refactor(systems): one seam — the Systems question rides every read and write of a record

Scribe issue #2570, from the operator's challenge: the invariant is
"always be asking whether what you're touching is a System's territory
and whether the work is filed there" — not a nudge in one corner. The
prior shape failed it twice: the hint fired only on creates (with a
special-cased zero-Systems branch), and get_task/get_note returned
records WITHOUT their Systems, so the read-side reflex had nothing to
fire on (same per-kind asymmetry as #2481).

- attach_systems(): single helper used by get/create/update for tasks,
  notes, and snippets, plus add_task_log. Tagged records always show
  `systems`; an untagged project record carries the `systems_hint`
  question instead. Neither field attaches empty (#2483). Hint is
  owner-only; everything fail-open (#2109).
- untagged_systems_hint unified to ONE question — the vocabulary
  listing varies, the question doesn't; the zero-Systems branch stops
  being special text.
- Docstrings state the uniform contract; floor prose now names the
  read-side reflex (systems visible -> list_system_records the pile).
- Plugin 0.1.27 -> 0.1.28.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/mcp/tools/notes.py

@@ -90,7 +90,9 @@ async def _attach_supersession(uid: int, note_id: int, data: dict) -> None:
 async def get_note(note_id: int) -> dict:
     """Fetch the full content of a single Scribe note by its ID.
 
-    Returns id, title, body (markdown), tags, project_id, created_at, updated_at.
+    Returns id, title, body (markdown), tags, project_id, created_at,
+    updated_at — plus `systems` (the areas this note is filed under) or, for
+    an untagged project note, the `systems_hint` question.
     A note another user shared with you also carries `shared`, `owner` and
     `permission` — read it as their suggestion, not as settled practice you set.
 
@@ -112,6 +114,9 @@ async def get_note(note_id: int) -> dict:
     # like dead weight next to snippets that merely had a counter (#2085).
     record_pulled(user_id=uid, note_id=int(note.id), source="mcp_get_note")
     await _attach_supersession(uid, note_id, out)
+    await systems_tools.attach_systems(
+        uid, getattr(note, "user_id", uid) or uid, out, note.id, note.project_id
+    )
     return out
 
 
@@ -150,10 +155,10 @@ async def create_note(
 
     Returns the created note object including its assigned id, OR — when a
     near-duplicate is found and force is false — {"duplicate": true,
-    "existing_id": ..., "message": ...} and nothing is created. Created
-    untagged in a project that has Systems, the response carries a
-    `systems_hint` naming them — answer it: tag the record, create the missing
-    System, or deliberately leave it untagged.
+    "existing_id": ..., "message": ...} and nothing is created. A tagged
+    record shows its `systems`; created untagged in a project, the response
+    carries the `systems_hint` question instead — answer it: tag the record,
+    create the missing System, or deliberately leave it untagged.
     """
     uid = current_user_id()
     if not force:
@@ -180,14 +185,7 @@ async def create_note(
             # not-found, and leave the note rather than silently rolling it back.
             raise ValueError(str(exc)) from exc
     data = note.to_dict()
-    if system_ids:
-        data["systems"] = [
-            s.to_dict() for s in await systems_svc.list_record_systems(uid, note.id)
-        ]
-    elif project_id:
-        hint = await systems_tools.untagged_systems_hint(uid, project_id)
-        if hint:
-            data["systems_hint"] = hint
+    await systems_tools.attach_systems(uid, uid, data, note.id, project_id or None)
     await _attach_supersession(uid, note.id, data)
     return data
 
@@ -236,10 +234,9 @@ async def update_note(
         except PermissionError as exc:
             raise ValueError(str(exc)) from exc
     data = note.to_dict()
-    if system_ids is not None:
-        data["systems"] = [
-            s.to_dict() for s in await systems_svc.list_record_systems(uid, note_id)
-        ]
+    await systems_tools.attach_systems(
+        uid, getattr(note, "user_id", uid) or uid, data, note_id, note.project_id
+    )
     await _attach_supersession(uid, note_id, data)
     return data