[reoring]

Problem

Since DEP-0003 (#17, v0.3.0) retirement capture holds whenever no publication Zone resolves for a retired hostname/address pair (withdrawal.go → WithdrawalCapturePending: no publication Zone binding resolved for …). An ERS whose hostnames or addresses change before any matching Zone exists therefore never captures. Consequences observed on appthrust/platform Kind lanes (no DNS Provider):

• endpoint Reconcile returns early on the pending retirement, so status.observedGeneration freezes (generation 12, observed 1) and active hostnames keep stale diagnostics; HTTPPublish never reaches its ZoneNotResolved terminal.
• gateway endpoint cleanup waits on RetireOrDelete → capture, so the gateway.endpoint.dns.appthrust.io/httproute-finalizer is never released and the owning Project cannot be deleted.

Evidence: platform CI runs 41305702992 (identity lane) and 41305716631 (pooled lane); appthrust/platform#5581.

Change

Capture is vacuous for a pair only after an explicit Resolved=False/ZoneNotResolved result and authoritative proof that the endpoint was never published:

1. no retained hostname Zone binding or generated-record reference/count on the ERS;
2. no sticky WithdrawalProtected=True;
3. an uncached (APIReader) Zone read finds no suffix-matching Zone (ZoneNotResolved also covers conversion/capability rejection, so reason alone is not enough);
4. an uncached source-label-bound RecordSet read finds no generated child (closes the create/status-write crash and cache-lag window).

Everything else keeps capture pending and retains finalizers. A Zone that disappears after prior publication stays fail-closed. No provider/environment special case. endpoint-api.md and DEP-0003 updated.

Verification

• New withdrawal_no_zone_test.go fails on the previous source with the exact WithdrawalCapturePending message; passes with the change. Cases: never-published pair completes; generated RecordSet present (even only via uncached read) pends; lost prior Zone binding pends; sticky protection pends; read error / incomplete list / missing reader pend; active-status convergence; retire-only cleanup; direct deletion.
• go test ./internal/go/apps/endpoint/controllers/endpointrecordset -count=1, go vet on the package: pass.
• Not yet validated on a Kind lane with the built image; that happens through the platform reviewed-import bump after this is released.