: high
+state_hub_task_id: "02a8d006-cc70-5a0e-b773-6924f05540ed"
+```
+
+2026-10-10: implemented `GH-DEC-2026-024` §3, the accepted refusal of
+load-bearing failure-path release. This corrects the source release behavior
+described under T01/T03; those dated entries remain historical evidence of
+`FLEX-DEC-2026-018`, not the current implementation. No new human decision is
+needed to implement the accepted doctrine in source.
+
+With a required recorder attached, a failed durable append now withholds every
+effect, including deny/redact/not_applicable. Single checks, restriction-only
+batches, list-allowed and application readback retain the existing
+`ErrRecordNotCommitted` / HTTP 503 availability representation. No replacement
+allow or deny is manufactured. Uncommitted results are not inserted into
+Explain's history, and no released-uncommitted counter is incremented. Existing
+historical outbox counters and their reporting remain readable. Standalone
+operation without an attached recorder remains unchanged; no source change
+enables production emission or claims that an unconfigured pin is conformant.
+
+Tests inject commit failure across the complete five-effect vocabulary, check
+that Explain cannot expose uncommitted results and can expose committed ones,
+exercise actual restrictive single/batch/list policy paths, and verify
+restrictive enforcement and readback HTTP 503. Affected package suites pass:
+`go test ./internal/decision ./internal/emission ./internal/readback
+./cmd/access-engine ./pkg/api`.
+
+This source fix is not deployed. Consumer outage behavior remains governed by
+each declared PEP stance: a consumer with an open-for-scope stance can treat
+unavailable evaluation as proceed, so the exact rollout must review those
+stances rather than claim that a 503 enforces denial. T02 native sender/custody,
+T06 compatible reconciliation windows, T08 exact approved rollout and silence
+proof, and T04 G2 closure remain unfinished. `cadence.yaml` remains declared,
+and the emission completeness gap remains open until native acceptance.

workplans/FLEX-WP-0035-per-identity-application-readback.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Per-identity application access readback and readable protected-system registry for user-engine"
 domain: infotech
 repo: access-engine
-status: active
+status: finished
 owner: claude
 topic_slug: netkingdom
 created: "2026-10-09"
-updated: "2026-10-09"
+updated: "2026-10-10"
 related: [USER-WP-0026, USER-WP-0028]
 state_hub_workstream_id: "cb9755fa-6824-5288-81c4-3aa2fbff1a9f"
 ---
@@ -191,3 +191,27 @@ without a token, `/v1/check` returns 404 on the readback pin, anonymous lifecycl
 user-engine's live check with its own token is still to come.
 The pin ships with the image that contains `serve-readback`. Hand user-engine
 the evidence that unblocks `USER-WP-0026-T03`.
+
+## Completion review — 2026-10-10
+
+All five tasks are done. Fresh read-only verification on railiance01 (node
+92.205.62.239) confirms the lifecycle and application-readback deployments
+are each Ready 1/1 on identical immutable image
+`sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229`.
+Readback ingress is restricted to the `user-engine` namespace and
+`app.kubernetes.io/name=user-engine` pods on port 8080. The source regression
+run `go test ./cmd/access-engine ./pkg/api -run 'TestReadback|TestPurpose'
+-count=1` passes, including participant image/package parity, non-transferable
+readback purpose, unauthorized-caller refusal, enforcement-route isolation,
+MFA denial, response schema and outbox failure handling.
+
+The earlier task records retain founder rollout authority and native anonymous
+route/health receipts; this review performed no deployment or credential action.
+
+The consumer integration and actual user-engine token probe remain live in the
+existing owner task `USER-WP-0026-T03` (and the related consumer UI task
+`USER-WP-0028-T02`). Those checks do not require unfinished Access Engine
+implementation. The service contract and URL are in this workplan and
+`docs/application-access-readback.md`. No new residual workplan is needed: the
+receiving owner records already carry the work. This closure does not assert
+that the consumer has integrated or that other applications opted in.