fix(6854): the locating arguments that only point are declared as references, and the plugin version is minted

The guard caught seven write-tool arguments with a locating name that are not
where the write lands:
- snippet_id on classify_shapes_by_rule and confirm_shape_proposals names the
  canon, not the rows written;
- rule_outcome, rule_misfired and judge_lesson_link record judgments.

REFERENCES lists each one with its reason, and the guard reads it.
READ_PREFIXES names the tool prefixes the fence answers without the server,
and a test holds every write tool to a name outside them.

plugin.json is minted to 2026.11.05.0242 for the PACKAGING.md row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/grimoire/services/write_scope.py

@@ -143,12 +143,43 @@ WRITE_TARGETS: dict[str, dict[str, str]] = {
 
 # Argument names that would locate a write wherever they appear. The guard test
 # requires every write tool parameter with one of these names to be declared
-# above, so a tool that gains one can't write past the fence unnoticed.
+# above, or listed in REFERENCES below, so a tool that gains one can't write
+# past the fence unnoticed.
 LOCATOR_NAMES = frozenset({
     "project_id", "task_id", "note_id", "lesson_id", "snippet_id", "process_id",
     "milestone_id", "system_id", "rule_id", "deleted_batch_id",
 })
 
+# Arguments with a locating name that only point at a record, with why each one
+# doesn't say where the write lands.
+REFERENCES: dict[str, dict[str, str]] = {
+    "classify_shapes_by_rule": {
+        "snippet_id": "the canon the shapes are judged against; the rows written are project_id's",
+    },
+    "confirm_shape_proposals": {
+        "snippet_id": "narrows which proposals to confirm; the rows written are project_id's",
+    },
+    "judge_lesson_link": {
+        "lesson_id": "a judgment on a lesson-to-rule pairing the system asked for",
+        "rule_id": "a judgment on a lesson-to-rule pairing the system asked for",
+    },
+    "rule_outcome": {
+        "rule_id": "telemetry on what a rule changed in this session's own work",
+    },
+    "rule_misfired": {
+        "rule_id": "telemetry on a moment that fired a rule in this session",
+        "project_id": "the project the misfire happened in, recorded with the report",
+    },
+}
+
+# Tool-name prefixes the plugin's fence answers without asking the server: every
+# tool named this way reads. tests/test_write_scope.py holds the hook's copy of
+# this list equal to it, and holds every write tool to a name outside it.
+READ_PREFIXES = (
+    "get_", "list_", "search", "find_", "enter_project", "what_might_apply",
+    "resolve_design_system",
+)
+
 # The one write a session may make in another project: filing an issue there,
 # as a new open task outside any plan of theirs.
 ISSUE_STATUSES = frozenset({"", "todo"})