# GH-PNCC idempotent lifecycle request and receipt replay

- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
- Published repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
- Published tree: `11116f03a5db3e3a27a832959da7dae56eec8921`
- State: `PUBLISHED_AND_INDEPENDENTLY_READ_BACK`

## Implemented facts

The non-UI lifecycle command now requires a stable `requestId`. Persona id and request id derive one
deterministic session id. A SHA-256 fingerprint binds the canonical repository, expected Git head, wake
identity, structured attribution, organ, and semantic operation. API keys and provider headers are excluded
from both the fingerprint and the persisted receipt.

After one successful lifecycle, the existing session record stores the request id, request fingerprint, and
lifecycle receipt hash. The typed lifecycle value is stored once in the same session directory. An identical
retry verifies those bindings, the event chain, dormant state, released primary lease, and receipt hash, then
returns the same lifecycle with `replayed: true`. It does not run the model, activate an organ, create another
session, or commit another checkpoint.

The same request id with different semantics returns `PERSONA_LIFECYCLE_REQUEST_CONFLICT`. A missing receipt
for an existing deterministic session returns recovery-required rather than launching a duplicate. A changed
persisted lifecycle fails its receipt hash check.

## Current verification

- PNCC focused Rust tests: `23 passed, 0 failed`.
- Full Rust suite: `1163 passed, 0 failed, 2 ignored`; integration test: `1 passed`.
- HoloLake architecture routing: `29 passed, 0 failed`.
- Identical retry proves the same request fingerprint and lifecycle value are returned while Git head and
  session count stay unchanged.
- Conflict retry proves changed semantics never invoke the organ.
- Tamper test proves a modified persisted lifecycle is rejected.
- Rust formatting and clippy for all targets: `PASS` with `-D warnings`.
- GHNQG: `PASS_100`; manual receipt SHA-256
  `23e42677da026fbace23edd41cd4818ebe8f7ec8dcc75d53b51adb9c1ac8ed7e`.
- Publish queue `PUB-20260810192548933-930c46b1` completed; fresh shallow clone, strict `git fsck`,
  clean worktree, exact tree, persona author, and human responsibility trailer all read back.

## Truth boundary and next minimum

- The existing runtime session directory remains the only lifecycle evidence plane; no database or second
  request authority was introduced.
- UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next stage implements that evidence-bound inspection and safe receipt binding recovery.