feat(pncc): close memory failures safely

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and human projection aesthetics remain deferred

engineering/INDEX.md

@@ -32,6 +32,7 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
+| 2026-08-11 | GH-PNCC 记忆失败闭环 | [记忆代谢失败闭环与运行时命令接入](operations/2026-08-11-hololake-pncc-memory-failure-closure-runtime-command.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG、提交与发布待验收 |
 | 2026-08-11 | GH-PNCC 运行查询 | [人格持久事件与回执有界查询](operations/2026-08-11-hololake-pncc-durable-runtime-query.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 器官合同 | [人格器官机器合同与清单检查](operations/2026-08-11-hololake-pncc-typed-organ-contract.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 中断恢复 | [人格代码频道中断会话检查与安全恢复](operations/2026-08-11-hololake-pncc-interrupted-session-recovery.md) | 实现提交已通过 GHNQG；仓库发布、桌面集成与部署待验收 |

engineering/operations/2026-08-11-hololake-pncc-memory-failure-closure-runtime-command.md

@@ -0,0 +1,41 @@
+# GH-PNCC memory failure closure and runtime command integration
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `962ea26db7044f7f17fafd55a054b0214b5e37cf`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+
+## Implemented facts
+
+The registered `run_persona_code_channel_memory_metabolism` command now executes its filesystem and Git work
+inside Tokio's blocking task pool. This keeps the native desktop command runtime responsive without adding a
+renderer, UI workflow, execution limb, shell permission, or second truth store.
+
+Memory rejection and pre-commit failure paths now use a checked closure. A complete closure appends the
+specific failure event, `ORGAN_RELEASED`, and `DORMANT`, persists `DORMANT_AFTER_FAILURE`, and removes the
+exact primary lease. If event persistence, session persistence, or lease removal fails, the returned error
+includes `MEMORY_FAILURE_CLOSURE_INCOMPLETE_REQUIRES_RECOVERY`. The runtime therefore cannot hide a closure
+failure behind the original candidate error. When completion cannot be proven, the lease remains available to
+the existing evidence-bound inspection and recovery path.
+
+Checkpoint rollback also precedes failure dormancy. If rollback itself fails, the session retains its lease
+and returns `MEMORY_CHECKPOINT_ROLLBACK_INCOMPLETE_REQUIRES_RECOVERY` instead of claiming a clean failure.
+
+## Current verification
+
+- PNCC focused Rust tests: `17 passed, 0 failed`.
+- Full Rust suite: `1157 passed, 0 failed, 2 ignored`; integration test: `1 passed`.
+- HoloLake architecture routing: `29 passed, 0 failed`.
+- Rust clippy for all targets: `PASS` with `-D warnings`.
+- The corrupted-source case proves the durable terminal chain
+  `MEMORY_SOURCE_REJECTED → ORGAN_RELEASED → DORMANT` and exact lease release.
+- The incomplete-closure case forces lease-removal failure, proves the error is surfaced, and proves the
+  unresolved lease is preserved rather than silently discarded.
+
+## Truth boundary and next minimum
+
+- GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
+- UI, packaged desktop, installation, deployment, online health, and the execution limb remain `0`.
+- The next source stage is a non-UI lifecycle coordinator for already registered safe organs; it must not make
+  `EXECUTION_LIMB` activatable or create a second runtime authority.