# GH-PNCC incomplete idempotent request inspection and safe receipt recovery

- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`

## Implemented facts

The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its
request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those
two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.

`inspect_persona_code_channel_lifecycle_request` derives the deterministic session from the original semantic
request and reports `NOT_STARTED`, `COMPLETE_REPLAYABLE`, `SAFE_BIND_PERSISTED_RECEIPT`,
`INCOMPLETE_REQUIRES_SESSION_RECOVERY`, or `MANUAL_REVIEW_REQUIRED`. It verifies the canonical repository,
persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.

`recover_persona_code_channel_lifecycle_request` may write only when a complete persisted receipt exists, the
session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state,
binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial
bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are
never reconstructed from guesses and remain owned by the established session recovery path.

## Current verification

- PNCC focused Rust tests: `25 passed, 0 failed`.
- A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
  lifecycle without another model call, session, organ activation, or Git commit.
- A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
- Full repository gates, GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.

## Truth boundary and next minimum

- Runtime files in the existing session directory remain the only evidence plane; no database or second
  request authority was introduced.
- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- Terminal failed lifecycle calls still do not have an idempotently replayable command-level failure receipt;
  that is the next minimum runtime boundary.