feat(ledger): the ledger can say "these look wrong" without acting on it (#4208)

THE HALF THAT WAS MISSING. #4204 put a floor under what the write-path hook
may assert. A floor only guards new writes; every row already stored stands
(lesson #4202). Measured after that fix shipped: Portal carried 32 rows under
one canon and 3 under another, all stamped on scores of 0.69-0.77 — below the
0.80 floor, so none of them could be written today, and all of them were still
there. Scribe's own ledger carries 334 under #2860.

`stamps_to_review` reports two things and changes nothing:

  weak       — rows the hook stamped on a resemblance below the current floor,
               each with its score, signature and derived form.
  incoherent — canons whose own judged rows do not agree on a form. A canon
               claims some shapes are the same sort of thing; when its members
               are a class, three getters and a dozen tests, that claim has
               stopped being true and every base-rate reading built on it is
               reading noise. `canon_form` already made such a canon fall
               silent — nothing made it VISIBLE.

IT DELIBERATELY CANNOT FIX ANYTHING, and that is the design, not an omission.
The first version of this commit was an automatic sweep that reset rows by
score. That is the original defect pointed the other way: what harmed the
ledger was not one wrong score, it was a machine recording permanent
classifications unattended. Un-recording them unattended is the same act with
a wider blast radius. An agent reads the evidence, judges, and records the
judgment under its own name through `classify_shapes`.

`test_the_service_carries_no_machinery_for_bulk_withdrawal` asserts that
structurally, so the next person to reach for an auto-retire has the argument
again on purpose rather than in a diff nobody reads.

A JUDGMENT IS NEVER LISTED AS WEAK, whatever its age. This is the measured
correction to an assumption I nearly shipped: of Scribe's 334 rows under
#2860, 302 are in `services/` — the canon's own home — and the ones sampled
there are `classified_by="audit"` with no score at all. The legitimate bulk
of that canon was never scored; it was judged by an agent in batch. Listing
those as weak would invite an agent to withdraw the only real judgments in the
ledger. An agent's decision is a different KIND of evidence, not a worse one.

THE SCORE NOW HAS A PARSER. It lived only inside a prose sentence, so nothing
could ask how strong the evidence for a row was without re-deriving it — which
is how 32 rows sat unexamined for nineteen days. Format and reader are one
constant apart (`_RESEMBLE_REASON` / `stamp_score`), with a round-trip test and
a test pinned to reason strings taken verbatim from the two poisoned ledgers.

`live_rows_for` is `live_rows` behind the project read gate, for callers that
arrive from outside rather than from a job that already knows who is asking.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

src/scribe/mcp/tools/shapes.py

@@ -247,6 +247,42 @@ async def shape_history(
     )
 
 
+async def stamps_to_review(project_id: int, top: int = 10) -> dict:
+    """Judged rows whose evidence no longer meets the ledger's bar, and canons
+    whose own rows no longer agree what they are. **Read-only — you decide.**
+
+    This tool deliberately cannot fix anything. Every row it lists was written
+    unattended by the write-path hook on a similarity score, and what made
+    that harmful was not one bad score but a machine recording a permanent
+    classification with nobody reading it. Un-asserting them automatically
+    would be the same mistake with a wider blast radius. So: read the
+    evidence, judge, and record the judgment yourself with `classify_shapes`
+    — under your own name, with a reason.
+
+    `weak` — rows the hook stamped on a resemblance below the current floor
+    (`floor` in the response). The floor arrived after they did, and a guard
+    at the point of classification never undoes what is already stored. Rows
+    an agent or an audit judged are NOT listed at any age: a judgment is not
+    weak evidence, it is a different kind of evidence. Each row carries its
+    score, signature and derived form so you can judge rather than trust the
+    threshold.
+
+    `incoherent` — canons whose judged rows do not agree on a form: the
+    `forms` histogram, how many members were hook-stamped weakly, and a
+    sample. A canon asserts that some shapes are the same sort of thing; when
+    its members are a class, three getters and a dozen tests, that assertion
+    has stopped being true and every base-rate reading built on it — the
+    divergence prompt included — is reading noise.
+
+    A row listed here is a question, not a verdict. Some will be correct.
+
+    Read-only; requires read access to the project.
+    """
+    uid = current_user_id()
+    rows = await shape_ledger_svc.live_rows_for(uid, project_id)
+    return shape_ledger_svc.stamps_to_review(rows, top=top)
+
+
 async def confirm_shape_proposals(
     project_id: int,
     snippet_id: int = 0,
@@ -326,5 +362,6 @@ def register(mcp) -> None:
     for fn in (
         classify_shapes, classify_shapes_by_rule, list_shapes,
         refresh_pattern_coverage, confirm_shape_proposals, shape_history,
+        stamps_to_review,
     ):
         mcp.tool(name=fn.__name__)(fn)