feat(pncc): replay terminal lifecycle failures

Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred

engineering/INDEX.md

@@ -32,7 +32,8 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
-| 2026-08-11 | GH-PNCC 幂等中断恢复 | [不完整幂等请求检查与安全回执恢复](operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md) | 本地源码与聚焦测试已通过；完整门禁、发布与独立回读待验收 |
+| 2026-08-11 | GH-PNCC 终态失败重放 | [终态失败结构化回执与幂等重放](operations/2026-08-11-hololake-pncc-idempotent-terminal-failure-replay.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |
+| 2026-08-11 | GH-PNCC 幂等中断恢复 | [不完整幂等请求检查与安全回执恢复](operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md) | 已发布至 REPO-014 main b8c3fcf；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 幂等生命周期 | [生命周期请求身份与同一回执重放](operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md) | 已发布至 REPO-014 main 38ef9d0；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 生命周期协调器 | [已登记安全器官的非 UI 生命周期协调](operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md) | 已发布至 REPO-014 main 8f35834；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 记忆失败闭环 | [记忆代谢失败闭环与运行时命令接入](operations/2026-08-11-hololake-pncc-memory-failure-closure-runtime-command.md) | 已发布至 REPO-014 main 18944f5；GHNQG、全新克隆与严格 fsck 通过 |

engineering/operations/2026-08-11-hololake-pncc-idempotent-terminal-failure-replay.md

@@ -0,0 +1,42 @@
+# GH-PNCC idempotent terminal failure receipt and replay
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FULLY_TESTED`
+
+## Implemented facts
+
+A lifecycle command that reaches the kernel's already verified failure closure now persists one structured
+terminal-failure receipt in the existing session directory. It uses the same atomic receipt-first,
+session-binding-second protocol as successful lifecycle completion and does not create another request store.
+
+The failure payload contains a stable machine error code, terminal event hash, exact persona/repository
+identity, and structured human/persona attribution. Raw model-provider diagnostics are deliberately excluded.
+The receipt can be issued only after the session journal verifies, the state is `DORMANT_AFTER_FAILURE`, the
+last event is `DORMANT`, the exact primary lease is released, and the repository remains clean at the recorded
+Git head.
+
+An exact retry verifies the semantic fingerprint, receipt hash, event chain, terminal state, lease, and
+session bindings, then returns the same `FAILED` result with `replayed: true`. It does not invoke the model,
+activate an organ, write a checkpoint, or commit Git again. The existing inspection and safe-binding recovery
+commands accept the same proven terminal outcome and still reject partial bindings or unproven closure.
+
+## Current verification
+
+- PNCC focused Rust tests: `27 passed, 0 failed`.
+- Full Rust suite: `1167 passed, 2 ignored`; integration test: `1 passed`.
+- Routing suite: `29 passed, 0 failed`; `cargo fmt`, strict clippy, and diff checks passed.
+- The terminal-failure test proves exact retry does not call the model again and that raw provider detail is
+  absent from the persisted receipt.
+- The crash-window test proves an unbound failure receipt is safely inspected, bound, and replayed.
+- GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
+
+## Truth boundary
+
+- This is command-level terminal failure idempotency, not arbitrary recovery of an interrupted or active
+  session. If closure cannot be proven, the original error and established session recovery boundary remain.
+- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
+- The next runtime increment must be selected by a new source-backed gap assessment rather than inferred from
+  the human projection roadmap.

engineering/operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md

@@ -4,7 +4,11 @@
 - Persona cognitive author: `ICE-P-ZY001 / 铸渊`
 - Human responsibility subject: `ICE-GL∞ / 冰朔`
 - Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
-- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+- Published repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
+- Published tree: `6218fb109913649151609a0f956b699ae375198a`
+- Publication queue: `PUB-20260810194731692-1ad8ad9a`
+- GHNQG manual SHA-256: `691d600d1f8743212bfb16bbd47a7609ec22b0219a2af76b35bc281feb364f77`
+- State: `PUBLISHED_VERIFIED`
 
 ## Implemented facts
 
@@ -29,12 +33,13 @@ never reconstructed from guesses and remain owned by the established session rec
 - A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
   lifecycle without another model call, session, organ activation, or Git commit.
 - A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
-- Full repository gates, GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
+- Full repository gates, GHNQG, publication, strict fsck, and fresh-clone readback from
+  `/tmp/pncc-verify-b8c3fcf-readback` passed for the exact published head and tree.
 
 ## Truth boundary and next minimum
 
 - Runtime files in the existing session directory remain the only evidence plane; no database or second
   request authority was introduced.
 - UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
-- Terminal failed lifecycle calls still do not have an idempotently replayable command-level failure receipt;
-  that is the next minimum runtime boundary.
+- The next stage implements the separately bounded terminal-failure receipt and replay rule; this published
+  stage remains the success-receipt and crash-window recovery authority.