the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision

Approval authoritative timestamp precision repair

Frozen source repair under APPROVAL-WP-0006-T01, base 3485415b823faf4f3b682079195e186666b0ed2b. Isolated source: /tmp/netkingdom-approval-timestamp-precision-20261016. Canonical source, prior WP0005 closure and registrar-generated identifiers remain untouched. Exact observed owner dirt is preserved in owner-dirty-baseline.patch.

The coordinator counterexample demonstrates a real validity defect: clock .750 was rounded to .000 and consumed an approval expiring at .500. The same rounding made legitimate immediate consumption evidence appear before Access's precise signed NotBefore. The repair retains actual aware UTC microseconds in utc_now and ISO serialization. First consumption samples exactly once after SQLite's write lock is acquired and uses that one instant for validity, immutable receipt, updated_at and the use outbox's occurrence/creation time. No Access backdating, consumer tolerance, caller sleep, schema change or new approval protocol exists.

Historical whole-second rows/readback and same-digest idempotent receipts retain their original timestamps/decision IDs without fabricated precision. All new source timestamps, including claims/freshness, preserve clock precision. The existing Go helper already accepts microseconds; its code is unchanged, and only its README's old whole-second producer statement is corrected.

Validation: 89 focused tests pass, including actual SQLite lock waits crossing expiry, immediate fractional receipt/readback/restart, one sampled clock and identical receipt/outbox time, unchanged old evidence and failed-outbox rollback. Full source suite: 298 pass, one known historical release-evidence/image-pin mismatch remains. Original regressions failed five cases before repair. An initial repaired test tried issuing an already expired approval and correctly failed; its fixture now issues before expiry and then advances. These outcomes remain recorded instead of being rewritten into success.

implementation.patch SHA256: 74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd. approval_engine/store.py SHA256: 866b275ed2d844d0aa9090ce9899ce955c6bfe32a493c2645c86e72efa343e86. The original standalone repair is frozen independently of later temporal review. owner-review-record.patch applies after it, recording T02 progress and the Approval-owned formal review in the owner repo; no canonical write is performed.

The supplementary review approves Approval facts/time only for exact Access R3 full patch 46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6. All 31 frozen source hashes match; independent temporal/retained-registry HTTP race checks pass. Signed claim-free DENY supplies authenticated normalized facts before issue; final source join compares that approved act/PDP binding without rewriting the original claim. Exact operation lifetime must fit original/fresh fact bounds. Default freshness30 cannot cover backend30 plus cleanup5; fixture freshness120 is explicit synthetic configuration, never a native grant.

Prior R1 review and WP0005 closure remain exact historical records. Immediate strict CAS and whole-path remeasurement use the final separately pinned repaired Approval source, Access R3 and Secrets successor; their result is not assumed here. Native issuer/profile, source/custody/config/image admission, actual audit receiver and served PEP/CAS/journal/effect/cleanup remain the existing WP0002 T01/T04/T05 and other-owner obligations. No authority promotion is recorded.