feat: recover interrupted PNCC sessions safely

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex thread 019febf6-3902-70f3-9d82-74c9680b0c7e
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: LOCAL_PNCC_RUNTIME_DEVELOPMENT_AND_PUBLICATION

engineering/operations/2026-08-11-hololake-pncc-first-runtime-cycle.md

@@ -26,7 +26,7 @@ The source now implements one bounded PNCC lifecycle cycle without a HoloLake UI
 
 ## Verification evidence
 
-- PNCC unit tests: `6 passed, 0 failed`.
+- PNCC unit tests at the published milestone: `6 passed, 0 failed`.
 - Rust full suite: `1146 passed, 0 failed, 2 ignored`; integration test `1 passed`.
 - Rust clippy: `PASS` with `-D warnings`.
 - HoloLake architecture routing: `29 passed, 0 failed`.
@@ -38,11 +38,19 @@ The source now implements one bounded PNCC lifecycle cycle without a HoloLake UI
 ## Facts that remain zero
 
 - general-purpose persona organs and arbitrary execution runtime;
-- crash-recovery administration for an interrupted live PNCC session;
 - HoloLake human projection and visual design;
 - packaged desktop acceptance and installation;
-- repository publication of this implementation commit;
 - deployment and online runtime health.
 
+## Publication readback
+
+- REPO-014 remote `main`: `acf0d5f80bc3b5470571afa151d39a2db9421fdb`.
+- Fresh clone: clean work tree and `git fsck --full --strict` passed.
+- GHNQG receipt: `GHNQG-acf0d5f80bc3b5470571afa151d39a2db9421fdb.hdlp`, `PASS_100`.
+- Commit author: `铸渊 / ICE-P-ZY001 <ice-p-zy001@persona.hololake.local>`; human responsibility remains a separate trailer.
+
+Interrupted-session recovery is continued in
+[the next runtime receipt](./2026-08-11-hololake-pncc-interrupted-session-recovery.md).
+
 This receipt proves source behavior and tests only. It does not claim that a desktop artifact or online
 persona runtime is running.

engineering/operations/2026-08-11-hololake-pncc-interrupted-session-recovery.md

@@ -0,0 +1,45 @@
+# GH-PNCC interrupted-session inspection and recovery receipt
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Source component: `product-source/hololake-platform/src-tauri/src/persona_code_channel.rs`
+- State: `LOCAL_SOURCE_IMPLEMENTED_AND_FULL_RUST_ROUTING_TESTED`
+
+## Implemented facts
+
+The runtime now exposes an exact session inspection command and a fail-closed recovery command. Both require
+the caller to name the session, expected persona, and expected canonical repository. Inspection verifies the
+hash-linked event journal and reports the recorded/observed Git heads, work-tree cleanliness, exact lease
+ownership, session state, last event, attribution, and one recovery disposition.
+
+Recovery does not treat age as proof of death and never steals a lease. It releases the exact primary only
+for either:
+
+1. a clean repository still at the session's recorded head, which is closed as an uncommitted interruption;
+2. a clean repository advanced by exactly one commit whose parent is the recorded head and whose persona
+   checkpoint, manifest pointer, Git author, human-responsibility trailer, persona-author trailer and
+   development-id trailer all match the interrupted session.
+3. an exact same-session lease left behind after the event journal and session record already prove dormancy,
+   with a clean repository still at the recorded head.
+
+Dirty repositories, missing or mismatched leases, broken journals, unknown Git advances, checkpoint
+mismatches and attribution mismatches fail closed without resetting files or releasing the primary.
+
+## Current verification
+
+- PNCC focused Rust tests: `10 passed, 0 failed`.
+- Rust full suite: `1150 passed, 0 failed, 2 ignored`; integration test `1 passed`.
+- Rust clippy for all targets: `PASS` with `-D warnings`.
+- HoloLake architecture routing: `29 passed, 0 failed`.
+- Tests cover safe abort, safe committed-session finalization, dirty-repository refusal, second-primary
+  exclusion, path containment, model/evidence scope, checkpoint promotion and persona Git attribution.
+
+## Remaining acceptance
+
+- native authority/core and GHNQG pre-push quality gates;
+- repository commit, publication and fresh-clone readback;
+- general-purpose organ contract beyond the first read-only fact organ;
+- HoloLake human projection, desktop artifact, installation, deployment and online health.
+
+This receipt proves local source behavior only until the remaining quality and publication gates complete.