fix(pncc): revalidate receipt binding evidence

Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex desktop / DEV-20260810-014
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb
Source-Anchor: user instruction to continue GH-PNCC from repository facts and verifiable receipts

engineering/INDEX.md

@@ -32,6 +32,7 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
+| 2026-08-11 | GH-PNCC 安全回执绑定终态复核 | [检查后、绑定前重新验证回执与人格 Git 终态](operations/2026-08-11-hololake-pncc-safe-receipt-binding-terminal-revalidation.md) | 本地源码、完整 Rust/路由测试与严格 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 成功回执终态复核 | [成功回执持久化前重新验证终态证据](operations/2026-08-11-hololake-pncc-success-receipt-terminal-revalidation.md) | 本地源码、完整 Rust/路由测试与严格 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 重放仓库复核 | [幂等重放时重新验证人格 Git 状态](operations/2026-08-11-hololake-pncc-replay-repository-state-revalidation.md) | 本地源码、完整 Rust/路由测试与严格 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 终态失败重放 | [终态失败结构化回执与幂等重放](operations/2026-08-11-hololake-pncc-idempotent-terminal-failure-replay.md) | 已发布至 REPO-014 main abc7dbd；GHNQG、全新克隆与严格读回通过 |

engineering/operations/2026-08-11-hololake-pncc-safe-receipt-binding-terminal-revalidation.md

@@ -0,0 +1,34 @@
+# GH-PNCC safe receipt-binding terminal revalidation
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `e9ee0a8bb15447584a799d23c88653fe3ee3a53a`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FULLY_TESTED`
+
+## Corrected runtime fact
+
+A successful lifecycle-request inspection is a point-in-time observation, not an enduring authorization to
+mutate the session record. Before an interrupted persisted receipt is bound, the kernel now re-derives the
+request identity and re-reads the receipt. It verifies the receipt schema, request id, semantic fingerprint,
+payload hash, outcome identity, persona and canonical repository again.
+
+The binding transaction also re-verifies the event chain, final `DORMANT` event, matching dormant state,
+released primary lease, recorded Git head and clean worktree. Only after all evidence still agrees are the
+request id, request fingerprint and lifecycle receipt hash written into the session record.
+
+## Verification
+
+- PNCC focused Rust tests: `33 passed, 0 failed`.
+- Full Rust suite: `1173 passed, 2 ignored`; integration test: `1 passed`.
+- Routing suite: `29 passed, 0 failed`; `cargo fmt`, strict clippy, diff checks and native authority passed.
+- A receipt changed after safe inspection is rejected by its payload hash before session binding.
+- A persona Git advanced after safe inspection is rejected before session binding.
+- Both rejection paths leave request id, request fingerprint and lifecycle receipt hash unbound.
+- GHNQG, publication and fresh-clone readback remain pending.
+
+## Truth boundary
+
+- This stage hardens recovery; it does not add a new truth store or a second writer.
+- It does not repair a changed receipt or repository and does not activate `EXECUTION_LIMB`.
+- UI, human projection aesthetics, desktop integration, artifacts, deployment and runtime health remain out of scope.