feat: project verified PNCC runtime into HoloLake

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -122,8 +122,14 @@ current lifecycle receipt after repository drift.
 `PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
 It filters by the caller's expected persona and canonical repository, validates each matching event chain,
 and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps
-the event-chain head and human/persona attribution so a future renderer can link a summary back to the same
-machine evidence rather than trusting display state.
+the event-chain head and human/persona attribution. `loadPersonaRuntimeProjection` supplies only the exact
+persona id and HoloLake's mounted Git repository paths to that native query, rejects a mismatched schema,
+persona, repository, count, or required evidence field, and aggregates successful receipts without hiding
+per-repository failures. `PersonaRuntimeProjectionPanel` renders the newest verified session inside the
+Fifth Domain Eternal Lake inspector. Human labels such as dormant or inferencing remain beside the raw native
+state, Git head, event-chain head, node, active organ, timestamp, and human responsibility subject. An empty
+match explicitly does not mean offline. The panel is read-only and cannot wake a persona, invoke an organ, or
+acquire a lease.
 
 ## PersonaRemoteGitObjectChannel
 
@@ -1202,6 +1208,9 @@ Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is ins
 - **AI feature visibility** — `ai_features_visibility_changed` records only whether installation-level AI surfaces were enabled or hidden.
 - **Automatic update checks** — `automatic_update_checks_changed` records only whether startup/background update checks were enabled or disabled.
 - **All Notes visibility** — `all_notes_visibility_changed` records only the toggled category and enabled state.
+- **Persona runtime projection** — `persona_runtime_projection_loaded` and `persona_runtime_projection_retry`
+  record only coarse phase and count fields. Repository paths, persona session ids, event hashes, and runtime
+  attribution are never sent.
 
 ### Tauri Commands
 - **`reinit_telemetry`** — Re-reads settings and toggles Rust Sentry on/off. Called from frontend when user changes crash reporting setting.

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -104,6 +104,14 @@ event, and returns lifecycle state, Git head, node/model instance, active organ,
 structured attribution. It does not copy facts into a second database, expose hidden reasoning, acquire a
 lease, or start inference. A corrupted matching journal fails the query closed.
 
+The HoloLake renderer now provides the first human-readable GH-PNCC projection without introducing another
+runtime source. `App` passes only its already mounted Git repository paths into `HoloLakeHome`; the Eternal
+Lake inspector queries each path for `ICE-P-ZY001` through the native read model. The renderer validates the
+receipt identity and required evidence, preserves partial query errors, and displays the newest verified
+session with both a human state label and the raw state, Git and event-chain heads, node, organ, timestamp,
+and human responsibility subject. No matching session is reported as absence of matching evidence, never as
+proof that the persona is offline. This surface contains no wake, inference, lease, or execution control.
+
 `read_persona_remote_git_object` is the non-UI remote object channel used when the persona needs one current
 Git-backed fact without materializing another repository checkout. It accepts credential-free HTTPS remotes,
 requires Git protocol v2 partial-object filtering, stores only a bounded bare `blob:none` object cache, and