feat(moments): mounted rules arrive when their moment happens, through every door (milestone 458 step 4a, #4922)

A rule mounted on a moment now reaches the session when an act reaches
that moment, with no semantic match involved:

- run_moment_arm on the pipeline: a lookup, not a ranked search. Each
  line names the moment and the act that reached it ("at work.deliver,
  reached by `git push`"), so a misfire is visible where it lands and
  can be unmapped in-session. A repeat is cited, not quoted; fresh
  rules are recorded surfaced under source moment_rule with the moment
  in detail. No retrieval_logs row, as for the other lookups, so no
  latency is persisted for this arm.
- rule_scope: a rule's home clause, moved out of semantic_search_rules
  so the moment lookup scopes by the same one.
- rulebooks.rules_on_moments / mounted_moments.
- The plugin door: a catch-all PreToolUse hook (scribe_moment.sh). It
  keeps /moment-tools' answer on disk for five minutes, so a call to a
  tool that cannot reach a mounted rule sends nothing, and an install
  that has mounted nothing sends one request per window. It shares the
  rules ledger with the other arms and fails open silently.
- The MCP door: Scribe's own tools named by the shipped mappings carry
  moment_rules in their response, so a client without the plugin gets
  them too. The hook skips those tools. A guard pins the attach on
  every one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/routes/plugin.py

@@ -13,6 +13,7 @@ from quart import Blueprint, g, jsonify, request
 from scribe.auth import admin_required, get_current_user_id, login_required
 from scribe.config import Config
 from scribe.services import lesson_rules as lesson_rules_svc
+from scribe.services import moment_delivery as moment_delivery_svc
 from scribe.services import plugin_context as plugin_ctx_svc
 from scribe.services import repo_bindings as repo_bindings_svc
 from scribe.services import report_check as report_check_svc
@@ -241,6 +242,58 @@ async def pre_tool_rules():
     return jsonify(result)
 
 
+@plugin_bp.get("/moment-tools")
+@login_required
+async def moment_tools():
+    """The tools whose calls can deliver a mounted rule (milestone 458 step 4).
+
+    Read by the plugin's catch-all PreToolUse hook once per session window and
+    kept on disk, so a call that cannot reach a mounted rule costs no request.
+    `tools` are tool KEYS — bare, lowercased, no MCP server prefix — the same
+    keys the moment mappings are written in. Empty on an install that has
+    mounted nothing, which keeps that hook entirely off the wire.
+    """
+    return jsonify({"tools": await moment_delivery_svc.reachable_tools(g.user.id)})
+
+
+@plugin_bp.post("/moment")
+@login_required
+async def moment():
+    """The rules mounted on the moments this tool call reaches (milestone 458).
+
+    Body: the PreToolUse event as Claude Code delivers it — `tool_name` and
+    `tool_input` are read, nothing else. Sent whole because which input field
+    a mapping matches on is the mapping's business, not the hook's.
+
+    Query: `repo` / `project_id` for the scope, and the shared session ledger —
+    `exclude_rule_ids` (named this session: a repeat is cited, not quoted) and
+    `held_rule_ids` (opened) — exactly as /tool-rules takes them.
+
+    Returns `context` (the lines, each naming the moment and the action that
+    reached it, so a misfire is visible and can be unmapped in-session),
+    `rule_ids` (the FRESH ones, for the hook to append to the ledger) and
+    `moments` (the names reached). A lookup, not a ranked search: no
+    retrieval_logs row; each fresh rule is recorded surfaced with its moment.
+    """
+    event = await request.get_json(silent=True) or {}
+    tool = str(event.get("tool_name") or "").strip()
+    tool_input = event.get("tool_input")
+    if not tool:
+        return jsonify({"context": "", "rule_ids": [], "moments": []})
+    project_id, _repo, _unbound = await _project_scope()
+    reached, result = await moment_delivery_svc.deliver_for_act(
+        g.user.id, tool, tool_input if isinstance(tool_input, dict) else {},
+        project_id=project_id,
+        exclude=frozenset(_int_list(request.args.get("exclude_rule_ids"))),
+        held=frozenset(_int_list(request.args.get("held_rule_ids"))),
+    )
+    return jsonify({
+        "context": "\n".join(result.lines),
+        "rule_ids": result.rule_ids,
+        "moments": [hit["moment"] for hit in reached],
+    })
+
+
 @plugin_bp.get("/prior-art")
 @login_required
 @memoized_query_embeddings