[Task]: GH-C37 add IP-035 install ownership is not an update permission

[Chumaniac]

Task ID or area

GH-C37 (interaction model / docs)

Technical direction

Architecture and research incubator

Intent

I want to claim an existing task

Goal and acceptance gap

Goal/source: GH-C37 asks for one new public-safe good/bad case in
docs/concepts/interaction-pattern-catalog.md, with trigger signals, user
channel, agent channel, state contract, bad smell, and validation reference.

Current gap: the catalog covers missing write-scope projection (IP-006),
revision-guarded configuration apply (IP-030), connector runtime boundaries
(IP-028), and manager-context retention (IP-031), but it has no entry for the
case where the write target itself has a different owner than the caller: an
install that LoopX does not own. loopx/self_update.py::_install_lifecycle
already classifies install_kind / owner / loopx_apply_supported and fails
closed with next_action.kind=use_installation_owner, and
tests/test_self_update_runtime_activation.py already pins the mutation cases,
but nothing in the concept catalog tells a controller or agent that
"requires_upgrade=true" is not permission to pick an installer.

Accepted outcome (before → after): before, an agent or automation that sees
upgrade drift has no catalog rule to consult and may run pip install --upgrade loopx, pipx upgrade, or git pull against an install it does not own; after,
IP-035 states the classify-then-mutate rule, the fail-closed
unsupported_install_owner behavior, and the obligation to hand back the
owner-owned command without switching install channels.

Proposed scope

In scope / owner: one new catalog entry IP-035 Install Ownership Is Not An Update Permission under the State And Boundary family, with its family-table
row, its Pattern-To-Canary matrix listing, and a detail section carrying
trigger, expected behavior, mermaid visual model, bad smell, and validation
references. Docs only; no production or test change.

Existing related work / dependencies: loopx/self_update.py::_install_lifecycle
(the install_kind / owner / execution_driver / owner_upgrade_command
predicate), tests/test_self_update_runtime_activation.py
(test_live_checkout_apply_never_mutates_git_or_switches_install_channels,
test_unknown_package_manager_apply_fails_without_guessing_pip),
tests/test_doctor_install_freshness.py, examples/loopx-update-smoke.py, and
docs/guides/installing-loopx.md. No new smoke is proposed; the entry is
protected by the existing examples/interaction-pattern-catalog-smoke.py
structure check.

Out of scope: changing update/apply behavior, adding installer support for
package managers outside pip/pipx, new canary profiles, and any change to
doctor output.

If staged: not staged. The entry is complete on its own; a future owner may add
a CLI-level assertion for the case where no owner command exists.

Intended base branch

main

Relevant files or commands

• docs/concepts/interaction-pattern-catalog.md
• loopx/self_update.py (_install_lifecycle)
• tests/test_self_update_runtime_activation.py
• tests/test_doctor_install_freshness.py
• examples/loopx-update-smoke.py
• docs/guides/installing-loopx.md
• python3 examples/interaction-pattern-catalog-smoke.py
• loopx check --scan-path docs/concepts/interaction-pattern-catalog.md

Validation plan

Accepted result and independent oracle: the catalog gains exactly one new
IP-035 row with a matching #### IP-035 ... detail heading, listed under a
single family, and the pre-existing catalog smoke still passes. The oracle is
the shipped update contract itself: the entry's claims are checkable against
_install_lifecycle and the five named tests rather than against prose.

Actual entrypoint / safe command:
python3 examples/interaction-pattern-catalog-smoke.py and
loopx check --scan-path docs/concepts/interaction-pattern-catalog.md.

Negative or recovery case: the smoke fails if a pattern row exists without a
detail heading, if a detail heading exists without a row, or if an id is listed
under more than one family; the entry must therefore keep all three surfaces in
sync. The bad-smell paragraph is independently falsifiable: if
update apply ever mutates a live_checkout or guesses pip for a
custom-manager environment, the cited tests fail and the entry is wrong.

Frontend / Lark / CLI impact or verified N/A: N/A. Documentation-only change to
a concept catalog; no CLI, dashboard, or Lark surface is touched.

Public/private boundary

• This issue does not include private benchmark traces, verifier output, credentials, internal document links, raw agent sessions, or local runtime state.
• I will not run or duplicate maintainer-owned benchmark cases unless a maintainer explicitly splits out a public task.