FLEX-WP-0035 T01-T03: application access readback pin

Contract accepted by user-engine; FLEX-DEC-2026-019 accepted.
- serve-readback: dedicated pin, no enforcement routes, own caller binding
- CheckRequest.purpose hashed into every digest when set; /v1/check refuses it
- POST /v1/readback/application_access and GET /v1/readback/systems
- optional client_binding on protected systems; readback schemas
- schemaguard implements maxItems
- T05 added: informed-decision needs an application.access rule over
  realm-level claims (its lifecycle rules read authentication_audience)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

decisions/decisions.md

@@ -2084,8 +2084,8 @@ flex-auth suppressing a record together with its own count.
 ## FLEX-DEC-2026-019 — Application access readback is a per-package opt-in action, advisory by binding, served from a dedicated pin
 
 **Date:** 2026-10-09
-**Status:** proposed (pending user-engine review)
-**Workplan:** `FLEX-WP-0035-T01`
+**Status:** accepted 2026-10-09 (user-engine review, message `f54df082`)
+**Workplan:** `FLEX-WP-0035-T01`; implemented in T02/T03 (`serve-readback`)
 **Contract:** `docs/application-access-readback.md`
 
 **Question.** How does access-engine tell user-engine which applications a
@@ -2110,3 +2110,7 @@ without letting registry content decide an allow?
    `lifetime.expires_at`. Readback decisions are recorded as their own
    non-load-bearing `readback` event class under `FLEX-DEC-2026-018`.
 5. **Grants stay inside access-engine.** No user-domain grant surface.
+6. **Rules read realm-level claims only** (review amendment). Forwarded claims
+   were issued for user-engine's client, so an `application.access` rule that
+   reads audience, authorized party or client-scoped roles answers for the
+   wrong client. This is a package-review checklist item.