fix(plugin): the ledger that proves a rule was read was being deleted by the compaction that asked about it (#4217)

Milestone 419's acceptance, and it failed the first time it was run — which
is the only reason this commit exists.

THE MEASUREMENT. Ran the step-5 readout against this session's real traffic
instead of a fixture. It reported 19 rules named by an arm and none opened.
That is false: the session had called `get_rule` 45 times. Across six real
sessions on this instance: 208 opens, 3 surviving ledger entries. 1.4%.

THE CAUSE. `.opened.ids` was doing two jobs with opposite lifetimes.

  - "this context HOLDS rule 156" — false after a compaction, and three hooks
    read it to decide whether to stay quiet. Clearing it is correct.
  - "rule 156 WAS OPENED" — which no compaction makes untrue, and which the
    session-end readout is built on.

`scribe_clear_session_ledgers` sweeps every `<sid>*.ids` on SessionStart
source=compact. Right for the first claim, and it was deleting the second.
The TTL did the same thing more quietly: `scribe_rules_live` ages an
exclusion ledger, which is right, and would have eaten the early part of any
long session's evidence too.

So the readout was reporting only the stretch since the last compaction while
reading as though it had reported the session — a statistic that cannot vary
being mistaken for a finding (#3311), which is the shape this whole milestone
exists to stop producing. It ran AT the seam it was blind to.

THE SPLIT. `scribe_rules_append` now writes both: the exclusion ledger it
always wrote, and `<kind>.keep.ids`, an evidence twin that is never aged and
never swept. The readout reads twins; the three `held` readers are untouched.

DERIVED, NOT LISTED, because a list is what broke this before — the comment
above the sweep says so about its own history. Every ledger written through
the appender gets a twin, including the next one somebody adds; a new ledger
is born on the swept side unless its name opts out. `scribe_checkpoint_allowed`
writes its twin explicitly since it bypasses the appender, and there the split
lands right on both sides: the cap counts the swept file, so a compaction
honestly restores the budget to stop an act the context can no longer justify,
while the record that a stop happened stays.

Removed `scribe_ledger_ids`, orphaned by the change — a dead helper beside a
live one is a thing the next reader trusts.

test_session_ledger_clear.py asserted every ledger dies and could not have
caught this: its fixture never created a twin, so the sweep was one glob away
from either mistake with only one of them guarded. Both sides now asserted.
The slippage tests build their ledgers through the real writers rather than
by hand, for the same reason — a fixture that writes the bytes itself keeps
passing after the writer stops.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_session_ledger_clear.py

@@ -75,8 +75,12 @@ def _swept_dirs() -> set[str]:
     return set(line.group(1).split())
 
 
-def _run_session_start(source: str, tmp: Path) -> Path:
-    """Run the SessionStart hook for real, with the ledger directories filled."""
+def _run_session_start(source: str, tmp: Path, extra: list[str] | None = None) -> Path:
+    """Run the SessionStart hook for real, with the ledger directories filled.
+
+    `extra` names further files to plant in `scribe-priorart` — used to put
+    an evidence twin in front of the sweep.
+    """
     for tool in ("bash",):
         if shutil.which(tool) is None:
             pytest.skip(f"hook runtime tool {tool!r} not installed")
@@ -88,6 +92,8 @@ def _run_session_start(source: str, tmp: Path) -> Path:
             (state / f"s1{suffix}").write_text("42\t1789600000\n")
     # Not a ledger: an outage marker that must outlive the clear.
     (tmp / "scribe-priorart" / "s1.unreached").write_text("1\n")
+    for name in extra or ():
+        (tmp / "scribe-priorart" / name).write_text("42\t1789600000\n")
 
     env = {"PATH": os.environ["PATH"], "HOME": str(tmp), "TMPDIR": str(tmp)}
     out = subprocess.run(
@@ -226,3 +232,28 @@ def test_the_clear_is_derived_and_not_a_list_of_names():
         assert suffix not in block, (
             f"the clear names {suffix} again — a list, not a convention"
         )
+
+
+def test_the_evidence_twin_is_not_swept_with_them(tmp_path):
+    """The second thing that survives, and for the `.unreached` reason (#4217).
+
+    `scribe_rules_append` writes each ledger twice: `<sid>.<kind>.ids`, which
+    says what this context HOLDS and must be forgotten here, and
+    `<sid>.<kind>.keep.ids`, which says what HAPPENED and no compaction makes
+    untrue. The session-end readout is built on the second, and it runs AT the
+    compaction — so a sweep that took both would leave the readout reporting
+    only the stretch since the last one, while reading as though it had
+    reported the session.
+
+    Measured before the split, on the instance this was built on: six sessions,
+    208 `get_rule` calls, 3 surviving ledger entries.
+
+    The test above asserts every exclusion ledger dies; this asserts its twin
+    does not. Neither is complete alone, and the sweep is one glob away from
+    either mistake.
+    """
+    root = _run_session_start("compact", tmp_path, extra=["s1.rules.keep.ids"])
+    assert (root / "scribe-priorart" / "s1.rules.keep.ids").exists(), (
+        "the evidence twin was swept with the exclusion ledgers — the readout "
+        "at this seam now reports a session it cannot see"
+    )