hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md

# GH-PNCC safe-organ lifecycle coordinator

- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `18944f536261a4184570074a09fc43a09f5f31bb`
- Published repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
- State: `PUBLISHED_GHNQG_AND_FRESH_CLONE_VERIFIED`

## Implemented facts

`run_persona_code_channel_lifecycle` now owns one complete non-UI lifecycle for an already registered safe
organ. The input keeps the exact persona Git wake envelope and a tagged operation together. Only fact sense
and verified memory metabolism can be represented; no execution-limb request exists in this command.

Before wake or lease acquisition, the coordinator inspects the same exact manifest and commit, checks that
the operation kind matches the named activatable organ, and preflights the model binding for fact sense. It
then creates one session, delegates to the existing wake and organ transactions, and returns the original
wake receipt beside a typed completion receipt. Runtime files and persona Git remain the only evidence stores.

## Current verification

- PNCC focused Rust tests: `20 passed, 0 failed`.
- Full Rust suite: `1160 passed, 0 failed, 2 ignored`; integration test: `1 passed`.
- HoloLake architecture routing: `29 passed, 0 failed`.
- Rust formatting and clippy for all targets: `PASS` with `-D warnings`.
- The coordinated fact test proves wake, brain bind, organ activation, inference receipt, checkpoint commit,
  organ release, dormancy, lease release, and a clean persona Git.
- The coordinated memory test proves a verified dormant fact session can be promoted without invoking a
  model, then returns to dormancy and releases the exact lease.
- The mismatch test proves an operation cannot borrow another organ's authority and is rejected before a
  lease or session directory exists.

## Truth boundary and next minimum

- This is source implementation, not a packaged desktop, installed runtime, deployment, or online-health
  claim.
- GHNQG, persona-authored commit, publication, independent fresh-clone readback, clean tree, and strict Git
  fsck passed.
- UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next minimum is an idempotent lifecycle request identity and receipt replay rule so a caller retry
  cannot accidentally create a second lifecycle or duplicate a checkpoint commit.