feat(guidance): the agent is the judge — stated in the product, not in a rule

I recorded this as project rule 174 first. That was wrong twice over, and the
second reason is the one that matters.

RULE 119 SAYS THIS EXACTLY: guidance about how an agent should behave with
Scribe belongs in `_INSTRUCTIONS`, `plugin/skills/*` or the adapter's static
context, never in the corpus. I read 119 while writing the rule, decided it was
"about authority rather than about using Scribe", and wrote it anyway — which
is the reasoning preference 29 exists to catch, performed in full.

THE REASON THAT MATTERS: a rule in the corpus is true on ONE install. If the
agent being the judge is how Scribe works, every install gets it or none does.
Baked in, it ships. As a rule it was one operator's private note about a
product stance.

WHAT IT SAYS. The agent is the judge of record for the work — what a shape is,
whether a finding holds, whether something is done. Surfacing a finding for the
operator to rule on is the judgment NOT made, however well written up: it reads
as diligence and functions as a backlog. Escalate the acts that are genuinely
theirs — their money, their infrastructure, anything hard to reverse or facing
outward — and keep the decisions. A hard call is still yours; an irreversible
act is still theirs.

And the half that keeps this from becoming the previous defect: JUDGING IS
ATTENDED. An agent reading evidence and recording why is judgment; a threshold
or a sweep reclassifying in bulk with nobody reading is the thing that fills a
ledger with confident nonsense (#4208, and Portal's 35 rows). When the fix for
bad unattended writes is another unattended write, stop.

THE PRODUCT WAS TEACHING THE OPPOSITE. reporting-back's Finding row read
"Symptom · Cause · Size of the fix · **Offer to fix it**". So the behaviour I
was corrected for is the behaviour the skill prescribed — which is the better
argument for fixing it here than any rule could be.

Three surfaces, per 119 and the ownership registry (#4027): `_INSTRUCTIONS`
gets a one-line JUDGE index entry; using-scribe owns the authority and the
attended/unattended distinction; reporting-back owns the report shape. Two
topics rather than one, registered separately in test_guidance_ownership so
trimming one cannot quietly take the other.

Plugin version minted — skills only reach a session when the manifest moves
(#2209).

Rule 174 deleted (trash 074434a2, recoverable).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

plugin/skills/using-scribe/SKILL.md

@@ -376,6 +376,35 @@ to the situation it applies to so a later session meets it there. Both are
 first-class outcomes of noticing something, not what's left when a rule
 proposal fails.
 
+## You are the judge of what the record says
+
+Scribe's shape exists to support how you work, so you are the judge of record
+for the work itself: what a shape is, which canon a thing belongs to, whether
+a finding holds, whether something is done. `classify_shapes`, `update_task`,
+`create_snippet` and the rest are where your judgment lands — under your own
+name, with the reasoning recorded beside it.
+
+**Judging is attended, and that is the whole distinction.** You judge by
+reading the evidence and writing down why. A threshold, a sweep or a hook that
+classifies in bulk with nobody reading it is not judgment; it is the thing
+that fills a ledger with confident nonsense. The write-path hook may offer
+evidence (`classified_by="hook"`) and any judgment of yours overrides it —
+that asymmetry is deliberate. When you are about to correct a pile of bad
+unattended writes with one more unattended write, stop and read them instead.
+
+**A finding you surface and do not judge is a finding dropped.** Handing a
+classification, a verdict or a done/not-done call to the operator "to decide"
+is the judgment not being made, however carefully it is written up. Keep
+escalating the acts that are genuinely theirs — their money, their
+infrastructure, anything hard to reverse or facing outward — and keep the
+decisions. A hard call is still yours; an irreversible act is still theirs.
+
+**A record that is wrong stays wrong until something rewrites it.** A guard
+added at the point of classification does not undo classifications already
+stored, so when you fix how judgments are made, go and look at the ones
+already there. That look is yours to do, and its result is a judgment you
+record, not a queue you leave behind.
+
 ## When a record doesn't reach the moment it should
 
 Retrieval misjudging is ordinary, and it is fixable — but only by whoever