fix(pncc): revalidate receipt binding evidence

Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex desktop / DEV-20260810-014
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb
Source-Anchor: user instruction to continue GH-PNCC from repository facts and verifiable receipts

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -37,6 +37,12 @@ interruption at the recorded head or a single persona-attributed checkpoint comm
 checkpoint identity and commit trailers all match the session. Dirty repositories, unknown Git advances,
 broken journals and attribution mismatches retain the lease and require manual review.
 
+Idempotent lifecycle receipt recovery treats inspection as evidence, not as a lasting write permit. Immediately
+before binding an interrupted persisted receipt, the kernel re-reads and verifies its schema, request identity,
+semantic fingerprint, payload hash and persona identity, then re-checks the terminal event chain, dormant state,
+released lease, canonical repository, recorded Git head and clean work tree. A receipt or repository changed
+after inspection fails closed before any request or receipt-hash binding is written into the session record.
+
 The manifest now has a typed organ-contract extension. The native inspection command returns normalized
 contracts for `FACT_SENSE`, `MEMORY_METABOLISM`, and `EXECUTION_LIMB`, including fixed mode, input/output
 schemas, derived permissions, inference/reality-action boundaries, and the actual activation state. The fact