feat(rules)!: retire the always-on tier — every rule arrives by retrieval (#394)

Milestone 394, steps 5-8. Operator: "remove the always on rule functionality
as the goal was to not have it at all since it didn't seem to work as
expected."

Unconditional preload had three failures the retrieval arms do not. It could
not be MEASURED — a resident rule is in the context whether or not it
mattered, so nothing distinguished "this governed the act" from "this was
scenery", and it was the one surface structurally exempt from the scoreboard
judging every other. It was SUMMARISED AWAY by compaction while the session
went on believing it held the rules. And it CROWDED OUT the few rules that
applied with the thirty that did not.

WHAT GOES

Schema (0100): rules.tier + ck_rules_tier, rule_versions.tier,
rulebooks.always_on, and project_rulebook_exclusions — a table recording a
project's opt-out of something that no longer binds it unasked.

Tools: list_always_on_rules, exclude_always_on_rulebook,
include_always_on_rulebook. Service: the same three plus rules_etag_for,
_valid_tier and the whole etag family. The SessionStart preload and the
write-path staleness arm go with them: nothing is resident, so nothing can
have drifted since a session loaded it.

THREE CALLS WORTH REVIEWING

enter_project got NARROWER, not wider. Its filter was `always_on OR
area-tagged`; dropping the tier arm leaves the deterministic half, so a
project with no canonical-tagged Systems gets no bulk rules and reaches them
by retrieval instead. Dropping the whole clause would have made that payload
bigger than the preload this milestone deletes.

Backups import tolerantly. A pre-394 archive carries tier, always_on and the
retired inception choice; none is read, and the exclusion key is DROPPED
rather than remapped, because restoring it would write data that
validate_inception now rejects as unknown.

The migration is irreversible in the way that matters and says so: downgrade
recreates the columns at their defaults and cannot restore which rules were
always-on. A value invented to fill a hole is not a measurement.

THE INSTRUCTION SURFACES SAY THE HARDER THING

Deleting "call list_always_on_rules()" is easy; replacing it is not, because
the new model asks a session to trust something it cannot see. All three
surfaces now say a session holds nothing, that rules arrive when work matches
them, and — the half that got dangerous — that "no rule arrived" means
"nothing matched", never "there is no rule". Under residency an empty session
was rare and suspicious; it is now the ordinary state of most turns, so
reading it as permission is wrong on nearly every turn rather than
occasionally. That is #3720's defect at session scale.

test_instruction_surfaces_agree is repointed rather than retired: its two
halves collapsed into one instruction, and it gains a guard that every
surface states what absence means. _INSTRUCTIONS is back at 1999/2000 —
the inception clause paid for the longer HOW line.

UI (rule 27, and the opportunity step 8 named)

The tier selector is gone, and what replaces it is the point: `when_to_apply`
is now the field that decides whether a rule is ever seen, so the editor
marks it required, warns while it is empty, and both rule lists badge a
trigger-less rule "never surfaces". A rule without one is not quiet, it is
unreachable.

TESTS

Two files deleted outright — test_rules_etag.py and test_inception_rules.py
tested subsystems that no longer exist. Elsewhere obsolete cases were removed
and the rest repointed. One deserves naming: the wiring test asserted the act
arms pass no `tier`, which had become an assertion that could not fail. It is
repointed onto `kind`, which does still exist and where the same claim is
live — a preference must reach a write exactly as a rule does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011cPyzNnegXHr5iRMzzy5KJ

src/scribe/models/rulebook.py

@@ -256,18 +256,11 @@ project_rule_suppressions = Table(
     Column("created_at", DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)),
 )
 
-# A project's opt-out of a whole ALWAYS-ON rulebook (milestone 297): the
-# sibling of the two suppression tables below, one level up. Always-on
-# rulebooks bind every project implicitly; an inception decision can exclude
-# specific ones for this project, and get_applicable_rules /
-# get_applicable_rules(project_id) skips them. FKs CASCADE like the others.
-project_rulebook_exclusions = Table(
-    "project_rulebook_exclusions",
-    Base.metadata,
-    Column("project_id", BigInteger, ForeignKey("projects.id", ondelete="CASCADE"), primary_key=True),
-    Column("rulebook_id", BigInteger, ForeignKey("rulebooks.id", ondelete="CASCADE"), primary_key=True),
-    Column("created_at", DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)),
-)
+# `project_rulebook_exclusions` lived here until milestone 394. It recorded a
+# project's opt-out of a whole always-on rulebook — which only made sense
+# while a rulebook could bind a project WITHOUT being asked. Subscription is
+# now the only reach a rulebook has, so declining one is expressed by not
+# subscribing, and there is nothing left to opt out of.
 
 project_topic_suppressions = Table(
     "project_topic_suppressions",

src/scribe/services/backup.py

@@ -23,7 +23,6 @@ from scribe.models.rulebook import (
     Rulebook,
     RulebookTopic,
     project_rule_suppressions,
-    project_rulebook_exclusions,
     project_rulebook_subscriptions,
     project_topic_suppressions,
 )
@@ -82,7 +81,7 @@ _BACKED_UP = [
     "users", "projects", "milestones", "notes", "task_logs", "note_drafts",
     "note_versions", "settings", "rulebooks", "rulebook_topics", "rules",
     "project_rulebook_subscriptions", "project_rule_suppressions",
-    "project_topic_suppressions", "project_rulebook_exclusions",
+    "project_topic_suppressions",
     # v5 (2026-08): the five-year gap this list was written to stop.
     "systems", "record_systems", "design_systems", "design_tokens",
     "note_usage_events", "repo_bindings", "note_supersessions",
@@ -247,8 +246,6 @@ def _topic_suppression_rows(rows) -> list[dict]:
     return [{"project_id": r.project_id, "topic_id": r.topic_id} for r in rows]
 
 
-def _rulebook_exclusion_rows(rows) -> list[dict]:
-    return [{"project_id": r.project_id, "rulebook_id": r.rulebook_id} for r in rows]
 
 
 # The v5 sections. Pure row-builders like the join-table helpers above, for the
@@ -652,9 +649,6 @@ async def export_full_backup() -> dict:
         topic_suppressions = (await session.execute(
             select(project_topic_suppressions)
         )).all()
-        rulebook_exclusions = (await session.execute(
-            select(project_rulebook_exclusions)
-        )).all()
 
     return {
         "version": BACKUP_VERSION,
@@ -680,7 +674,6 @@ async def export_full_backup() -> dict:
         "rulebook_subscriptions": _subscription_rows(subscriptions),
         "rule_suppressions": _rule_suppression_rows(rule_suppressions),
         "topic_suppressions": _topic_suppression_rows(topic_suppressions),
-        "rulebook_exclusions": _rulebook_exclusion_rows(rulebook_exclusions),
         "canonical_systems": _canonical_system_rows(canonical_systems),
         "rule_systems": _rule_system_rows(rule_system_rows),
         "rule_relations": _rule_relation_rows(rule_relations),
@@ -848,13 +841,8 @@ async def export_user_backup(user_id: int) -> dict:
                     project_topic_suppressions.c.project_id.in_(project_ids)
                 )
             )).all()
-            rulebook_exclusions = (await session.execute(
-                select(project_rulebook_exclusions).where(
-                    project_rulebook_exclusions.c.project_id.in_(project_ids)
-                )
-            )).all()
         else:
-            subscriptions = rule_suppressions = topic_suppressions = rulebook_exclusions = []
+            subscriptions = rule_suppressions = topic_suppressions = []
 
     return {
         "version": BACKUP_VERSION,
@@ -882,7 +870,6 @@ async def export_user_backup(user_id: int) -> dict:
         "rulebook_subscriptions": _subscription_rows(subscriptions),
         "rule_suppressions": _rule_suppression_rows(rule_suppressions),
         "topic_suppressions": _topic_suppression_rows(topic_suppressions),
-        "rulebook_exclusions": _rulebook_exclusion_rows(rulebook_exclusions),
         "canonical_systems": _canonical_system_rows(canonical_systems),
         "rule_systems": _rule_system_rows(rule_system_rows),
         "rule_relations": _rule_relation_rows(rule_relations),
@@ -1028,7 +1015,7 @@ async def _restore_v2(data: dict) -> dict:
         "task_logs": 0, "note_drafts": 0, "note_versions": 0,
         "settings": 0, "rulebooks": 0, "rulebook_topics": 0, "rules": 0,
         "rulebook_subscriptions": 0, "rule_suppressions": 0,
-        "topic_suppressions": 0, "rulebook_exclusions": 0,
+        "topic_suppressions": 0,
         "systems": 0, "record_systems": 0, "design_systems": 0,
         "design_tokens": 0, "note_usage_events": 0, "rule_usage_events": 0,
         "repo_bindings": 0,
@@ -1347,15 +1334,11 @@ async def _restore_v2(data: dict) -> dict:
             stats["topic_suppressions"] += 1
 
         # 14b. Always-on rulebook exclusions (v10, milestone 297)
-        for exc in data.get("rulebook_exclusions", []):
-            mapped_pid = project_id_map.get(exc.get("project_id", 0))
-            mapped_rbid = rulebook_id_map.get(exc.get("rulebook_id", 0))
-            if mapped_pid is None or mapped_rbid is None:
-                continue
-            await session.execute(project_rulebook_exclusions.insert().values(
-                project_id=mapped_pid, rulebook_id=mapped_rbid,
-            ))
-            stats["rulebook_exclusions"] += 1
+        # `rulebook_exclusions` was a v10 section and is READ BY NOBODY since
+        # milestone 394 removed the table. An archive carrying it still
+        # imports — the key is simply not looked at — because refusing a
+        # backup for remembering something we deleted would make every v10-v13
+        # archive unrestorable.
 
         # --- v5 sections. Every one is data.get()-guarded, so a v2/v3/v4
         # payload restores without them rather than failing on an absent key.
@@ -1680,10 +1663,12 @@ async def _restore_v2(data: dict) -> dict:
             inception = p_data.get("inception")
             if isinstance(inception, dict):
                 choices = dict(inception.get("choices") or {})
-                choices["exclude_always_on_rulebooks"] = [
-                    rulebook_id_map[i] for i in choices.get("exclude_always_on_rulebooks") or []
-                    if i in rulebook_id_map
-                ]
+                # DROPPED, not remapped (milestone 394). A pre-394 archive
+                # carries the retired exclusion choice; restoring it would put
+                # a key back that `validate_inception` now rejects as unknown,
+                # so the next edit to that project would fail on data this
+                # importer wrote.
+                choices.pop("exclude_always_on_rulebooks", None)
                 choices["subscribe_rulebooks"] = [
                     rulebook_id_map[i] for i in choices.get("subscribe_rulebooks") or []
                     if i in rulebook_id_map

src/scribe/services/plugin_context.py

@@ -2142,18 +2142,6 @@ def _stamp_line(path: str, stamped: list[dict]) -> str:
     )
 
 
-async def _topic_titles(topic_ids: set[int]) -> dict[int, str]:
-    """Map topic_id -> title for the given ids (live topics only)."""
-    if not topic_ids:
-        return {}
-    async with async_session() as session:
-        rows = await session.execute(
-            select(RulebookTopic.id, RulebookTopic.title).where(
-                RulebookTopic.id.in_(topic_ids),
-                RulebookTopic.deleted_at.is_(None),
-            )
-        )
-        return {tid: title for tid, title in rows.all()}
 
 
 async def build_session_context(