fix(tasks): add_task_log wrote to a surface no agent could read back (#4241)

The work log reached the web UI through routes/task_logs.py and nothing
else. get_task returned only the body — a claim written once, before the
work — with the record written during it invisible beside it. So a stale
body arrived with nothing to contradict it, and this session rebuilt work
that had already shipped, with the evidence sitting in the task's own logs.

Read side, scoped through the access layer (rule 78):
  - logs_for_task / count_logs_for_task / log_counts_for_tasks in
    services/task_logs.py. Scoped by who may read the TASK rather than by
    who wrote the entry: list_logs filters TaskLog.user_id == user_id,
    which hands a shared collaborator an empty list reading as "no work
    has been done". The page query folds readable_notes_clause into the
    same statement so the permission does not become an N+1.
  - get_task returns work_log; list_tasks and get_milestone steps carry
    log_count, zero-filled so "none" is a count and not a missing key.

Elision keeps both ends. The newest entry arrives whole to 4000 chars
because it answers "where does this stand"; older ones are shortened from
the MIDDLE, never the head. A head cut selects what a reader sees by
character position, which is uncorrelated with what matters — an entry
closing with "so this shipped in 04775c3" loses the one sentence that
answers the question, and a truncated flag says something went, never
whether it mattered. The gap states how many characters it covers.

conftest gains an autouse stub for the new read arm, same reasoning as
_no_rule_arm: three widely-called tools grew a database read, and the
existing call sites should not each have to learn about it.

Raised while reviewing this: search() has the same shape and worse —
body[:240] with no marker at all, while the chunk that actually matched
sits unused in the row that won. Filed as #4243, not fixed here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/conftest.py

@@ -102,6 +102,32 @@ def _no_supersession():
         yield
 
 
+@pytest.fixture(autouse=True)
+def _no_task_log_arm():
+    """Stub the task-log read arm that get_task / list_tasks / get_milestone
+    grew in #4241.
+
+    Autouse for the reason _no_rule_arm is: those three tools now read work
+    logs, and the reads go through the access layer to Postgres. Every unit
+    test that opens a task — and most of them do, because a task is what this
+    codebase is mostly about — would otherwise try to reach the fake
+    DATABASE_URL this file sets, to learn that a fake task has no logs.
+
+    The arm's own behaviour is covered where it belongs: the payload shape and
+    the tool wiring in tests/test_task_work_log_surface.py, which re-patches
+    these explicitly, and the ACL scoping against real Postgres in
+    tests/test_integration_task_work_log.py. A test that wants the arm live
+    re-patches it, same as the rules arm.
+    """
+    with patch("scribe.services.task_logs.logs_for_task",
+               AsyncMock(return_value=[])), \
+         patch("scribe.services.task_logs.count_logs_for_task",
+               AsyncMock(return_value=0)), \
+         patch("scribe.services.task_logs.log_counts_for_tasks",
+               AsyncMock(return_value={})):
+        yield
+
+
 @pytest.fixture(autouse=True)
 def _no_rule_arm():
     """Stub the write-path hint's standing-RULES arm (milestone 307).