Finish approval engine spine

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

INTENT.md

@@ -215,23 +215,21 @@ proposed, not assigned), this engine publishes the contract at its own
 boundary and yields to the schema when it exists. Inventing a permanent local
 shape is the drift §17 exists to prevent.
 
-## Consumption Ordering — Unresolved
+## Consumption Ordering — Resolved by GH-DEC-2026-003
 
-The decision precedes the action, and the action precedes consumption. Three
-failure modes are named, and each needs an owner (standard §9.7.4, §16):
+The decision precedes consumption, and consumption precedes the protected
+side effect. Gate House settled this in `GH-DEC-2026-003` and
+`docs/contracts/approval-consumption.md`. Three failure modes are named:
 
 - an allow rendered against an approval that is then never consumed;
 - an approval consumed twice by racing callers;
 - an approval consumed after the action it authorized has already failed.
 
-`approval-engine` performs the mutation, because `access-engine` never mutates.
-But *who signals consumption, at what point relative to the decision, and what
-happens on each of the three states above* is a contract between the two engines
-and is **not yet settled**. It is recorded in the standard's §16, in
-`GH-WP-0002-T06`, and is required before `FLEX-WP-0017` T05. Raised by
-`flex-auth`.
-
-Nothing here may be implemented by guessing that contract.
+The PEP signals consumption by presenting the decision binding's canonical
+request digest to this engine. approval-engine performs the CAS before the PEP
+acts; `access-engine` never mutates. Same-digest retries are idempotent success,
+different digests conflict, and a failure after consume leaves the approval
+spent. There is no unconsume.
 
 ## What approval-engine Does Not Own
 
@@ -306,9 +304,9 @@ word under standard §8, and this engine must never claim it.
 - **It claims the outbox closes omission.** Atomicity covers crash. Treating it
   as covering a compromised source, or skipping the heartbeat, is the v0.6
   overclaim this engine must not reintroduce.
-- **It implements consumption by guessing.** The three races are named and
-  unowned. Code that picks a side is a contract with `access-engine` that
-  `access-engine` has not assented to.
+- **It diverges from the consumption contract.** PDP mutation,
+  action-before-consume, different-digest reuse, or unconsume violates
+  `GH-DEC-2026-003`.
 - **It cites observation or containment that has not happened.** Nothing is
   observed in production, and nothing can be contained automatically
   (companion §10).
@@ -329,5 +327,6 @@ word under standard §8, and this engine must never claim it.
    rendered against approval A for request R cannot be replayed for request R';
 7. load-bearing classes declare a heartbeat or reconciliation, and divergence
    from `audit-core`'s event count is a finding;
-8. consumption is not implemented until `GH-WP-0002-T06` settles the contract;
+8. consumption implements `GH-DEC-2026-003`, including atomic use evidence,
+   same-digest idempotency, different-digest conflict, and no unconsume;
 9. `FLEX-WP-0017` T03 and T05 are unblocked.