Implement the engine spine: claim, outbox, machine, API

Contracts first (T02–T04): approval claim schema with issuer, freshness,
and binding digest; local transactional outbox wire; load-bearing cadence
as heartbeat or reconciliation (layer.yaml declared).

Then the object (T06–T08): SQLite closed state machine, CAS supersession,
distinct-approver fail-closed, revocation without holder cooperation,
outbox insert in the same transaction. Tests fail the mutation when
emission fails, and revoke while the drain sink is down.

Introspection GET /v1/approvals/{id}/claim is a PIP fact, not a decision.
No public consume (T05 waits on GH-WP-0002-T06). Canon T-06 coverage for
wrong binding, expiry, revoke, and supersede.

FLEX-WP-0017 T03 is unblocked on this object; T05 remains blocked only on
consumption ordering.

Assistant: grok
Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9

tests/test_cas.py

@@ -0,0 +1,70 @@
+import tempfile
+import threading
+from pathlib import Path
+
+from approval_engine.errors import Conflict
+from approval_engine.store import Engine
+from tests.conftest import approve
+
+
+def test_second_supersession_loses(engine):
+    obj = approve(engine)
+    first = engine.supersede(obj.id)
+    assert engine.get(obj.id).status == "superseded"
+    assert first["successor_id"]
+    try:
+        engine.supersede(obj.id)
+        raise AssertionError("second supersession must conflict")
+    except Conflict:
+        pass
+    claim = engine.claim(obj.id)
+    assert claim["valid_now"] is False
+    assert claim["reason_code"] == "superseded"
+
+
+def test_concurrent_supersessions_one_winner():
+    with tempfile.TemporaryDirectory() as tmp:
+        path = Path(tmp) / "a.sqlite"
+        setup = Engine(path)
+        obj = approve(setup)
+        setup.close()
+
+        winners: list[str] = []
+        errors: list[str] = []
+        barrier = threading.Barrier(2)
+
+        def race():
+            eng = Engine(path)
+            barrier.wait()
+            try:
+                result = eng.supersede(obj.id)
+                winners.append(result["successor_id"])
+            except Conflict as exc:
+                errors.append(str(exc))
+            finally:
+                eng.close()
+
+        threads = [threading.Thread(target=race) for _ in range(2)]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+        assert len(winners) == 1
+        assert len(errors) == 1
+        check = Engine(path)
+        assert check.get(obj.id).status == "superseded"
+        check.close()
+
+
+def test_internal_consume_cas_once(engine):
+    obj = approve(engine)
+    engine._cas_consume(obj.id)
+    try:
+        engine._cas_consume(obj.id)
+        raise AssertionError("double consume must conflict")
+    except Conflict:
+        pass
+    claim = engine.claim(obj.id)
+    assert claim["consumed"] is True
+    assert claim["valid_now"] is False
+    assert claim["reason_code"] == "consumed"