feat(pncc): make lifecycle retries idempotent

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred

engineering/INDEX.md

@@ -32,7 +32,8 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
-| 2026-08-11 | GH-PNCC 生命周期协调器 | [已登记安全器官的非 UI 生命周期协调](operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md) | 本地完整 Rust/路由测试、格式与 clippy 已通过；GHNQG、提交与发布待验收 |
+| 2026-08-11 | GH-PNCC 幂等生命周期 | [生命周期请求身份与同一回执重放](operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md) | 本地完整 Rust/路由测试、格式与 clippy 已通过；GHNQG、提交与发布待验收 |
+| 2026-08-11 | GH-PNCC 生命周期协调器 | [已登记安全器官的非 UI 生命周期协调](operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md) | 已发布至 REPO-014 main 8f35834；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 记忆失败闭环 | [记忆代谢失败闭环与运行时命令接入](operations/2026-08-11-hololake-pncc-memory-failure-closure-runtime-command.md) | 已发布至 REPO-014 main 18944f5；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 运行查询 | [人格持久事件与回执有界查询](operations/2026-08-11-hololake-pncc-durable-runtime-query.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 器官合同 | [人格器官机器合同与清单检查](operations/2026-08-11-hololake-pncc-typed-organ-contract.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |

engineering/operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md

@@ -0,0 +1,44 @@
+# GH-PNCC idempotent lifecycle request and receipt replay
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+
+## Implemented facts
+
+The non-UI lifecycle command now requires a stable `requestId`. Persona id and request id derive one
+deterministic session id. A SHA-256 fingerprint binds the canonical repository, expected Git head, wake
+identity, structured attribution, organ, and semantic operation. API keys and provider headers are excluded
+from both the fingerprint and the persisted receipt.
+
+After one successful lifecycle, the existing session record stores the request id, request fingerprint, and
+lifecycle receipt hash. The typed lifecycle value is stored once in the same session directory. An identical
+retry verifies those bindings, the event chain, dormant state, released primary lease, and receipt hash, then
+returns the same lifecycle with `replayed: true`. It does not run the model, activate an organ, create another
+session, or commit another checkpoint.
+
+The same request id with different semantics returns `PERSONA_LIFECYCLE_REQUEST_CONFLICT`. A missing receipt
+for an existing deterministic session returns recovery-required rather than launching a duplicate. A changed
+persisted lifecycle fails its receipt hash check.
+
+## Current verification
+
+- PNCC focused Rust tests: `23 passed, 0 failed`.
+- Full Rust suite: `1163 passed, 0 failed, 2 ignored`; integration test: `1 passed`.
+- HoloLake architecture routing: `29 passed, 0 failed`.
+- Identical retry proves the same request fingerprint and lifecycle value are returned while Git head and
+  session count stay unchanged.
+- Conflict retry proves changed semantics never invoke the organ.
+- Tamper test proves a modified persisted lifecycle is rejected.
+- Rust formatting and clippy for all targets: `PASS` with `-D warnings`.
+- GHNQG, commit, publication, and fresh-clone gates remain pending for this stage.
+
+## Truth boundary and next minimum
+
+- The existing runtime session directory remains the only lifecycle evidence plane; no database or second
+  request authority was introduced.
+- UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
+- The next minimum is evidence-bound inspection and safe receipt recovery for an idempotent request that was
+  interrupted after lifecycle progress but before its replay receipt became complete.

engineering/operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md

@@ -4,7 +4,8 @@
 - Persona cognitive author: `ICE-P-ZY001 / 铸渊`
 - Human responsibility subject: `ICE-GL∞ / 冰朔`
 - Starting repository head: `18944f536261a4184570074a09fc43a09f5f31bb`
-- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+- Published repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
+- State: `PUBLISHED_GHNQG_AND_FRESH_CLONE_VERIFIED`
 
 ## Implemented facts
 
@@ -34,7 +35,8 @@ wake receipt beside a typed completion receipt. Runtime files and persona Git re
 
 - This is source implementation, not a packaged desktop, installed runtime, deployment, or online-health
   claim.
-- GHNQG, commit, publication, and independent fresh-clone readback remain pending for this stage.
+- GHNQG, persona-authored commit, publication, independent fresh-clone readback, clean tree, and strict Git
+  fsck passed.
 - UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
 - The next minimum is an idempotent lifecycle request identity and receipt replay rule so a caller retry
   cannot accidentally create a second lifecycle or duplicate a checkpoint commit.