fix(#4016): records that cite each other are created together, and a guessed id is refused

Sessions predicted the ids their next creates would get and wrote them into
plan bodies and reference notes before the records existed. The database
never collides; the sequence is shared by every session and user, so any
concurrent create took the guessed numbers and the references pointed at
someone else's records.

- create_records (new MCP tool) and start_planning(body=, steps=) create
  their records in ONE transaction: insert, flush for the real ids, rewrite
  {{ref:N}} / {{ref:milestone}} placeholders as #id "title", commit. No
  prediction, no waiting, no stub records left behind when a batch fails.
  Ids need not be consecutive and nothing depends on it.
- Every MCP create/update of a note, task or milestone refuses a #N sitting
  just above the highest assigned id (within 50): that can only be a guess.
  Refusal, not warning. Numbers far above the max (PRs, forge issues) pass.
- notes.build_note splits validation out of create_note so the batch
  validates records exactly as a single create does.
- writing-plans and using-scribe say to pass steps up front and never write
  an unassigned id; plugin version minted.

Integration test runs six concurrent batches and checks each resolves its
placeholders to its own records, and that a failing batch writes nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugin/skills/using-scribe/SKILL.md

@@ -161,6 +161,13 @@ Two constraints on *how* that's achieved:
    context than the operator has now: commit messages, task bodies, and any
    record that cites another.
 
+   **An id exists only once a create call returns it.** Never write the id you
+   expect a record to get — every session and user draws from one sequence,
+   so the number goes to whoever creates next, and Scribe refuses a body that
+   cites an id not yet assigned. Records that must cite each other are created
+   together — `create_records` or `start_planning(steps=...)` — with
+   `{{ref:N}}` where the Nth record's id belongs.
+
 9. **State updates in place; chronicles don't.** A dev-log records what
    *happened* — write it once, never rewrite it. A durable finding (how a
    subsystem works, a measured number) lives in that System's **reference

plugin/skills/writing-plans/SKILL.md

@@ -34,13 +34,26 @@ already done. It creates a **milestone** (the plan container) seeded with a
 design template and returns the milestone id plus the project's applicable
 rules. The plan lives in that milestone:
 
-- The **design/intent** goes in the milestone `body` — edit it with
+- The **design/intent** goes in the milestone `body` — pass it as
+  `start_planning(..., body=...)`, or edit it later with
   `update_milestone(milestone_id, body=...)`.
-- Each **step** is its own task under the milestone — create it with
-  `create_task(milestone_id=<that milestone>)` and track it with status +
-  `add_task_log`. Steps are first-class tasks, **not** checkboxes in the body.
+- Each **step** is its own task under the milestone. When you know the steps,
+  pass them in the same call — `start_planning(..., steps=[{title, body}, …])`
+  — and the milestone and every step are created together. Add steps later
+  with `create_records(milestone_id=<that milestone>, records=[…])`, or
+  `create_task` for one. Track each with status + `add_task_log`. Steps are
+  first-class tasks, **not** checkboxes in the body.
 - Read the whole plan back with `get_milestone` (body + its step-tasks).
 
+**Never write an id you have not been given.** A plan body that says "see
+#4012" before #4012 exists is a guess, and other sessions and users are
+creating records from the same sequence at the same time — the number goes to
+whoever creates next, and the plan then points at their record. Scribe refuses
+a body citing an id that has not been assigned. Where the plan and its steps
+need to cite each other, write a placeholder instead: `{{ref:N}}` is the Nth
+step in the list, `{{ref:milestone}}` is the milestone. They are replaced with
+the real id and title as the records are created.
+
 **Do not** write plans or specs to local `.md` files — the milestone is the
 record, not a file on disk. (The old `kind=plan` task is retired; `start_planning`
 no longer creates one.)