# GH-PNCC incomplete idempotent request inspection and safe receipt recovery

- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
- Published repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
- Published tree: `6218fb109913649151609a0f956b699ae375198a`
- Publication queue: `PUB-20260810194731692-1ad8ad9a`
- GHNQG manual SHA-256: `691d600d1f8743212bfb16bbd47a7609ec22b0219a2af76b35bc281feb364f77`
- State: `PUBLISHED_VERIFIED`

## Implemented facts

The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its
request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those
two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.

`inspect_persona_code_channel_lifecycle_request` derives the deterministic session from the original semantic
request and reports `NOT_STARTED`, `COMPLETE_REPLAYABLE`, `SAFE_BIND_PERSISTED_RECEIPT`,
`INCOMPLETE_REQUIRES_SESSION_RECOVERY`, or `MANUAL_REVIEW_REQUIRED`. It verifies the canonical repository,
persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.

`recover_persona_code_channel_lifecycle_request` may write only when a complete persisted receipt exists, the
session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state,
binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial
bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are
never reconstructed from guesses and remain owned by the established session recovery path.

## Current verification

- PNCC focused Rust tests: `25 passed, 0 failed`.
- A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
  lifecycle without another model call, session, organ activation, or Git commit.
- A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
- Full repository gates, GHNQG, publication, strict fsck, and fresh-clone readback from
  `/tmp/pncc-verify-b8c3fcf-readback` passed for the exact published head and tree.

## Truth boundary and next minimum

- Runtime files in the existing session directory remain the only evidence plane; no database or second
  request authority was introduced.
- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next stage implements the separately bounded terminal-failure receipt and replay rule; this published
  stage remains the success-receipt and crash-window recovery authority.