docs: archive M10 provenance to COMPLETED; reconcile CLAUDE.md + CONTEXT.md

M10 landed. CLAUDE.md gains provenance/provenance_shell entries, test
target, and a current-state refresh; CONTEXT.md null-test line annotated
(verification action cut, manual only).

COMPLETED.md

@@ -964,6 +964,67 @@ timeline item).
 
 ---
 
+## Milestone 10 — provenance (re-capture from source)
+**Goal:** Populate `Sample.provenance` (parent sample id + a capture-recipe
+fingerprint) on resample-from-sample, and ship a **"re-capture from source"**
+action that regenerates a sample from its recorded source. Reconciled with the
+dual-canvas (Phase D2) model. CONTEXT.md §Data model, §capture; product framing +
+the settled reconciliation in `docs/product/provenance.md`.
+**Verify (in DAW):** A sample resampled from a bank sample carries its parent id +
+recipe fingerprint; "re-capture from source" regenerates the file into the bank
+(never auto-inserting into the timeline — load-bearing principle); re-capture with
+an unchanged source + request is byte-identical to the original (bit-identical
+repeats); non-destructive to source items/tracks.
+
+> **Reshaped from the old "provenance + null-test verify" M10.** **Cut (fixed by
+> Daniel):** the null-test verification *action* and the true-pre-FX-dry *mechanism*
+> the old note required — both dropped, see `docs/product/provenance.md` §What was
+> cut. **Kept:** provenance + re-capture. The `Sample.provenance` struct and its JSON
+> round-trip **already exist** (M1) — M10 populates and consumes the field, it does
+> not add it. Fork picks settled by Daniel (2026-07-23): **P1=a thin fingerprint,
+> P2=a bank-only re-capture**; P3/P4 moot under P2=a.
+
+- [x] Populate `Sample.provenance` on resample-from-sample: `parentSampleId` (the
+  bank sample the capture derived from) + `fxChainSnapshot` as a **thin capture-recipe
+  fingerprint** (scope + source FX-chain identity/hash at capture time — a drift/repro
+  fingerprint, NOT a serialized pre-FX-dry chain to restore; P1=a settled).
+- [x] "Re-capture from source" action (`RECAPTURE_FROM_SOURCE`, channel-composed):
+  regenerate a provenanced sample by re-running its recorded capture request against
+  the source's **current** state; update the bank file + Sample in place
+  (`BankIndex::updateInPlace` / `BankBook::updateSampleInPlace` — order-preserving,
+  id-stable; old file becomes a Phase R orphan). **Bank-only — never inserts/re-places
+  into the timeline** (load-bearing principle). Reports drift if the source changed
+  since capture.
+- [x] Verify: re-capture of an unchanged source is byte-identical to the original
+  capture (bit-identical repeats); non-destructive (`FxBypassGuard` snapshot/restore
+  as M7); relative-paths-only preserved.
+
+**Dual-canvas reconciliation (settled — `docs/product/provenance.md`):** With
+bank-only re-capture (P2=a), provenance is **pure per-sample bank metadata**,
+`bank_model` and `view_mode_model` **stay decoupled**, and M10 touches **no** canvas
+code. Dual-canvas compliance is satisfied by staying on the right side of the
+capture-never-places line — not by any new coupling. Forks P3 (canvas/lane memory in
+provenance) and P4 (re-capture auto-tag interaction) were only live under
+re-capture-and-replace (P2=b) and are **closed as moot**; if the user manually
+re-places a regenerated sample, the existing D2 mode-aware placement rule governs.
+
+**Notes/decisions:**
+- Pure `provenance` module: `rsprov1` length-prefixed encoding; captures scope, exact
+  range, tail, rate/channels, track GUIDs, order-sensitive FX-chain identity;
+  parse/compare for drift detection. NOT a serialized chain to restore.
+- `provenance_shell`: FX-chain identity queries via `TrackFX_*` / `TakeFX_*`;
+  source-item path collection; parent-detection inputs. Item scope fingerprints take
+  FX via `TakeFX_*`; track scope fingerprints track FX. Stamps `Sample.provenance`
+  when every resolving source item maps by exact normalized path (case-folded on
+  Windows) to exactly one bank sample — ambiguous/mixed cases conservatively record
+  nothing.
+- **Cut items (correct per spec, not built):** the null-test verification action and
+  the pre-FX dry path. Both were explicitly removed at M10 reshaping
+  (`docs/product/provenance.md` §What was cut).
+- New CTest target `provenance_tests`.
+
+---
+
 ## Phase B open questions — all resolved
 
 All five forks settled by Daniel (2026-07-23): persistence key = fold pool into `banks`,