docs(coordination): clarify operation retry and no-change receipt semantics

[huangruiteng]

Summary

Follow up the review on #4053 without changing runtime authority semantics.

• Clarify operation identity vs parameter equality in both shared-authority RFC languages. UUIDs minted outside the transport retry boundary are valid; hashing parameters or a freshly observed revision is not a substitute for caller retry identity.
• Explain why named claim/update no-change operations retain a CAS-protected terminal receipt, unlike an empty archive selection.
• Extend the real FileAuthorityStore update test: replaying an earlier no-change after an intervening edit must not overwrite it; identical parameters with a new id may legitimately be new work.
• Explicitly retain the limitations: receipt-only history has a storage cost, and create/text-note update lack a public cross-process recovery key. This PR neither solves those limitations nor claims universal exactly-once execution.

Validation

• Tested revision: 342e02bf9 (based on current main 91baa0f96).
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
integration	passed	node --no-warnings --experimental-strip-types --test tests/control_plane_ts/local_authority_runtime.test.ts tests/control_plane_ts/todo_update.test.ts: 30 passed, zero skipped; real disposable FileAuthorityStore, identity conflicts and lost-response coverage.
real_entrypoint	passed	python -m pytest -q tests/control_plane/test_local_coordination_authority.py: 33 passed; public caller/provider/projection regressions.
integration	passed	Prior investigation on unchanged runtime: 5 selected managed-runtime retry/checkpoint tests passed, 22 unrelated cases deselected.
static	passed	python examples/docs-governance-smoke.py, python examples/repository-hygiene-smoke.py, diff whitespace and public/private scans.

Coverage/gaps: only documentation and one existing regression test change; no production implementation, permissions, provider schema, default behavior, UI or installation changes. PostgreSQL/full runtime suites are not required for this bounded non-runtime diff and were not rerun. No active goal or private data was used. The negative replay/new-intent contrast exercises the relevant real backend; this is not a migration or a new recovery framework.

Review and merge scope

Product/architecture judgment: preserve existing typed identity-consumption semantics while preventing a misleading blanket UUID/no-op fix. The future-facing pass documents the actual recovery boundary and adds a narrow regression instead of introducing speculative tracking infrastructure. No typed-state, domain-neutrality, guidance/obligation or default-off behavior is changed.

Owner authorized self-merge after validation and a temporary local Git time-gate bypass for this PR only. Bypass uses per-command configuration; no permanent hook or repository policy change is included. The diff is limited to two RFC files and a focused test; DCO sign-off is present.

[huangruiteng]

Self-review of exact head 342e02bf9360cc8436fd9268227829484343d0fb: no blocking findings.

Changed surfaces are the English/Chinese shared-authority RFC and one existing real FileAuthorityStore update regression. There is no production-code or authority-policy change. The test now distinguishes an old terminal no-change replay after an intervening edit from a genuinely independent attempt with identical parameters. The RFC explicitly preserves the current recovery limitations rather than presenting documentation as their implementation.

Risk-based premerge evidence: 30 focused TS tests and 33 public-caller Python tests passed on the current baseline; documentation governance, repository hygiene, whitespace and public/private scans passed. Five selected transport/checkpoint tests also passed during the investigation on unchanged runtime. No local failures or manual holds. Full runtime/PostgreSQL suites were not rerun because no such implementation changed. Hosted checks are still running; their completion is not claimed as evidence.

Typed-state, authority, domain-neutrality, behavior-change, guidance/obligation and default-off review: no new state rule, permission, runtime default, heuristic classifier or execution obligation. The bounded future-facing pass is the focused counterexample and explicit retry contract, not a new framework. This small docs/test clarification is covered by the owner's explicit self-merge authorization. Proceed with an exact-head admin squash merge using the local validation above, without changing repository protection or persistent local gate configuration.