feat(pncc): make lifecycle retries idempotent

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -87,6 +87,15 @@ before wake or lease acquisition, then delegates to the same tested organ transa
 completion beside the wake receipt. It does not accept an execution action, infer organ permissions from UI
 state, or create a parallel lifecycle record.
 
+`requestId` is the coordinator's idempotency key, not a UI message id. The runtime derives a stable session
+identity from the exact persona and request id, and hashes the non-secret semantic request. API keys and
+provider headers are excluded; the manifest-pinned provider id, endpoint, model id, operation, Git head, and
+attribution remain included. A successful lifecycle stores one hash-bound receipt in its existing session
+directory and records the request id, fingerprint, and receipt hash in the same session record. Exact retries
+return that verified lifecycle with `replayed: true`. A changed request under the same id fails with
+`PERSONA_LIFECYCLE_REQUEST_CONFLICT`; a partial session without a complete receipt fails recovery-required
+instead of launching a duplicate.
+
 `PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
 It filters by the caller's expected persona and canonical repository, validates each matching event chain,
 and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps