docs: capture accepted retention source boundary in Atlas

docs/atlas/catalog.json

@@ -0,0 +1 @@
+{"records":["7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03"],"schema":"fsgg.atlas/1"}

docs/atlas/records/7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03.json

@@ -0,0 +1 @@
+{"citations":[{"path":"src/FS.GG.Governance.VerifyCommand/ProviderContextCapture.fs","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"4b6fd57ec3786aef02e077a1c6be3eb11896f6ba5131730a820e783bfb2f2fe9"},{"path":"tests/FS.GG.Governance.VerifyCommand.Tests/ProviderContextCaptureTests.fs","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"03d2c1e98a464139b338daaa4e3412c01f0dcd0da985cb12c385d11d3fba74d7"},{"path":"docs/roadmaps/governance-423-neutral-capability-bindings.md","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"b8073de13dbdb43173e8c94b2191c01234de913f759d8add1d7279bf86bd7ae5"}],"conflictsWith":[],"id":"governance/provider-capture-retention-boundary","kind":"boundary","recordedAt":"2026-10-15T06:33:45Z","repository":"FS-GG/FS.GG.Governance","schema":"fsgg.atlas/1","status":"recorded","summary":"The capture interpreter keeps native operations and clock immutable per original session; production prepare selects unchanged Linux calls, while friend-visible controlled construction supplies inert operations and refuses native lease duplication. Registered actual activity, original ends, bounded immutable evidence, sticky failures and close uncertainty remain with the caller owner; release retains outstanding root leases. Ten finite real-interpreter controls cover pending read, uncertain synthetic close, cancellation, failure ordering and normal lifecycle joins. These controls and hosted source qualification cannot establish blocked kernel read or physical uncertain-close acceptance. The existing physical wrapper deliberately retains unsettled sessions, so a separate qualified observation and whole-worker/resource teardown boundary is still required. C2 loader/profile/package joins and physical acceptance remain open.","supersedes":[],"tags":["governance","capture","ownership","retention","qualification"],"title":"Capture owner retention does not establish physical blocked-read or uncertain-close qualification"}

docs/roadmaps/governance-423-neutral-capability-bindings.md

@@ -328,8 +328,8 @@ Templates/public receivers and broader release completion retain their applicabl
 
 ### GOV423-C2 controlled retention source window (2026-10-15)
 
-Owner: Governance source lane. Status: source prepared; hosted qualification pending. C2 remains
-unchecked. This extends the existing capture milestone and preserves all earlier failures and custody
+Owner: Governance source lane. Status: [source window delivered](https://github.com/FS-GG/FS.GG.Governance/pull/459)
+at `8a6a74c701ccc713f28723fad5eea539acaada38`; C2 remains unchecked. This extends the existing capture milestone and preserves all earlier failures and custody
 unknowns. The historical 15-case report above describes #449; #453 subsequently added held-root lease
 coverage and reported 20 physical controls. Those reports do not qualify blocked kernel reads or
 uncertain physical closes.
@@ -341,16 +341,21 @@ signature remain preserved. A post-read work check prevents a late read from acc
 Synthetic sessions cannot duplicate native leases; production's outstanding lease fences stay intact.
 The surface guard explicitly rejects exported operation/test types and entry points.
 
-Local validation is limited to source, exact touch set, diff and relative links. No local CLR or native
-fixture execution is admitted. Normal PR CI may qualify compilation and controlled/default tests with
-physical capture still pending. Preserve its first failing run and exact successor head; hosted green
-establishes source qualification only. The source PR and its exact checks supply delivery evidence;
-publication, installed adoption and physical acceptance remain separate.
+Local validation covered source, exact touch set, diff and relative links; no local CLR or native
+fixture ran. [Hosted qualification](https://github.com/FS-GG/FS.GG.Governance/actions/runs/38692065699)
+passed the required source matrix and advisory API job at `8c242c6133b36206f9ff83fc287684840788a777`.
+VerifyCommand passed 219 tests in each of Debug and Release, with all 20 physical cases skipped.
+The first `b086c148` build failed on two nullable reflection accesses; its successor repaired the
+guard. After rebase, the first routine event refused the stale head marker; the subsequent authentic
+edited event passed after rebinding. Both failures remain preserved. The protected delivery helper
+accepted routine eligibility and coherent validation, then one guarded apply delivered #459.
+This establishes source qualification and delivery only; publication, installed adoption, physical
+blocked-read/uncertain-close acceptance and the rest of C2 remain open.
 
 The remaining physical gate needs an accountable supplying owner, an authentic regular-file blocked
 read accepted by production acquisition, independently observed uncertain close and demonstrated
 whole-worker/resource teardown. No backend is qualified by this window. Keep those physical cases
 pending and retain the original caller owner and failure evidence. The existing provider loader,
 Program/Verify integration, stronger profiles, coherent SDD consumer joins and C3/C4 milestones remain
-open. Atlas capture remains an asynchronous owning-archive follow-up for the programme integrator:
-`governance/provider-capture-retention-boundary`.
+open. The owning Atlas archive records `governance/provider-capture-retention-boundary`; retrieve it
+with the Atlas helper and verify its immutable source citations before reuse.