feat(rules): rules retrieve against the operator's message (#3852)

The third rule arm, and the one the other two cannot reach. `write_path_rule`
is keyed on code, `pre_tool_rule` on a command — both things the session is
about to DO. A rule that governs what to SAY has no such trigger: extract
intent from loose phrasing, raise a conflict before acting, hand off an
action with its reason, end a finding with an offer all bind on a RESPONSE,
and no tool call precedes one.

The operator's message is the only query that exists before a response is
composed. That hook searched notes alone, so no rule had ever been retrieved
against a thing the operator actually said — and residency was the only
surface those rules had, which is what milestone 394 removes.

A SEPARATE FUNCTION, not a branch in build_autoinject_hint, because of its
early returns. That arm bails when auto-inject is disabled, when the query is
blank, when nothing clears the note bar — every one a statement about NOTES.
Folded in, an operator who turned the awareness menu off would silently lose
their rules, a coupling with no symptom since both look like a quiet hook.
Two functions, two sets of gates, composed in the route. Guarded as "the rule
arm never asks the notes arm's config", which is the structural fact.

Joins _ARMS rather than getting its own test file. #3497's history is that
the pre-tool arm inherited a defect from its sibling by being MODELLED on it
instead of sharing with it, and a third arm modelled on two is two chances to
repeat that. Repeat rendering, fresh-only counting, log-before-bailout, the
kind register and the two-recorders identity are properties of every arm or
of none.

The bar is INHERITED and says so. 0.72 was tuned against code and commands;
prose is a different query shape against the same documents, and triggers are
written in the vocabulary of the moment — which for most rules is act
vocabulary. Starting at the only number with evidence behind it and logging
every call from the first deploy is what makes it settleable; guessing lower
would put an unmeasured bar in front of a corpus that binds.

k=3, anchored on this hook's own budget rather than the act arms'.
RULEHINT_LIMIT is 1 because that arm fires before every Bash call; this one
fires once per turn, beside a notes menu already spending three slots. And a
prompt genuinely contains more than one act — "merge to main and then start
on X" is two — where a command is one thing.

`prompt_rule` added to RANKED_SOURCES: a ranker picked it, and a ranked
source missing from that tuple is silently counted as bulk delivery and drops
out of the pull-through denominator.

The hook reads and writes the SHARED rule ledger under scribe-priorart, not a
private one — one session keeps one list, aged (#3751), so a rule named here
is not re-announced before the next Bash call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011cPyzNnegXHr5iRMzzy5KJ

plugin/hooks/scribe_autoinject.sh

@@ -7,6 +7,18 @@
 # only — never bodies; the agent calls get_note(id) to pull anything it judges
 # relevant. Most turns inject nothing.
 #
+# TWO ARMS SINCE #3852, on one request. Rules and preferences are retrieved
+# against the same prompt and returned in the same payload, ahead of the notes
+# menu. That arm exists because the two act arms are keyed on a file write or
+# a command, so a rule governing what to SAY — extract intent from loose
+# phrasing, raise a conflict before acting, end a finding with an offer — had
+# no moment to fire at. The operator's message is the only query that exists
+# before a response is composed.
+#
+# The two arms are gated separately server-side: turning the notes menu off
+# leaves rules arriving, because they are different claims with different
+# costs of being missed.
+#
 # Best-effort enrichment ONLY: unlike the SessionStart channel there is no
 # static floor here. If the instance is unconfigured/unreachable, or anything
 # fails, the hook stays SILENT and exits 0 — it must never block a prompt.
@@ -65,16 +77,32 @@ fi
 # Per-session dedup: ids already injected this session are skipped.
 state_dir="${TMPDIR:-/tmp}/scribe-autoinject"
 mkdir -p "$state_dir" 2>/dev/null || true
+# RULES DEDUP IN A DIFFERENT DIRECTORY, and it has to be this one. The rule
+# ledger is SHARED by every arm that can name a rule — the two PreToolUse
+# hooks already keep it under scribe-priorart — so that one session keeps ONE
+# list and a rule named here is not re-announced before the next Bash call.
+# A private copy here would make each arm's "already seen" mean something
+# different, which is the state #3749/#3750 exist to keep coherent. The
+# directory name is the prior-art hook's history, not a scope claim.
+rule_state_dir="${TMPDIR:-/tmp}/scribe-priorart"
+mkdir -p "$rule_state_dir" 2>/dev/null || true
 idfile=""
+rulefile=""
 exclude_q=""
 if [ -n "$session_id" ]; then
   # session_id is an opaque token from Claude Code; keep only filename-safe chars.
   safe_sid=$(printf '%s' "$session_id" | tr -c 'A-Za-z0-9._-' '_')
   idfile="$state_dir/${safe_sid}.ids"
+  rulefile="$rule_state_dir/${safe_sid}.rules.ids"
   if [ -f "$idfile" ]; then
     seen=$(tr '\n' ',' < "$idfile" 2>/dev/null | sed 's/,$//')
     [ -n "$seen" ] && exclude_q="&exclude_ids=${seen}"
   fi
+  # AGED, not read flat: an exclusion that never expires means a rule surfaced
+  # once in a long session is silenced for the rest of it, even as the session
+  # stops holding what it was told. scribe_rules_live carries the reasoning.
+  rule_seen=$(scribe_rules_live "$rulefile")
+  [ -n "$rule_seen" ] && exclude_q="${exclude_q}&exclude_rule_ids=${rule_seen}"
 fi
 
 body=$(curl -fsS --max-time 5 \
@@ -89,6 +117,14 @@ context=$(printf '%s' "$body" | jq -r '.context // empty' 2>/dev/null) || exit 0
 if [ -n "$idfile" ]; then
   printf '%s' "$body" | jq -r '.note_ids[]? // empty' 2>/dev/null >> "$idfile" || true
 fi
+# Rules onto the SHARED ledger, stamped so they can age out. Only FRESH ids
+# come back in rule_ids (#3752) — a rule rendered as a repeat is already on
+# the ledger, and re-appending it would keep pushing its stamp forward so it
+# never aged at all.
+if [ -n "$rulefile" ]; then
+  printf '%s' "$body" | jq -r '.rule_ids[]? // empty' 2>/dev/null \
+    | scribe_rules_append "$rulefile"
+fi
 
 jq -n --arg c "$context" \
   '{hookSpecificOutput: {hookEventName: "UserPromptSubmit", additionalContext: $c}}'