fix(pncc): revalidate Git state before replay

Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -81,6 +81,11 @@ clean Git head, semantic fingerprint, receipt hash, and session bindings before
 with `replayed: true`. Active, dirty, partially closed, or otherwise unproven failures retain the original
 recovery path and cannot be converted into a terminal receipt.
 
+The unchanged-clean-repository condition is enforced again on every successful or failed receipt replay,
+not only when the receipt is first persisted. If the current head differs from the session's recorded head,
+or the worktree has become dirty, replay fails closed and request inspection reports manual review instead
+of restarting the organ or treating stale evidence as current.
+
 `query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
 name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
 existing session records and event journals directly, verifies every returned hash chain, sorts by the last