Preserve fractional approval expiry through atomic consumption

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/approval-consumption.md

@@ -42,6 +42,24 @@ after consumption, the approval remains spent and a retry needs a new approval.
 The response is mutation evidence, not a permission decision. It contains no
 `effect`, `allow`, `deny`, or decision result.
 
+## Authoritative time and fractional precision
+
+New source preserves the actual aware UTC clock's microseconds rather than
+rounding down to whole seconds. The first consume samples one instant after
+`BEGIN IMMEDIATE` acquires its write lock, then uses that instant for the
+not-before/inclusive and expiry/exclusive check, persisted `consumed_at` and
+`updated_at`, and use-event occurrence/creation time. Lock wait cannot borrow
+an earlier validity instant or stamp evidence before actual admission.
+
+Existing whole-second ISO strings remain valid and are never backfilled with
+invented fractions. Idempotent responses and object readback retain the original
+recorded timestamp/decision exactly, even after expiry; they do not renew
+execution authority. The store schema, API keys, CAS/digest correspondence and
+no-unconsume rule are unchanged. Claim observation/freshness and other new
+source timestamps also retain actual clock precision. Consumers must parse
+aware ISO/RFC3339 timestamps including fractional seconds instead of assuming
+a fixed-width whole-second string. No clock skew or early-use tolerance is added.
+
 ## The claim response is not an `ActionAuthorization`
 
 `GET /v1/approvals/{id}/claim` serves the **approval-claim** envelope defined in