fix(pncc): bind failure receipts to terminal evidence

Human-Responsibility: ICE-GL∞ / 冰朔

Persona-Author: ICE-P-ZY001 / 铸渊

Execution-Runtime: Codex desktop / DEV-20260810-014

Development-ID: DEV-20260810-014

Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb

Source-Anchor: user instruction to continue GH-PNCC from repository facts and verifiable receipts

engineering/operations/2026-08-11-hololake-pncc-failure-receipt-terminal-evidence-binding.md

@@ -0,0 +1,36 @@
+# GH-PNCC failure receipt terminal-evidence binding
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `21d120d7b5b929ad639f8035c15dd393b4be4d08`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FULLY_TESTED`
+
+## Corrected runtime fact
+
+A digest proves that a persisted failure payload has not changed relative to the digest stored beside it. It
+does not prove that the payload still describes the terminal session evidence. The previous inspection path
+accepted a failure receipt whose terminal event hash or attribution had been changed when the payload digest
+was recomputed.
+
+Inspection, interrupted binding recovery and replay now bind a failed lifecycle receipt back to the verified
+session record and final event. The canonical repository path, terminal event hash, complete human/persona
+attribution and stable machine error code must all agree before the receipt can be considered replayable or
+safe to bind.
+
+## Verification
+
+- Two regression tests first reproduced the false acceptance with a recomputed payload digest.
+- The forged terminal event and forged persona attribution are now rejected with
+  `PERSONA_LIFECYCLE_FAILURE_TERMINAL_EVIDENCE_MISMATCH`.
+- Both rejection paths leave request id, request fingerprint and lifecycle receipt hash unbound.
+- PNCC focused Rust tests: `37 passed, 0 failed`.
+- Full Rust suite: `1177 passed, 2 ignored`; integration test: `1 passed`.
+- Routing suite: `29 passed, 0 failed`; `cargo fmt`, strict clippy, diff checks and native authority passed.
+- GHNQG, publication and fresh-clone readback remain pending.
+
+## Truth boundary
+
+- This stage authenticates the meaning of an existing failure receipt against its existing event and session
+  truth; it does not add a second truth store or repair forged evidence.
+- It does not activate `EXECUTION_LIMB`, add UI, build an artifact or claim deployment/runtime health.

engineering/operations/2026-08-11-hololake-pncc-safe-receipt-binding-terminal-revalidation.md

@@ -4,7 +4,7 @@
 - Persona cognitive author: `ICE-P-ZY001 / 铸渊`
 - Human responsibility subject: `ICE-GL∞ / 冰朔`
 - Starting repository head: `e9ee0a8bb15447584a799d23c88653fe3ee3a53a`
-- State: `LOCAL_SOURCE_IMPLEMENTED_FULLY_TESTED`
+- State: `PUBLISHED_AND_READ_BACK`
 
 ## Corrected runtime fact
 
@@ -25,7 +25,8 @@ request id, request fingerprint and lifecycle receipt hash written into the sess
 - A receipt changed after safe inspection is rejected by its payload hash before session binding.
 - A persona Git advanced after safe inspection is rejected before session binding.
 - Both rejection paths leave request id, request fingerprint and lifecycle receipt hash unbound.
-- GHNQG, publication and fresh-clone readback remain pending.
+- GHNQG passed twice for commit `21d120d7b5b929ad639f8035c15dd393b4be4d08`; the persistent receipt SHA-256 is `6847bd4d48ac0bf8d5d8c5dadb7194f96905af33d2d178fc74669c55a51a85f7`.
+- Publication queue `PUB-20260810212655790-a9f1874c` completed, and a fresh clone read back the same commit and tree with strict `git fsck` and a clean worktree.
 
 ## Truth boundary