Create a durable source-verified evidence ingestion under an independently reviewed source retention policy

Dedicated records:bank staff authority and step-up within five minutes required; customers, services, API keys and third parties refuse. Source retention mappings, release, retention events, disposition and dispose_versions (removal of an unheld inventory source's retained row versions superseded through a nonfuture time, carried to the source by the repair route and worker only while no hub hold covers that source) need independent approval. Holds take effect immediately for existing/future archived facts and stay pending at each source until actual acknowledgment. An attachment the source or hub verification refuses for good, or that staff declare unretrievable after exhausted transport fetches, is recorded as a capture failure rather than blocking the ingest. Ingestion uses dedicated service connections and retained exact source snapshots/pages; users cannot upload or assert source contents. Discovery freezes complete membership and hashes with the requesting staff subject/purpose; every read is audited before release. Full external referenced documents remain outside explicit metadata projection coverage.