Implement the engine spine: claim, outbox, machine, API

Contracts first (T02–T04): approval claim schema with issuer, freshness,
and binding digest; local transactional outbox wire; load-bearing cadence
as heartbeat or reconciliation (layer.yaml declared).

Then the object (T06–T08): SQLite closed state machine, CAS supersession,
distinct-approver fail-closed, revocation without holder cooperation,
outbox insert in the same transaction. Tests fail the mutation when
emission fails, and revoke while the drain sink is down.

Introspection GET /v1/approvals/{id}/claim is a PIP fact, not a decision.
No public consume (T05 waits on GH-WP-0002-T06). Canon T-06 coverage for
wrong binding, expiry, revoke, and supersede.

FLEX-WP-0017 T03 is unblocked on this object; T05 remains blocked only on
consumption ordering.

Assistant: grok
Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9

cadence.yaml

@@ -0,0 +1,38 @@
+# Source-side emission cadence for load-bearing approval evidence.
+# Statute §9.6; detection surface GH-WP-0002-T04.
+schema_version: "0.1"
+source: approval-engine
+kind: load-bearing
+form: heartbeat-or-reconciliation
+rate_monitoring: forbidden
+
+heartbeat:
+  class: heartbeat
+  interval: 24h
+  assertion: nothing-to-report
+  missing: finding
+
+reconciliation:
+  compare:
+    local: committed outbox counts per class
+    remote: "audit-core event counts where source=approval-engine"
+  divergence: finding
+  undrained_local: lag-not-divergence
+
+lag_bound:
+  outbox_depth: 100
+  outbox_age: 1h
+  exceed: finding
+
+classes:
+  issuance:
+    action: approval.issuance
+  use:
+    action: approval.use
+    note: "Internal CAS only until GH-WP-0002-T06."
+  supersession:
+    action: approval.supersession
+  revocation:
+    action: approval.revocation
+  heartbeat:
+    action: approval.heartbeat