[HLCC-ICE-000003] fix: recover code-channel owner login safely

deployment/receipts/HLCC-JD-OWNER-LOGIN-RECOVERY-20260726.json

@@ -0,0 +1,44 @@
+{
+  "schema": "guanghu.deployment-receipt/v1",
+  "receipt_id": "HLCC-JD-OWNER-LOGIN-RECOVERY-20260726",
+  "timestamp": "2026-07-26T14:54:05+08:00",
+  "target": "JD-FD-PRIMARY",
+  "channel": "bingshuo/guanghu-ice-heart",
+  "workorder": "6d62659c-eef7-49de-a397-4ddc98d66a37",
+  "authorization_scope": "server-ops",
+  "result": "RECOVERED_AND_VERIFIED",
+  "root_causes": [
+    "The existing restore-owner-password-login action changed the JD SSH PasswordAuthentication setting; it did not recover the HoloLake Code Channel application account.",
+    "The new channel owner password digest no longer matched the legacy Fifth Domain owner digest even though the architecture requires one human credential.",
+    "The SQLite WAL contained newer repository mapping state than the main database file, so raw single-file backup and rollback could expose a stale fifth-domain row."
+  ],
+  "recovery": {
+    "owner": "bingshuo",
+    "credential_source": "JD-local legacy Fifth Domain database",
+    "plaintext_password_read": false,
+    "ssh_policy_changed": false,
+    "singapore_route_used": false,
+    "legacy_repository_modified": false,
+    "consistent_backup": "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/backups/channel-db-consistent-20260726T065405Z.db",
+    "repository_mapping": "bingshuo/guanghu-ice-heart",
+    "repository_head": "8c0642d4f208d1d0027fa1956de372ce61f191ef"
+  },
+  "verification": {
+    "owner_credential_matches_legacy": true,
+    "owner_active": true,
+    "owner_admin": true,
+    "owner_login_prohibited": false,
+    "channel_service": "ready",
+    "channel_health": "pass",
+    "public_repository": true,
+    "repository_empty": false,
+    "default_branch": "main",
+    "public_git_head_matches": true
+  },
+  "follow_up": [
+    "Deploy the distinct restore-code-channel-owner-login registered action after review.",
+    "Publish REPO-012 in the AI repository route map.",
+    "Keep restore-owner-password-login documented as SSH-only.",
+    "Use SQLite backup API plus WAL checkpoint for future channel database recovery."
+  ]
+}