feat(pncc): close memory failures safely

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and human projection aesthetics remain deferred

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -73,6 +73,12 @@ chain head into a new checkpoint, commits with the persona Git identity, release
 `DORMANT`. It cannot accept arbitrary hidden reasoning or an older/non-current session as memory. An
 `EXECUTION_LIMB` remains declarative and non-activatable; declaration never grants a shell or reality action.
 Manifest inspection reads and validates all contracts without acquiring a runtime lease or starting inference.
+The public memory command runs its filesystem and Git work in the blocking task pool instead of occupying the
+Tauri command thread. Rejected memory candidates must durably append the failure, organ-release, and dormancy
+events, persist `DORMANT_AFTER_FAILURE`, and release the exact primary lease. If any closure step fails, the
+command returns `MEMORY_FAILURE_CLOSURE_INCOMPLETE_REQUIRES_RECOVERY`; it never reports only the original
+candidate error while silently losing the closure failure. An incomplete closure preserves the lease for the
+existing evidence-bound session inspection and recovery path.
 
 `PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
 It filters by the caller's expected persona and canonical repository, validates each matching event chain,