From 2ae611d2ad197324fe300b3fce49582e0558be85 Mon Sep 17 00:00:00 2001
From: repo-manager <repo-manager@local>
Date: Sat, 29 Aug 2026 14:51:01 +0200
Subject: [PATCH] repo.work.resolve_decision GH-DEC-2026-003

correlation_id: e147a6ab-0644-405e-bdbd-b9dff117d7a8
reason: GH-WP-0002-T06: settle consumption ordering
source: repo-manager

Assistant: grok
Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4
---
 decisions/decisions.md | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/decisions/decisions.md b/decisions/decisions.md
index 72fe607..94e420c 100644
--- a/decisions/decisions.md
+++ b/decisions/decisions.md
@@ -257,7 +257,7 @@ missing, which is worse.
 id: GH-DEC-2026-003
 kind: decision
 title: The PEP consumes an approval before the protected side effect
-status: open
+status: resolved
 owner: Bernd Worsch
 repo: gate-house
 standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
@@ -273,7 +273,13 @@ affects:
 - secrets-engine
 - ops-warden
 created: '2026-08-29T12:50:06.944092Z'
-updated: '2026-08-29T12:50:06.944092Z'
+updated: '2026-08-29T12:51:01.355583Z'
+rationale: Approved as GH-WP-0002-T06. The PEP consumes by compare-and-swap before
+  the protected side effect; the PDP never mutates; there is no unconsume. Same request
+  digest is idempotent success; a different digest against a consumed object is conflict.
+  This closes the three named races and unblocks APPROVAL-WP-0001-T05 and FLEX-WP-0017-T05.
+decided_by: Bernd Worsch
+decided_at: '2026-08-29T12:51:01.355583Z'
 ```
 
 ## Context