feat(pncc): recover persisted lifecycle receipt binding

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -96,6 +96,13 @@ return that verified lifecycle with `replayed: true`. A changed request under th
 `PERSONA_LIFECYCLE_REQUEST_CONFLICT`; a partial session without a complete receipt fails recovery-required
 instead of launching a duplicate.
 
+The persisted receipt is promoted before its three binding fields are written to `PersonaSessionRecord`.
+`PersonaLifecycleRequestInspectionReceipt` makes that two-write boundary explicit. Only a complete, hash-valid
+receipt beside a verified dormant session with no lease and all three binding fields absent is
+`SAFE_BIND_PERSISTED_RECEIPT`; the recovery command fills those bindings and then uses the ordinary replay
+verifier. Missing receipts, partial bindings, active leases, damaged chains, or changed semantics remain
+recovery/manual-review states and cannot be converted into a successful receipt.
+
 `PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
 It filters by the caller's expected persona and canonical repository, validates each matching event chain,
 and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps