Close G10, the last of the ten assessment gaps

Every closure criterion now has evidence, taken one at a time rather than as an
impression. Custody admitted and provisioned (CCR-2026-0017/0018, both secrets
wired, receipt committed). The real callback registered, verified live by its
owner, pinned by test. The new contracts deployed and verified at the 2026-09-09
attended rollout: acceptance passed at generation 38, per-client live JWKS
verification, exact claims, excess-scope and wrong-secret denial, human consume
denied, no credential values emitted. Token types reconciled at the consumer
boundary -- ops-warden took option (a) because the proxy's OpenBao token and an
issuer JWT were never one thing to cut over between; both lanes owner-confirmed
and no route changed. Four handoff receipts retained.

The condition that named the gap -- source capability running ahead of live
custody and consumer adoption -- no longer holds.

What closing it does not claim, stated in both documents: the approver
registration is published, not deployed, so the human approval path is registered
rather than proved; the deployed image predates most of this revision; the
verifier receipt declines real predecessor rotation and observed wall-clock
expiry and so do we; and the Qonto rotation is deferred by owner decision on
evidence. Those are open items with owners and triggers, which is a different
thing from a gap between what this repository claims and what is true.

SCOPE's header lineage is consolidated so a reader can ask what changed since a
given revision and get an answer, and the test count is refreshed rather than
carried.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

SCOPE.md

@@ -1,15 +1,16 @@
 # SCOPE
 
-Reviewed 2026-09-09 against source revision `7a73352`. The preceding review was
-2026-09-05 against `b989de4`; the [reassessment](history/2026-09-09-scope-reassessment.md)
-records what changed and how each claim below was checked.
+Reviewed 2026-09-10 against source revision `f247d35`.
 
-The capability review was performed against `5ae80d3`. `7a73352` landed a minute
-before it and changes documentation and workplans only, no source; its substance
-reached this document as a peer report and was afterwards confirmed by reading
-the commit, which is why the baseline names it. That distinction — read versus
-told — is worth keeping in a header whose whole purpose is to let a reader ask
-"what changed since?" and get a usable answer.
+Review lineage, because "what changed since?" should have a usable answer. The
+full capability review was 2026-09-09 against `5ae80d3`
+([reassessment](history/2026-09-09-scope-reassessment.md)), superseding
+2026-09-05 against `b989de4`. `7a73352` followed it by a minute — documentation
+and workplans only — and was confirmed by reading the commit rather than by
+report. Since then the tenant claim gained `tenant_source`, the approver client
+was registered, and two guards were added that pin properties rather than
+behaviours; each is described below. Read versus told, and reviewed versus merely
+later, are distinctions this header is meant to preserve.
 
 ## Purpose and boundary
 
@@ -101,10 +102,17 @@ Keycloak interchangeability are not established.
   unexercised, and credential/MFA migration is not supplied at all, so no harness
   can establish it. Subject continuity is explicitly not preserved: the canonical
   ID survives as an attribute while Keycloak mints its own `sub`.
+- **All ten gaps from the 2026-09-05 assessment are now closed**, G10 last, on
+  2026-09-10. Closure means the gap each named no longer holds; it does not mean
+  nothing is outstanding. The approver registration is published but no human has
+  logged in through it, the deployed image predates most of this revision, and the
+  Qonto rotation is deferred by owner decision on evidence. Those are open items
+  with owners and triggers, which is a different thing from a gap between what
+  this document claims and what is true.
 - **Source behaviour and deployed behaviour are not the same claim, and this
   document describes source.** Everything above is what the code in this revision
-  does, established by 390 Go tests across 23 packages plus the harness runs
-  named. What has been demonstrated against the live deployment is narrower and is
+  does, established by 394 Go tests across 23 packages plus the harness
+  runs named. What has been demonstrated against the live deployment is narrower and is
   recorded as committed receipts in `docs/evidence/`: the upstream issuer was
   probed and then pinned in `sso/keycape-config`
   (`2026-09-09-upstream-issuer-pin.json` — the pre-pin state did **not** match, so