Preserve legacy Persona checkpoints and refuse blank recovery

[joelteply]

A legacy core could save Persona working memory beneath its working directory while a new core loads the native user data directory. It could therefore start from an unrelated checkpoint. Existing load/read/schema errors could also become an empty-memory registration.

Add an explicit local continuum checkpoint inspect/adopt path that selects one complete legacy snapshot by declared Persona UUID and exact hashes, preserves selected/prior bytes, and records intent plus retry-verifiable receipt before and after replacement. No sequence/mtime merge or current-machine migration script. Adoption requires stopped legacy writers, checks one readable process snapshot, and rechecks offline state under the same per-Persona OS lock used by loading and saving.

Resident registration is now fallible: only a missing checkpoint permits fresh memory; lock/read/schema failures preserve an existing resident and surface a typed supervisor slot error. Ephemeral evaluation remains independent of resident files. Ordinary checkpoint saves flush bytes before replacement and synchronize parent directories on Unix.

The CLI protects both Persona stores from inspection-plan writes, rejects ambiguous process evidence, and refreshes executable paths without broadening core termination to parent-directory name matches. Recovery documentation describes the operator contract and limitations.

Validation:

• At b4e0060, three independent source reviews, rustfmt, git diff --check, and a clean merge-tree against canary 8c088d2 passed. CI run 34286768088 passed 7,847 library tests, two compile-fail doctests, Windows library/test-harness checks, and binding checks. The native Windows library plus real CLI harness passed 20 tests at that head.
• Combined native Clippy on companion Preserve resident memory and report checkpoint state accurately #3927 at 64703ce exited 0 but emitted 1,356 warnings against a 1,351-warning baseline. The introduced warnings prevented a clean validation receipt.
• Current head 9d3fe80 fixes the checkpoint-adoption nonminimal_bool and CLI items_after_test_module findings. Its CI run 34296170337 passed 7,847 library tests (0 failed), both compile-fail doctests, Windows library/test-harness checks, and binding checks. Companion Preserve resident memory and report checkpoint state accurately #3927 also checks its ignored test registration Result. These three mechanical corrections were source reviewed; no post-fix native Clippy run is claimed or required for readiness. Fresh CI has now passed at this head and companion Preserve resident memory and report checkpoint state accurately #3927 head 7dd3bff.

Regressions exercise actual files, owner lock contention, changed source/destination, interrupted receipt completion, failed resident replacement, actual supervisor sibling isolation, CLI preconditions, and process classification. The reviewed corrected head has passed its executable CI checks.

Limits: the legacy payload has no embedded identity/lifetime; its UUID is explicitly declared, and every receipt says legacy_final_flush_acknowledged=false. Old binaries cannot retroactively honor the file lock or produce a final-flush acknowledgement. Both inputs must decode; corrupt native destinations remain untouched and are not repaired by this command. Windows receipts do not promise directory-journal persistence across power loss. No runtime adoption or restart performed.

Card 9f160b78-ae31-485f-aadd-91865618a40e.