FLEX-WP-0031-T03: durable decision outbox and the FLEX-DEC-2026-018 release rule

internal/emission commits one audit-core-shaped event per decision with
fsync before release (one sync per batch), random event ids with the
decision id as correlation_id, torn-tail and failed-commit truncation, and
per-class committed/released_uncommitted counts at GET /v1/emission.
The engine releases restrictions whose record failed to commit and
withholds allow/audit_only (503). api.DecisionEffects() is pinned by a
source-parsing test and cadence.yaml must classify exactly it.

T03 split under the task budget: heartbeat+drain is T05, reconciliation,
profile check and PVC are T06. Nothing deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 307130@bnt-lap001
Assistant-Session: 270c79f7-0823-4b0d-990d-aad5af9935ce

internal/decision/emission_atomicity_test.go

@@ -0,0 +1,105 @@
+package decision_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/netkingdom/flex-auth/internal/decision"
+	"github.com/netkingdom/flex-auth/pkg/api"
+)
+
+// failingRecorder is an outbox whose commit always fails.
+type failingRecorder struct {
+	appends     int
+	batches     int
+	uncommitted []api.DecisionEffect
+}
+
+func (r *failingRecorder) Append(api.DecisionEnvelope) error {
+	r.appends++
+	return errors.New("disk full")
+}
+
+func (r *failingRecorder) AppendBatch([]api.DecisionEnvelope) error {
+	r.batches++
+	return errors.New("disk full")
+}
+
+func (r *failingRecorder) NoteReleasedUncommitted(effect api.DecisionEffect) {
+	r.uncommitted = append(r.uncommitted, effect)
+}
+
+var (
+	allowedRead = api.CheckRequest{
+		Subject:  api.SubjectRef{ID: "user:alice"},
+		Action:   "read",
+		Resource: api.ResourceRef{ID: "document:internal-note", System: "markitect-tool"},
+	}
+	deniedRead = api.CheckRequest{
+		Subject:  api.SubjectRef{ID: "user:alice"},
+		Action:   "read",
+		Resource: api.ResourceRef{ID: "document:missing", Type: "document", System: "markitect-tool"},
+	}
+)
+
+// FLEX-DEC-2026-018: withholding a deny turns it into an error an open-stance
+// consumer reads as proceed, so a restriction is released and counted.
+func TestUncommittedDenyIsReleasedAndCounted(t *testing.T) {
+	engine := newTestEngine(t)
+	recorder := &failingRecorder{}
+	engine.SetDecisionLog(recorder)
+
+	got, err := engine.Check(context.Background(), deniedRead)
+	if err != nil {
+		t.Fatalf("Check: %v; a restriction must never be withheld", err)
+	}
+	if got.Effect != api.DecisionEffectDeny {
+		t.Fatalf("effect = %q; want deny", got.Effect)
+	}
+	if len(recorder.uncommitted) != 1 || recorder.uncommitted[0] != api.DecisionEffectDeny {
+		t.Fatalf("released_uncommitted = %v; want [deny]", recorder.uncommitted)
+	}
+}
+
+// FLEX-DEC-2026-018: authority is never granted without its evidence.
+func TestUncommittedAllowIsWithheld(t *testing.T) {
+	engine := newTestEngine(t)
+	recorder := &failingRecorder{}
+	engine.SetDecisionLog(recorder)
+
+	got, err := engine.Check(context.Background(), allowedRead)
+	if !errors.Is(err, decision.ErrRecordNotCommitted) {
+		t.Fatalf("err = %v, decision = %+v; want ErrRecordNotCommitted", err, got)
+	}
+	if len(recorder.uncommitted) != 0 {
+		t.Fatalf("a withheld allow was counted as released: %v", recorder.uncommitted)
+	}
+}
+
+func TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow(t *testing.T) {
+	engine := newTestEngine(t)
+	recorder := &failingRecorder{}
+	engine.SetDecisionLog(recorder)
+
+	_, err := engine.BatchCheck(context.Background(), api.BatchCheckRequest{
+		Subject:   allowedRead.Subject,
+		Action:    "read",
+		Resources: []api.ResourceRef{allowedRead.Resource, deniedRead.Resource},
+	})
+	if !errors.Is(err, decision.ErrRecordNotCommitted) {
+		t.Fatalf("err = %v; want ErrRecordNotCommitted for a batch holding an allow", err)
+	}
+	if recorder.batches != 1 || recorder.appends != 0 {
+		t.Fatalf("batches=%d appends=%d; want one batch commit", recorder.batches, recorder.appends)
+	}
+
+	decisions, err := engine.BatchCheck(context.Background(), api.BatchCheckRequest{
+		Subject:   deniedRead.Subject,
+		Action:    "read",
+		Resources: []api.ResourceRef{deniedRead.Resource},
+	})
+	if err != nil || len(decisions) != 1 {
+		t.Fatalf("restriction-only batch: decisions=%v err=%v; want it released", decisions, err)
+	}
+}