FLEX-WP-0031-T03: durable decision outbox and the FLEX-DEC-2026-018 release rule

internal/emission commits one audit-core-shaped event per decision with
fsync before release (one sync per batch), random event ids with the
decision id as correlation_id, torn-tail and failed-commit truncation, and
per-class committed/released_uncommitted counts at GET /v1/emission.
The engine releases restrictions whose record failed to commit and
withholds allow/audit_only (503). api.DecisionEffects() is pinned by a
source-parsing test and cadence.yaml must classify exactly it.

T03 split under the task budget: heartbeat+drain is T05, reconciliation,
profile check and PVC are T06. Nothing deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 307130@bnt-lap001
Assistant-Session: 270c79f7-0823-4b0d-990d-aad5af9935ce

pkg/api/canonical.go

@@ -209,6 +209,30 @@ const (
 	DecisionEffectNotApplicable DecisionEffect = "not_applicable"
 )
 
+// DecisionEffects returns the complete effect vocabulary. Every effect is an
+// emission class in cadence.yaml; a test fails if a constant above is missing
+// here, so a new effect cannot ship unclassified (FLEX-WP-0031-T03).
+func DecisionEffects() []DecisionEffect {
+	return []DecisionEffect{
+		DecisionEffectAllow,
+		DecisionEffectDeny,
+		DecisionEffectRedact,
+		DecisionEffectAuditOnly,
+		DecisionEffectNotApplicable,
+	}
+}
+
+// Restricts reports whether an effect withholds authority. A restriction is
+// released even when its record fails to commit, because withholding it turns
+// it into an error an open-stance consumer reads as proceed (FLEX-DEC-2026-018).
+func (e DecisionEffect) Restricts() bool {
+	switch e {
+	case DecisionEffectDeny, DecisionEffectRedact, DecisionEffectNotApplicable:
+		return true
+	}
+	return false
+}
+
 // DecisionRecordContractV1 is the published decision-record contract identifier.
 const DecisionRecordContractV1 = "flex-auth.decision-record.v1"