[HLCC-ICE-000003] fix: recover code-channel owner login safely

deployment/navigation-maps/JD-FD-PRIMARY.json

@@ -10,7 +10,7 @@
     { "code": "JD-SEN-01", "name": "状态变化哨兵", "bind": "timer:15m", "owner": "systemd" },
     { "code": "JD-ROUTE-01", "name": "已登记下游节点 SSH 路由", "bind": "private-keys", "owner": "root", "registered_targets": ["AW-GZ-001"] },
     { "code": "JD-ACT-01", "name": "固定动作执行桥", "bind": "unix-socket", "owner": "root", "actions": ["inspect-services", "health-check", "inspect-code-channel-owner-auth"] },
-    { "code": "JD-OWNER-ACCESS-01", "name": "冰朔登录入口恢复执行器", "bind": "unix-socket", "owner": "root", "actions": ["restore-owner-password-login"] },
+    { "code": "JD-OWNER-ACCESS-01", "name": "冰朔受限登录恢复执行器", "bind": "unix-socket", "owner": "root", "actions": ["restore-owner-password-login", "restore-code-channel-owner-login"], "action_meanings": { "restore-owner-password-login": "仅恢复京东服务器 SSH 密码认证开关，不修改代码频道账号", "restore-code-channel-owner-login": "仅将新代码频道 bingshuo 凭证恢复为旧第五域本机凭证，不读取明文密码" } },
     { "code": "JD-ARCH-PROVISION-01", "name": "已批准新架构首次安装器", "bind": "unix-socket", "owner": "root", "actions": ["provision-approved-architecture"], "state": "ACTIVE" },
     { "code": "JD-LAN-01", "name": "光湖·来光者导航只读召回服务", "bind": "loopback:3924", "owner": "systemd", "architecture": "GLS-0231", "state": "DEPLOYED_AND_VERIFIED", "source_commit": "f4a4b5996c83b55d99172f3196f4a0d77ed5f3e9" },
     {
@@ -18,8 +18,8 @@
       "name": "第五域光湖代码频道隔离候选启动壳",
       "bind": "loopback:3340,3341",
       "owner": "guanghu",
-      "state": "BOOTSTRAP_DEPLOYED · CANDIDATE_NOT_READY",
-      "source_commit": "b4d9cf7635ffccde4f49ad1949a215bb9d22c5be",
+      "state": "ACTIVE_READY",
+      "source_commit": "8c0642d4f208d1d0027fa1956de372ce61f191ef",
       "receipt": "deployment/receipts/HLCC-JD-RUNTIME-CHECKPOINT-20260723.json"
     }
   ],

deployment/receipts/HLCC-JD-OWNER-LOGIN-RECOVERY-20260726.json

@@ -0,0 +1,44 @@
+{
+  "schema": "guanghu.deployment-receipt/v1",
+  "receipt_id": "HLCC-JD-OWNER-LOGIN-RECOVERY-20260726",
+  "timestamp": "2026-07-26T14:54:05+08:00",
+  "target": "JD-FD-PRIMARY",
+  "channel": "bingshuo/guanghu-ice-heart",
+  "workorder": "6d62659c-eef7-49de-a397-4ddc98d66a37",
+  "authorization_scope": "server-ops",
+  "result": "RECOVERED_AND_VERIFIED",
+  "root_causes": [
+    "The existing restore-owner-password-login action changed the JD SSH PasswordAuthentication setting; it did not recover the HoloLake Code Channel application account.",
+    "The new channel owner password digest no longer matched the legacy Fifth Domain owner digest even though the architecture requires one human credential.",
+    "The SQLite WAL contained newer repository mapping state than the main database file, so raw single-file backup and rollback could expose a stale fifth-domain row."
+  ],
+  "recovery": {
+    "owner": "bingshuo",
+    "credential_source": "JD-local legacy Fifth Domain database",
+    "plaintext_password_read": false,
+    "ssh_policy_changed": false,
+    "singapore_route_used": false,
+    "legacy_repository_modified": false,
+    "consistent_backup": "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/backups/channel-db-consistent-20260726T065405Z.db",
+    "repository_mapping": "bingshuo/guanghu-ice-heart",
+    "repository_head": "8c0642d4f208d1d0027fa1956de372ce61f191ef"
+  },
+  "verification": {
+    "owner_credential_matches_legacy": true,
+    "owner_active": true,
+    "owner_admin": true,
+    "owner_login_prohibited": false,
+    "channel_service": "ready",
+    "channel_health": "pass",
+    "public_repository": true,
+    "repository_empty": false,
+    "default_branch": "main",
+    "public_git_head_matches": true
+  },
+  "follow_up": [
+    "Deploy the distinct restore-code-channel-owner-login registered action after review.",
+    "Publish REPO-012 in the AI repository route map.",
+    "Keep restore-owner-password-login documented as SSH-only.",
+    "Use SQLite backup API plus WAL checkpoint for future channel database recovery."
+  ]
+}