feat(pncc): make lifecycle retries idempotent

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -58,6 +58,15 @@ sense. It then owns one complete session from wake through the existing organ tr
 the wake receipt and the typed completion receipt. It cannot express or activate `EXECUTION_LIMB`, does not
 add a scheduler or second state store, and runs the complete lifecycle on the blocking task pool.
 
+The coordinator also requires a caller-stable lifecycle request id. Persona id plus request id derives one
+deterministic session id, while a credential-free fingerprint binds the canonical repository, expected Git
+head, wake identity, attribution, organ, and semantic operation. A completed request persists its typed
+lifecycle receipt beside the existing session record and cross-binds its hash into that record. An identical
+retry verifies the session event chain, dormant state, released lease, fingerprint, and receipt hash before
+replaying the same lifecycle value without invoking an organ or committing Git again. Reusing the request id
+for different semantics is a conflict. A session without a complete bound receipt is recovery-required and
+is never treated as permission to start a second lifecycle.
+
 `query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
 name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
 existing session records and event journals directly, verifies every returned hash chain, sorts by the last