feat(pncc): recover persisted lifecycle receipt binding

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred

engineering/INDEX.md

@@ -32,7 +32,8 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
-| 2026-08-11 | GH-PNCC 幂等生命周期 | [生命周期请求身份与同一回执重放](operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md) | 本地完整 Rust/路由测试、格式与 clippy 已通过；GHNQG、提交与发布待验收 |
+| 2026-08-11 | GH-PNCC 幂等中断恢复 | [不完整幂等请求检查与安全回执恢复](operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md) | 本地源码与聚焦测试已通过；完整门禁、发布与独立回读待验收 |
+| 2026-08-11 | GH-PNCC 幂等生命周期 | [生命周期请求身份与同一回执重放](operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md) | 已发布至 REPO-014 main 38ef9d0；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 生命周期协调器 | [已登记安全器官的非 UI 生命周期协调](operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md) | 已发布至 REPO-014 main 8f35834；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 记忆失败闭环 | [记忆代谢失败闭环与运行时命令接入](operations/2026-08-11-hololake-pncc-memory-failure-closure-runtime-command.md) | 已发布至 REPO-014 main 18944f5；GHNQG、全新克隆与严格 fsck 通过 |
 | 2026-08-11 | GH-PNCC 运行查询 | [人格持久事件与回执有界查询](operations/2026-08-11-hololake-pncc-durable-runtime-query.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |

engineering/operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md

@@ -4,7 +4,9 @@
 - Persona cognitive author: `ICE-P-ZY001 / 铸渊`
 - Human responsibility subject: `ICE-GL∞ / 冰朔`
 - Starting repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
-- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+- Published repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
+- Published tree: `11116f03a5db3e3a27a832959da7dae56eec8921`
+- State: `PUBLISHED_AND_INDEPENDENTLY_READ_BACK`
 
 ## Implemented facts
 
@@ -33,12 +35,14 @@ persisted lifecycle fails its receipt hash check.
 - Conflict retry proves changed semantics never invoke the organ.
 - Tamper test proves a modified persisted lifecycle is rejected.
 - Rust formatting and clippy for all targets: `PASS` with `-D warnings`.
-- GHNQG, commit, publication, and fresh-clone gates remain pending for this stage.
+- GHNQG: `PASS_100`; manual receipt SHA-256
+  `23e42677da026fbace23edd41cd4818ebe8f7ec8dcc75d53b51adb9c1ac8ed7e`.
+- Publish queue `PUB-20260810192548933-930c46b1` completed; fresh shallow clone, strict `git fsck`,
+  clean worktree, exact tree, persona author, and human responsibility trailer all read back.
 
 ## Truth boundary and next minimum
 
 - The existing runtime session directory remains the only lifecycle evidence plane; no database or second
   request authority was introduced.
 - UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
-- The next minimum is evidence-bound inspection and safe receipt recovery for an idempotent request that was
-  interrupted after lifecycle progress but before its replay receipt became complete.
+- The next stage implements that evidence-bound inspection and safe receipt binding recovery.

engineering/operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md

@@ -0,0 +1,40 @@
+# GH-PNCC incomplete idempotent request inspection and safe receipt recovery
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
+- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
+
+## Implemented facts
+
+The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its
+request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those
+two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.
+
+`inspect_persona_code_channel_lifecycle_request` derives the deterministic session from the original semantic
+request and reports `NOT_STARTED`, `COMPLETE_REPLAYABLE`, `SAFE_BIND_PERSISTED_RECEIPT`,
+`INCOMPLETE_REQUIRES_SESSION_RECOVERY`, or `MANUAL_REVIEW_REQUIRED`. It verifies the canonical repository,
+persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.
+
+`recover_persona_code_channel_lifecycle_request` may write only when a complete persisted receipt exists, the
+session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state,
+binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial
+bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are
+never reconstructed from guesses and remain owned by the established session recovery path.
+
+## Current verification
+
+- PNCC focused Rust tests: `25 passed, 0 failed`.
+- A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
+  lifecycle without another model call, session, organ activation, or Git commit.
+- A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
+- Full repository gates, GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
+
+## Truth boundary and next minimum
+
+- Runtime files in the existing session directory remain the only evidence plane; no database or second
+  request authority was introduced.
+- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
+- Terminal failed lifecycle calls still do not have an idempotently replayable command-level failure receipt;
+  that is the next minimum runtime boundary.