[Task]: GH-C37 add IP-036 a lost response is not an absent commit

まず docs/concepts/interaction-pattern-catalog.md を開き、関連する項目とファミリーテーブルを読んでください。次に、記載されている CLI ヘルプテキストと調整テストを確認し、主張の根拠を確かめてください。単一のファミリーの下に IP-036 の項目を1つ追加し、マトリックスへの掲載と詳細セクションも含めてください。python3 examples/interaction-pattern-catalog-smoke.py と loopx check --scan-path docs/concepts/interaction-pattern-catalog.md を実行してください。カタログの各表示が一致し、両方のチェックに合格すれば完了です。

Task ID or area

GH-C37 (interaction model / docs)

Technical direction

Architecture and research incubator

Intent

I want to claim an existing task

Goal and acceptance gap

Goal/source: GH-C37 asks for one new public-safe good/bad case in
docs/concepts/interaction-pattern-catalog.md, with trigger signals, user
channel, agent channel, state contract, bad smell, and validation reference.

Current gap: the catalog names what a caller may do with an authority it can
see — IP-006 owns a projected write scope that disagrees with its checkpoint,
IP-016 owns the idempotency key inside a task lease, IP-020 owns a Todo claim /
supersede / successor lifecycle, IP-033 owns a rejection that is recorded rather
than absent. It has no entry for the transport-level case all four quietly
assume away: the commit landed and nobody was told. The rule already exists
in shipped code and tests — loopx/cli_commands/delegation.py:25 registers
--operation-id as "Stable request identity; reuse after a lost response",
loopx/cli_commands/handoff_mode.py:99 says the same for a canonical set
intent, tests/control_plane/test_coordination_recoverable_execution.py:693
asserts a re-sent operation returns already_applied with the original receipt,
and tests/control_plane/test_coordination_provider_parity.py:222 makes
operation_identity_reuse a dimension every coordination provider must answer
the same way — but nothing in the concept catalog tells a controller or agent
that a lost response is not an absent commit, so the default recovery move is a
blind retry.

Accepted outcome (before → after): before, an agent that sees an error, an
exceeded response budget, or a dropped reply has no catalog rule to consult and
may retry as a fresh request, creating a second authoritative record, spending
quota twice, or rolling back an effect that already settled; after, IP-036 A
Lost Response Is Not An Absent Commit states the four rules — name the write
before dispatching it, recover by readback instead of retry, publish the material
an authoritative record points at before or under the same identity as that
record, and treat one identity carrying a second intent as a rejection — with the
settled vocabulary (delivered / replayed / ambiguous_reconciled) as the
shared owner of the ambiguity outcome.

Proposed scope

In scope / owner: one new catalog entry IP-036 A Lost Response Is Not An Absent Commit under the State And Boundary family, with its family-table row, its
Pattern-To-Canary matrix listing, and a detail section carrying trigger, expected
behavior, mermaid visual model, bad smell, and validation references. Docs only;
no production or test change.

Existing related work / dependencies: loopx/cli_commands/delegation.py and
handoff_mode.py (the --operation-id help text that names this pattern),
tests/control_plane/test_coordination_recoverable_execution.py,
tests/control_plane/test_coordination_provider_parity.py,
tests/cli_commands/test_source_session_lifetime.py (the negative twin: one
identity may not carry two intents),
loopx/control_plane/coordination/local_authority_shadow_adapter.py
(_SETTLED_OUTCOMES), and #5007 / #5012 as the public counterexample and its
proposed ordering fix. No new smoke is proposed; the entry is protected by the
existing examples/interaction-pattern-catalog-smoke.py structure check.

Out of scope: changing any create/recovery behavior in the Todo, coordination, or
shadow paths (that is #5007 / #5012 and the authority owners' call), adding
--operation-id to commands that do not have one, new canary profiles, and any
change to settled-outcome vocabulary.

If staged: not staged. The entry is complete on its own; a possible successor is
a catalog-level assertion that every command with a durable write exposes a
recovery identity, which would need the CLI owners' input.

Intended base branch

main

Relevant files or commands

• docs/concepts/interaction-pattern-catalog.md
• loopx/cli_commands/delegation.py, loopx/cli_commands/handoff_mode.py
• tests/control_plane/test_coordination_recoverable_execution.py
• tests/control_plane/test_coordination_provider_parity.py
• tests/cli_commands/test_source_session_lifetime.py
• python3 examples/interaction-pattern-catalog-smoke.py
• loopx check --scan-path docs/concepts/interaction-pattern-catalog.md

Validation plan

Accepted result and independent oracle: the catalog gains exactly one new
IP-036 row with a matching #### IP-036 ... detail heading, listed under a
single family, and the pre-existing catalog smoke still passes. The oracle is the
shipped recovery contract itself: every claim in the entry is checkable against
the named file:line pairs and tests above, not against prose.

Actual entrypoint / safe command:
python3 examples/interaction-pattern-catalog-smoke.py and
loopx check --scan-path docs/concepts/interaction-pattern-catalog.md.

Negative or recovery case: the smoke fails if a pattern row exists without a
detail heading, if a detail heading exists without a row, or if an id is listed
under more than one family, so the three surfaces of this entry cannot drift
apart. The bad-smell paragraph is independently falsifiable: if a re-sent
operation ever returns a second effect instead of already_applied with the
original receipt, or if one identity carrying two intents stops being rejected,
the cited tests fail and the entry is wrong.

Frontend / Lark / CLI impact or verified N/A: N/A. Documentation-only change to a
concept catalog; no CLI, dashboard, or Lark surface is touched.

Public/private boundary

• This issue does not include private benchmark traces, verifier output, credentials, internal document links, raw agent sessions, or local runtime state.
• I will not run or duplicate maintainer-owned benchmark cases unless a maintainer explicitly splits out a public task.