feat(records): govern lifecycle recovery and transfer evidence

docs/RECORDS_DOMAIN_BOUNDARY.md

@@ -42,16 +42,24 @@ The native kernel currently provides:
   file versions and Cases revisions;
 - tenant APIs, search projection, uninstall/retirement guards, and a Records
   workspace using shared WebUI controls.
+- immutable close/reopen, retention, hold, appraisal, and independently
+  approved disposition transitions;
+- archive-neutral manifests, bounded receipts, and a clearly marked transfer
+  simulation that does not claim custody;
+- Core recovery-ledger adoption, atomic terminal evidence, Audit projection,
+  source and package restore diagnostics, catalog administration, volumes, and
+  lifecycle UI.
 
-Restricted object grants and the lifecycle after the planned/open stages remain
-separate governed slices. Archive transfer and destructive effects are not
-implemented by this kernel.
+Restricted object grants remain a separate governed slice. A target-tested
+archive adapter and any destructive effect remain deliberately unimplemented;
+approved destruction is only a pending lifecycle state.
 
 ## First Implementation Slice
 
-Complete restricted access, closure and retention calculation, holds,
-appraisal, disposition, transfer, recovery evidence, and one target-tested
-archive provider without moving source-module ownership into Records.
+Complete restricted access and one target-tested archive provider without
+moving source-module ownership into Records. Extend the executable reference
+journey across assisted service, decision, filing, hold, restore, search, and
+archive simulation before claiming production maturity.
 
 The complete native/external boundary, temporal and purpose-aware record model,
 disposition lifecycle, German public-sector provider profiles, and staged