If he never distributed it he hasn't to release anything.
Yes, the rule is source must follow binary.
You can even sell the binary for money, distribute the source with it and simply ask your client to not-redistribute the source to someone else and it's fully legal.
not under the gpl, you can't
Well, ask and compel are different. I'm pretty sure you can ask them to do anything, up to and including barking like a seal. You can't compel them to do it under GPL though.