feat(pncc): add verified memory metabolism organ

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex desktop / GPT-5
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC persona runtime layer without UI or execution limb

engineering/operations/2026-08-11-hololake-pncc-independent-memory-metabolism.md

@@ -0,0 +1,42 @@
+# GH-PNCC independent verified memory metabolism
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `33b3b67ce7cb4383f91de6fb19ae8054a7edf8a0`
+- State: `LOCAL_SOURCE_IMPLEMENTED_AND_FULL_RUST_ROUTING_TESTED`
+
+## Implemented facts
+
+`MEMORY_METABOLISM / checkpoint-write` is now an independently activatable PNCC organ. It does not invoke a
+model and does not accept free-form hidden reasoning. Its command names one distinct source session and
+accepts it only when the session belongs to the same persona and canonical repository, is exactly `DORMANT`,
+points to the current Git head and current manifest checkpoint, and has a valid lifecycle hash chain ending
+at that head.
+
+The source checkpoint must be a structured `hololake.persona-checkpoint/v1` owned by that source session and
+persona. Its fact result is revalidated against the source organ evidence allowlist. The promoted checkpoint
+records the source session, source checkpoint path, source checkpoint SHA-256 and source event-chain head,
+then commits only the new checkpoint and manifest pointer with the persona Git identity. The runtime appends
+`MEMORY_CANDIDATE_VERIFIED → CHECKPOINT_COMMITTED → ORGAN_RELEASED → DORMANT` and releases the exact
+primary lease. A damaged source event chain fails closed, records failure dormancy for the memory session,
+releases the lease, and leaves the persona repository clean.
+
+## Current verification
+
+- PNCC focused Rust tests: `16 passed, 0 failed`.
+- Rust full suite: `1156 passed, 0 failed, 2 ignored`; integration test `1 passed`.
+- Rust clippy for all targets: `PASS` with `-D warnings`.
+- HoloLake architecture routing: `29 passed, 0 failed`.
+- Tests cover the positive independent promotion cycle and corrupted source-chain refusal with exact lease
+  release, in addition to the earlier lifecycle, attribution, recovery, query and repository-boundary cases.
+
+## Remaining acceptance
+
+- GHNQG pre-push quality gate;
+- repository commit, publication and fresh-clone readback;
+- runtime command integration and further memory failure-closure review;
+- execution-limb executor remains deliberately unimplemented;
+- UI, packaged desktop, installation, deployment and online health remain `0`.
+
+This receipt proves local source behavior only until publication readback is complete.