FLEX-WP-0031-T03: durable decision outbox and the FLEX-DEC-2026-018 release rule

internal/emission commits one audit-core-shaped event per decision with
fsync before release (one sync per batch), random event ids with the
decision id as correlation_id, torn-tail and failed-commit truncation, and
per-class committed/released_uncommitted counts at GET /v1/emission.
The engine releases restrictions whose record failed to commit and
withholds allow/audit_only (503). api.DecisionEffects() is pinned by a
source-parsing test and cadence.yaml must classify exactly it.

T03 split under the task budget: heartbeat+drain is T05, reconciliation,
profile check and PVC are T06. Nothing deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 307130@bnt-lap001
Assistant-Session: 270c79f7-0823-4b0d-990d-aad5af9935ce

internal/emission/outbox_test.go

@@ -0,0 +1,180 @@
+package emission_test
+
+import (
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+
+	"github.com/netkingdom/flex-auth/internal/emission"
+	"github.com/netkingdom/flex-auth/pkg/api"
+)
+
+func deny(id, tenant string) api.DecisionEnvelope {
+	return api.DecisionEnvelope{
+		ID:       id,
+		Effect:   api.DecisionEffectDeny,
+		Resource: api.ResourceRef{ID: "t1", Type: "tenant", System: "tenant-engine"},
+		Binding:  &api.DecisionBinding{Tenant: tenant},
+	}
+}
+
+func readEvents(t *testing.T, dir string) []map[string]any {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(dir, "outbox.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var events []map[string]any
+	for _, line := range splitLines(data) {
+		var e struct {
+			Event map[string]any `json:"event"`
+		}
+		if err := yaml.Unmarshal(line, &e); err != nil {
+			t.Fatal(err)
+		}
+		events = append(events, e.Event)
+	}
+	return events
+}
+
+func splitLines(data []byte) [][]byte {
+	var lines [][]byte
+	start := 0
+	for i, b := range data {
+		if b == '\n' {
+			lines = append(lines, data[start:i])
+			start = i + 1
+		}
+	}
+	return lines
+}
+
+func TestCommittedEventsCarryAuditCoreRequiredFields(t *testing.T) {
+	dir := t.TempDir()
+	outbox, err := emission.Open(dir, "flex-auth.tenant-engine")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Identical checks share a content-digest decision id.
+	if err := outbox.AppendBatch([]api.DecisionEnvelope{deny("decision:aa", ""), deny("decision:aa", "tenant:acme")}); err != nil {
+		t.Fatal(err)
+	}
+	outbox.Close()
+
+	events := readEvents(t, dir)
+	if len(events) != 2 {
+		t.Fatalf("events = %d; want 2", len(events))
+	}
+	// audit-core normalize() rejects an event missing any of these.
+	for _, event := range events {
+		for _, key := range []string{"id", "type", "source", "subject", "tenant", "correlation_id", "occurred_at", "data"} {
+			if value, ok := event[key]; !ok || value == "" || value == nil {
+				t.Fatalf("event missing %q: %v", key, event)
+			}
+		}
+		if event["type"] != "flex-auth.decision.deny" || event["correlation_id"] != "decision:aa" {
+			t.Fatalf("event = %v", event)
+		}
+	}
+	if events[0]["id"] == events[1]["id"] {
+		t.Fatal("two decisions share an event id; audit-core idempotency would merge them")
+	}
+	if events[0]["tenant"] != emission.PlatformTenant || events[1]["tenant"] != "tenant:acme" {
+		t.Fatalf("tenants = %v, %v", events[0]["tenant"], events[1]["tenant"])
+	}
+}
+
+func TestCountsSurviveRestartAndTornTailIsDropped(t *testing.T) {
+	dir := t.TempDir()
+	outbox, err := emission.Open(dir, "flex-auth.test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := outbox.Append(deny("decision:1", "")); err != nil {
+		t.Fatal(err)
+	}
+	outbox.Close()
+
+	// A crash mid-write leaves a line with no newline.
+	f, _ := os.OpenFile(filepath.Join(dir, "outbox.jsonl"), os.O_APPEND|os.O_WRONLY, 0)
+	f.WriteString(`{"seq":2,"event":{"type":"flex-auth.decision.de`)
+	f.Close()
+
+	outbox, err = emission.Open(dir, "flex-auth.test")
+	if err != nil {
+		t.Fatalf("reopen with torn tail: %v", err)
+	}
+	if err := outbox.Append(deny("decision:3", "")); err != nil {
+		t.Fatal(err)
+	}
+	outbox.Close()
+
+	outbox, err = emission.Open(dir, "flex-auth.test")
+	if err != nil {
+		t.Fatalf("reopen after append past torn tail: %v", err)
+	}
+	defer outbox.Close()
+	if got := outbox.Status().Committed["flex-auth.decision.deny"]; got != 2 {
+		t.Fatalf("committed deny = %d; want 2 (torn write never counted)", got)
+	}
+}
+
+func TestReleasedUncommittedIsReportedPerClass(t *testing.T) {
+	outbox, err := emission.Open(t.TempDir(), "flex-auth.test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer outbox.Close()
+	outbox.NoteReleasedUncommitted(api.DecisionEffectRedact)
+	status := outbox.Status()
+	if status.ReleasedUncommitted["flex-auth.decision.redact"] != 1 {
+		t.Fatalf("status = %+v", status)
+	}
+	if len(status.Committed) != len(api.DecisionEffects()) {
+		t.Fatalf("status must report every class, zero included: %+v", status.Committed)
+	}
+}
+
+// cadence.yaml must classify exactly the effect vocabulary, so a new effect
+// cannot ship unclassified (FLEX-WP-0031-T03 gate).
+func TestCadenceClassifiesEveryEffect(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("..", "..", "cadence.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cadence struct {
+		Classes map[string]struct {
+			Action        string `yaml:"action"`
+			EvidenceClass string `yaml:"evidence_class"`
+		} `yaml:"classes"`
+	}
+	if err := yaml.Unmarshal(data, &cadence); err != nil {
+		t.Fatal(err)
+	}
+	var declared, want []string
+	for name, class := range cadence.Classes {
+		if class.EvidenceClass != "load-bearing" {
+			continue
+		}
+		declared = append(declared, name)
+		if class.Action != emission.Class(api.DecisionEffect(name)) {
+			t.Errorf("class %q action = %q; want %q", name, class.Action, emission.Class(api.DecisionEffect(name)))
+		}
+	}
+	for _, effect := range api.DecisionEffects() {
+		want = append(want, string(effect))
+	}
+	sort.Strings(declared)
+	sort.Strings(want)
+	if len(declared) != len(want) {
+		t.Fatalf("cadence.yaml load-bearing classes %v; want the effect vocabulary %v", declared, want)
+	}
+	for i := range want {
+		if declared[i] != want[i] {
+			t.Fatalf("cadence.yaml load-bearing classes %v; want %v", declared, want)
+		}
+	}
+}