fix(issue-5): bind the auto-completion decision atomically to its attempt

Two findings from round 2, both reproduced before being accepted.

R2 -- attribution was compared before the terminal write and nothing tied the
two together. A job could complete, be re-dispatched and claimed again in that
window, and evidence from the first attempt then satisfied a status check and
finished the second one. Reproduced with real transitions: committed, with the
registry already on iteration 2.

This corrects my own earlier reasoning, and I want to be plain about it. Last
round I argued that the attempt guard could live entirely in the evidence layer
because that is where attempt identity lives. That holds for comparing evidence
to a dispatch, and it does not hold for atomicity: a precondition can only be
atomic with the commit if the transaction can read it under its own lock. So the
identity now lives in the record.

It is an opaque dispatch token, not the iteration counter. That distinction is
the part of the earlier rebuttal that still stands: iteration already means the
loop round, and comparing a dispatch attempt against it produces a guard that is
vacuous when they agree and wrong when they diverge. A token has no competing
meaning. It is minted when an attempt begins -- claim and redispatch -- and the
gate passes the token it decided against, so any intervening re-dispatch refuses
the commit.

R4 -- the intent identity was being emitted but nothing consumed it. A replayed
notification is re-published with a fresh wire sequence, so the monotonic guard
cannot recognise it; to that guard a retry looks new. The subscriber now
deduplicates on the stable intent identity, leaving the sequence guard as the
rule for ordinary events. Across a restart the disk fallback resolves terminal
status and a duplicate terminal is refused as an idempotent ack, so a replay
after restart cannot double-apply either.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib_py/loop/autocomplete.py

@@ -181,6 +181,21 @@ def evaluate(job_id, scenario, registry_dir=None, workspace=None,
     if mismatch:
         return GateResult(False, "hold", mismatch)
 
+    # The evidence must belong to the attempt that is currently running, and the
+    # commit must be refused if that stops being true while this runs. Comparing
+    # here alone is not enough: the job can complete, be re-dispatched and
+    # claimed again before the terminal write, after which a status check alone
+    # would let stale evidence finish a new attempt.
+    from lib_py.delegation import engine as _engine
+
+    token = record.get(_engine.DISPATCH_TOKEN_FIELD)
+    if not token:
+        return GateResult(False, "hold",
+                          "job has no dispatch token to bind this decision to")
+    if dispatch.get("dispatch_token") != token:
+        return GateResult(False, "hold",
+                          "evidence belongs to a superseded dispatch of this job")
+
     verdict = finalize.verify_manifest(
         report_dir, job_id, expected_attempt=dispatch.get("attempt_id"),
         expected_artifacts=record.get("expected_artifacts") or [])
@@ -206,7 +221,7 @@ def evaluate(job_id, scenario, registry_dir=None, workspace=None,
     # carries a loop-iteration counter, which is a different thing.
     result = engine.transition(
         job_id, "completed", registry_dir=registry_dir,
-        expected_status="running", source=SOURCE,
+        expected_status="running", expected_dispatch_token=token, source=SOURCE,
         fields={"completed_by": SOURCE, "auto_complete_reason": decision.reason},
         notify="completed",
     )