Finish approval engine spine

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

docs/flex-auth-handoff.md

@@ -8,6 +8,8 @@
 - Claim contract: [`approval-claim.md`](approval-claim.md)
 - Introspection: `GET /v1/approvals/{id}/claim`
 - Object: `POST /v1/approvals`, entries, revoke, supersede
+- Consumption: `POST /v1/approvals/{id}/consume`, called by the PEP before the
+  protected side effect under `GH-DEC-2026-003`
 - Native `binding.digest` plus optional `binding.pdp_digest` for
   `NewDecisionBinding.request_digest`
 
@@ -15,12 +17,15 @@ T03 is unblocked on the **object**, not on a hub substitute. Validate the
 claim before privileged production actions. Fail closed if this engine is
 unreachable.
 
-## What does not exist yet
+## Consumption contract
 
-Consumption ordering (`GH-WP-0002-T06` / `APPROVAL-WP-0001-T05`). There is
-no public `consume`. `FLEX-WP-0017` T05 stays blocked **only** on that
-contract, not on a missing object or a missing digest.
+Gate House settled ordering in `GH-DEC-2026-003` and
+`docs/contracts/approval-consumption.md`. The PEP presents the decision
+binding's `request_digest` and consumes by CAS before the protected side
+effect. A same-digest retry is idempotent success; a different digest conflicts;
+there is no unconsume. `access-engine` remains read-only and never calls this
+mutation.
 
 Canon T-06 against this implementation: `tests/test_t06_replay.py` (wrong
-target, wrong action, later time, revoked, superseded). Consume-side replay
-is out of scope until T05.
+target, wrong action, later time, revoked, superseded, same-digest retry, and
+different-digest consume replay).