fix(plugin): the ledger that proves a rule was read was being deleted by the compaction that asked about it (#4217)

Milestone 419's acceptance, and it failed the first time it was run — which
is the only reason this commit exists.

THE MEASUREMENT. Ran the step-5 readout against this session's real traffic
instead of a fixture. It reported 19 rules named by an arm and none opened.
That is false: the session had called `get_rule` 45 times. Across six real
sessions on this instance: 208 opens, 3 surviving ledger entries. 1.4%.

THE CAUSE. `.opened.ids` was doing two jobs with opposite lifetimes.

  - "this context HOLDS rule 156" — false after a compaction, and three hooks
    read it to decide whether to stay quiet. Clearing it is correct.
  - "rule 156 WAS OPENED" — which no compaction makes untrue, and which the
    session-end readout is built on.

`scribe_clear_session_ledgers` sweeps every `<sid>*.ids` on SessionStart
source=compact. Right for the first claim, and it was deleting the second.
The TTL did the same thing more quietly: `scribe_rules_live` ages an
exclusion ledger, which is right, and would have eaten the early part of any
long session's evidence too.

So the readout was reporting only the stretch since the last compaction while
reading as though it had reported the session — a statistic that cannot vary
being mistaken for a finding (#3311), which is the shape this whole milestone
exists to stop producing. It ran AT the seam it was blind to.

THE SPLIT. `scribe_rules_append` now writes both: the exclusion ledger it
always wrote, and `<kind>.keep.ids`, an evidence twin that is never aged and
never swept. The readout reads twins; the three `held` readers are untouched.

DERIVED, NOT LISTED, because a list is what broke this before — the comment
above the sweep says so about its own history. Every ledger written through
the appender gets a twin, including the next one somebody adds; a new ledger
is born on the swept side unless its name opts out. `scribe_checkpoint_allowed`
writes its twin explicitly since it bypasses the appender, and there the split
lands right on both sides: the cap counts the swept file, so a compaction
honestly restores the budget to stop an act the context can no longer justify,
while the record that a stop happened stays.

Removed `scribe_ledger_ids`, orphaned by the change — a dead helper beside a
live one is a thing the next reader trusts.

test_session_ledger_clear.py asserted every ledger dies and could not have
caught this: its fixture never created a twin, so the sweep was one glob away
from either mistake with only one of them guarded. Both sides now asserted.
The slippage tests build their ledgers through the real writers rather than
by hand, for the same reason — a fixture that writes the bytes itself keeps
passing after the writer stops.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_session_slippage_readout.py

@@ -64,20 +64,26 @@ def sh(script: str) -> str:
 
 
 def ledgers(tmp_path, *, named=(), opened=(), acted=(), held=()) -> Path:
-    """The four ledgers, written the way the hooks write them."""
+    """The four ledgers, written THROUGH THE REAL WRITERS.
+
+    Not hand-rolled files: `scribe_rules_append` is what creates the evidence
+    twin these read from, so a fixture that wrote the bytes itself would keep
+    passing if the twin stopped being written — which is the whole defect
+    #4217 found.
+    """
     d = tmp_path / "scribe-priorart"
     d.mkdir(parents=True, exist_ok=True)
-    now = int(time.time())
+    script = []
     for name, ids in (("rules", named), ("opened", opened), ("acted", acted)):
         if ids:
-            (d / f"s.{name}.ids").write_text(
-                "".join(f"{i}\t{now}\n" for i in ids)
+            body = "".join(f"{i}\n" for i in ids)
+            script.append(
+                f"printf '%s' '{body}' | scribe_rules_append \"{d}/s.{name}.ids\""
             )
-    if held:
-        # The checkpoint ledger is bare ids — it records that something
-        # HAPPENED rather than what the context still holds, so it carries no
-        # stamp and never ages (#4214).
-        (d / "s.checkpoint.ids").write_text("".join(f"{i}\n" for i in held))
+    for i in held:
+        script.append(f'scribe_checkpoint_allowed "{d}/s.checkpoint.ids" {i} >/dev/null')
+    if script:
+        sh("\n".join(script))
     return d
 
 
@@ -253,3 +259,76 @@ def test_the_recorder_is_registered_on_the_rule_outcome_tool():
 def test_the_recorder_is_shell_valid():
     _need("bash")
     subprocess.run(["bash", "-n", str(RECORDER)], check=True)
+
+
+# ── Evidence outlives the compaction; exclusions do not (#4217) ────────────
+#
+# THE DEFECT THIS PINS, measured before it was fixed: across six sessions on
+# the instance this was built on, 208 `get_rule` calls produced 3 surviving
+# ledger entries. `.opened.ids` was doing two jobs with opposite lifetimes —
+# "this context holds the rule" (must be forgotten at a compaction, and three
+# hooks depend on that) and "this was opened" (which no compaction makes
+# untrue). The sweep, correct for the first, was deleting the second.
+
+def test_the_readout_is_unchanged_by_the_sweep(tmp_path):
+    """The readout runs AT the compaction. If the sweep took its inputs it
+    would report only the last stretch of a session and read as though it had
+    reported all of it."""
+    d = ledgers(tmp_path, named=[9, 34, 156], opened=[9, 156], acted=[156], held=[156])
+    before = readout(d)
+    sh(f'TMPDIR="{tmp_path}" scribe_clear_session_ledgers s')
+    assert readout(d) == before
+    assert "READ WITH NO OUTCOME RECORDED: 9" in readout(d)
+
+
+def test_the_sweep_still_clears_what_the_context_no_longer_holds(tmp_path):
+    """The other half, and it must keep working: after a compaction the agent
+    genuinely does not hold what it was shown, so an arm that stayed quiet on
+    the strength of the old ledger would be silent about a rule the context
+    has lost."""
+    d = ledgers(tmp_path, named=[9], opened=[9])
+    sh(f'TMPDIR="{tmp_path}" scribe_clear_session_ledgers s')
+    assert not (d / "s.rules.ids").exists()
+    assert not (d / "s.opened.ids").exists()
+    assert (d / "s.opened.keep.ids").exists()
+
+
+def test_the_evidence_twin_is_not_aged_out(tmp_path):
+    """An exclusion ledger ages by TTL, and should: a rule named two hours ago
+    is not in this context. A rule OPENED two hours ago was still opened."""
+    d = tmp_path / "scribe-priorart"
+    d.mkdir(parents=True, exist_ok=True)
+    stale = int(time.time()) - 99999
+    (d / "s.opened.keep.ids").write_text(f"9\t{stale}\n")
+    (d / "s.rules.keep.ids").write_text(f"9\t{stale}\n")
+    assert "read: 9" in readout(d)
+
+
+def test_every_ledger_written_through_the_appender_gets_a_twin(tmp_path):
+    """Derived in one place rather than listed at the call sites — a list is
+    what broke this before, and the next ledger somebody adds should be born
+    on the right side without anyone remembering to say so."""
+    d = tmp_path / "scribe-priorart"
+    d.mkdir(parents=True, exist_ok=True)
+    sh(f"""printf '7\n' | scribe_rules_append "{d}/s.brandnew.ids" """)
+    assert (d / "s.brandnew.keep.ids").read_text().startswith("7\t")
+    sh(f'TMPDIR="{tmp_path}" scribe_clear_session_ledgers s')
+    assert (d / "s.brandnew.keep.ids").exists()
+
+
+def test_a_checkpoint_budget_is_restored_by_a_compaction(tmp_path):
+    """The cap counts the SWEPT file on purpose. After a compaction this
+    context has not read the rule, so the budget to stop an act on it is
+    honestly fresh — while the record that a stop already happened stays."""
+    d = tmp_path / "scribe-priorart"
+    d.mkdir(parents=True, exist_ok=True)
+    f = d / "s.checkpoint.ids"
+    sh(f'scribe_checkpoint_allowed "{f}" 156 >/dev/null')
+    r = subprocess.run(
+        ["bash", "-c", f'. "{DEFS}"\nscribe_checkpoint_allowed "{f}" 156'],
+        capture_output=True, text=True, timeout=30,
+    )
+    assert r.returncode != 0, "a rule does not get to stop the same session twice"
+    sh(f'TMPDIR="{tmp_path}" scribe_clear_session_ledgers s')
+    sh(f'scribe_checkpoint_allowed "{f}" 156 >/dev/null')
+    assert (d / "s.checkpoint.keep.ids").read_text().count("156") == 2