fix: bind failure receipt error code

Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex desktop / DEV-20260810-014
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb
Source-Anchor: user instruction to continue GH-PNCC from repository facts and verifiable receipts

engineering/INDEX.md

@@ -32,7 +32,8 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
-| 2026-08-11 | GH-PNCC 成功回执事件日志绑定 | [把唤醒回执的日志路径重新绑定到精确运行时会话](operations/2026-08-11-hololake-pncc-success-receipt-event-journal-binding.md) | 本地源码、Rust 1191、聚焦路由、格式与严格 clippy 已通过；完整产品门和发布待验收 |
+| 2026-08-11 | GH-PNCC 失败回执错误码绑定 | [把稳定失败码绑定到终态会话证据](operations/2026-08-11-hololake-pncc-failure-receipt-error-code-binding.md) | 本地源码、Rust 1192、路由 29、格式与严格 clippy 已通过；完整产品门和发布待验收 |
+| 2026-08-11 | GH-PNCC 成功回执事件日志绑定 | [把唤醒回执的日志路径重新绑定到精确运行时会话](operations/2026-08-11-hololake-pncc-success-receipt-event-journal-binding.md) | 已发布至 REPO-014 main 1cd8a1b；GHNQG、全新克隆与严格读回通过 |
 | 2026-08-11 | GH-PNCC 成功回执完成检查点绑定 | [把完成回执的结构化事实重新绑定到人格 Git 检查点](operations/2026-08-11-hololake-pncc-success-receipt-completion-checkpoint-binding.md) | 已发布至 REPO-014 main 06a7782；GHNQG、全新克隆与严格读回通过 |
 | 2026-08-11 | GH-PNCC 成功回执唤醒器官合同绑定 | [成功回执唤醒器官合同证据绑定](operations/2026-08-11-hololake-pncc-success-receipt-wake-organ-contract-binding.md) | 本地源码、完整 Rust/前端/路由测试、原生权威与严格 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 成功回执唤醒器官模式绑定 | [成功回执唤醒器官模式证据绑定](operations/2026-08-11-hololake-pncc-success-receipt-wake-organ-mode-binding.md) | 本地源码、完整 Rust/前端/路由测试、原生权威与严格 clippy 已通过；GHNQG 和发布待验收 |

engineering/operations/2026-08-11-hololake-pncc-failure-receipt-error-code-binding.md

@@ -0,0 +1,33 @@
+# GH-PNCC failure receipt error-code evidence binding
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `1cd8a1b48951775530143c61a3af2d11215d4921`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+
+## Corrected runtime fact
+
+Failure receipt validation bound repository, terminal event and attribution, but only checked that `errorCode`
+looked like a stable machine code. A modified receipt could replace the real failure with another syntactically
+valid code, recompute the outer payload digest and still be accepted for safe binding or replay.
+
+The runtime now records the normalized terminal failure code in the same verified session record before writing
+the immutable failure receipt. Receipt persistence, inspection, recovery binding, replay and post-inspection
+binding revalidation require the receipt code to equal that exact session-bound value.
+
+## Verification
+
+- A regression test first reproduced `SAFE_BIND_PERSISTED_RECEIPT` after changing the real inference failure to
+  `AUTHORIZATION_GRANTED` and recomputing the payload digest.
+- The same forged receipt now fails with `PERSONA_LIFECYCLE_FAILURE_TERMINAL_EVIDENCE_MISMATCH`.
+- PNCC focused Rust tests: `52 passed, 0 failed`, including interrupted failure-receipt recovery.
+- Full Rust suite: `1192 passed, 2 ignored`; integration test: `1 passed`.
+- Routing suite: `29 passed`; formatting, strict clippy and diff checks passed.
+- Full product quality, publication and fresh-clone readback remain pending.
+
+## Truth boundary
+
+- This stage binds the already externalized stable failure code; raw provider details remain excluded.
+- It does not expose hidden reasoning, activate an execution limb, add UI, build an artifact or claim
+  deployment/runtime health.