feat(files): expose exact versions for records filing

docs/FILES_HANDBOOK.md

@@ -648,11 +648,17 @@ public HTTP API. They must not import Files ORM models or storage helpers.
 | --- | --- |
 | `files.access` (`0.1.6`) | Explain resource access provenance for managed files, explicit folders, and virtual folders |
 | `files.campaign_attachments` (`0.1.6`) | Resolve managed attachment matches, prepare frozen campaign snapshots, annotate built messages, share assets with a campaign, and record/mark exact attachment use |
+| `records.source.files` (`1.0.0`) | Recheck current Files access and resolve one exact, integrity-approved managed file version for Records filing |
 
 Files requires Core principal resolution and permission evaluation. Campaign is
 an optional dependency; when installed, Files consumes the optional
 `campaigns.access` interface to verify campaign existence and access. Missing
 optional Campaign support fails explicitly rather than bypassing the check.
+Records is also optional. When enabled, the source capability returns the
+requested `FileVersion` identity, path snapshot, content metadata, SHA-256,
+integrity/protection state, and launch link. It rejects mutable aliases,
+cross-tenant requests, missing access, and quarantined or failed blobs. Records
+stores the filing decision; Files continues to own the version and bytes.
 
 ### API families