feat(runtime): claim effects before dispatch and gate completion on them

Dispatcher seam: mark_dispatch, which runs inside the live Wave 3 binding
scope immediately before backend invocation, now durably claims a possible
effect before execution_id is assigned. If the claim cannot be persisted the
action stays undispatched and the dispatcher returns BLOCKED; dispatched()
closes the never-awaited coroutine. record_action appends the outcome
(including cancellation/interruption) and admitted-read observations before
the receipt reduction drops producer facts.

Adapters consume only the bound operations the dispatcher admitted:
filesystem bindings give exact scope and predicates (write_file content digest
after fence unwrapping, apply_patch add/delete, edit existence); bash/python
launches have unknown scope with the launch generation as lineage; job kills
scope the exact job and its processes; owned operations scope their exact
revisioned records; external backends are claimed as external and never
verified by acknowledgement; browser session_info yields session lifecycle
observations only, and a page binding is never effect scope. Complete
read_file re-reads the exact bound source to digest it; offset/limit,
truncation, extraction and listings are partial. Background launches stay
RUNNING until an admitted read of the exact job generation (via a durable
launch index, across continuation runs) reports settlement.

Producer seams: typed job lifecycle facts on manage_bg_jobs reads/kills, a
structured timed_out flag on containment timeouts, and mutation_attempted on
in-place write_file/edit_file failures after truncation.

Completion: the existing EvidenceLedger consumes effect assessments through a
single helper used for the decision, ask_user and prose filtering. A required
artifact is unsettled by a later unresolved effect that may have touched it,
a fresh contradicting readback fails the decision, and partial reads no longer
count as artifact validation. Ordinary conversation and read-only turns are
unchanged; no second completion policy is introduced.

src/agent_tools/bg_job_tools.py

@@ -44,6 +44,19 @@ def _status_label(rec: Dict[str, Any]) -> str:
     return status
 
 
+def _job_facts(rec: Dict[str, Any]) -> Dict[str, Any]:
+    """Typed lifecycle facts from the exact admitted job record.
+
+    Execution evidence only: completion of a job is not verification of any
+    filesystem, service or external state its command was meant to change.
+    """
+    code = rec.get("exit_code")
+    return {"status": rec.get("status") if rec.get("status") in {"running", "done", "failed"} else "unknown",
+            "exit_code": code if type(code) is int else None,
+            "timed_out": rec.get("timed_out") is True, "killed": rec.get("killed") is True,
+            "died": rec.get("died") is True}
+
+
 def _row(rec: Dict[str, Any]) -> str:
     cmd = (rec.get("command") or "").strip().splitlines()[0][:80]
     return f"[{rec.get('id')}] {_status_label(rec)} | {_age(rec)} | {cmd}"
@@ -101,17 +114,20 @@ class ManageBgJobsTool:
 
             if action in _KILL_ACTIONS:
                 if rec.get("status") != "running":
-                    return {"output": f"Job `{job_id}` already {_status_label(rec)}; nothing to kill.", "exit_code": 0}
+                    return {"output": f"Job `{job_id}` already {_status_label(rec)}; nothing to kill.", "exit_code": 0,
+                            "job": _job_facts(rec)}
                 killed = bg_jobs.kill(job_id, expected=resource)
                 if not killed or not killed.get("killed"):
                     return {"error": f"Could not verify termination of background job `{job_id}`.",
                             "exit_code": 1, "teardown": (killed or {}).get("teardown")}
-                return {"output": f"Killed background job `{job_id}` ({(killed or {}).get('command', '').splitlines()[0][:80]}).", "exit_code": 0}
+                return {"output": f"Killed background job `{job_id}` ({(killed or {}).get('command', '').splitlines()[0][:80]}).", "exit_code": 0,
+                        "job": _job_facts(killed)}
 
             out = rec.get("output") or "(no output yet)"
             return {
                 "output": f"Job `{job_id}` [{_status_label(rec)}, {_age(rec)}]\nCommand: {rec.get('command')}\n\nOutput:\n{out}",
                 "exit_code": 0,
+                "job": _job_facts(rec),
             }
 
         return {"error": f"manage_bg_jobs: unknown action '{action}'. Use list, output, or kill.", "exit_code": 1}