feat(retrieval): the ledger records what was OPENED, not merely what was shown (#4100)

Milestone 386 made a repeat REFERENCED rather than withheld, and the line it
chose says "You saw it earlier this session". Nothing ever checked that. The
arms emit a TEASER — title, trigger, get_rule(N) — so a session can be shown a
rule twenty times and never read a word of it, and a compaction summarises the
teaser away leaving nothing behind. The server was asserting something about
the reader's context it had no way to know.

Three states now, where there were two:

  never surfaced   "it is not in this session's loaded set"
  named, unopened  "Mentioned earlier this session but not opened — read it…"
  opened           "You opened it earlier this session; pull it… again"

The middle one is the honest one and the one that was missing. It keeps the
full invitation, because a session that skipped a teaser is in nearly the
position of one never shown it.

HOW "OPENED" BECOMES OBSERVABLE. A new PostToolUse hook watches the get_rule
call itself and appends to `<sid>.opened.ids`. PostToolUse does fire for MCP
tools — the event's own output schema carries `updatedMCPToolOutput`, which
would be meaningless otherwise — and the matcher is `mcp__.*__get_rule` so the
server segment, which varies by install, is not pinned.

This is NOT the self-report 386 rejected. That objection was to ASKING a model
whether it holds a rule, which is unverifiable. A tool call is an event the
harness reports whether anyone asks. Recording what a session DID and believing
what it SAYS about itself are different kinds of evidence.

Both ledgers clear together on compact/clear. Keeping `.opened.ids` across a
compaction would have the arms telling a freshly-summarised session "you opened
it earlier" about a rule now nowhere in its context — a more confident version
of the bug being removed. Same reader (scribe_rules_live) for both, so ageing,
last-entry-wins and the bare-id format are defined once.

Also closes two smoke-coverage holes the checker was reporting as SKIP: the new
recorder, and scribe_precompact_preserve.sh from #3680. The latter needed
STATIC_FLOOR to become a set — PreCompact's contract is inverted, its stdout
BECOMES the summarizer's instructions, so silence is its failure mode and a
generic read of it looks like a leak.

Step 2 of milestone 416, and a hard prerequisite for step 4: while suppression
keys on shown, widening k marks records "seen" faster than they are read, and
the ledger would degrade in proportion to the improvement.

Plugin minted 2026.09.16.1232 -> 2026.09.16.2102.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

scripts/check_plugin.py

@@ -345,13 +345,43 @@ SMOKE_EVENTS: dict[str, str] = {
         {"session_id": "smoke", "transcript_path": "/nonexistent/smoke.jsonl",
          "cwd": ".", "hook_event_name": "Stop", "stop_hook_active": False}
     ),
+    # The PreCompact preserver (#3680). Its whole contract is the inverse of
+    # every other hook's: it must exit 0 AND print, because stdout is what
+    # becomes the summarizer's custom instructions. A silent success here is
+    # the failure mode, and it would look like every other hook's success.
+    "scribe_precompact_preserve.sh": json.dumps(
+        {"session_id": "smoke", "cwd": ".", "hook_event_name": "PreCompact",
+         "trigger": "manual", "custom_instructions": None}
+    ),
+    # The opened-ledger recorder (#4100). It writes to TMPDIR and prints
+    # nothing — a PostToolUse hook that emitted output would put a line in
+    # front of every get_rule call, which is the opposite of its purpose. The
+    # smoke case is a well-formed open: it must exit 0 and stay silent.
+    "scribe_record_opened.sh": json.dumps(
+        {"session_id": "smoke", "cwd": ".",
+         "tool_name": "mcp__scribe__get_rule", "tool_input": {"rule_id": 1},
+         "tool_response": {}}
+    ),
     # The shared library is sourced, never run; executed bare it defines
     # functions and exits — silent by construction.
     "scribe_defs.sh": "",
 }
 
-# The one hook that legitimately produces output with no credentials.
-STATIC_FLOOR = "scribe_session_context.sh"
+# The hooks that legitimately produce output with NO credentials, each for its
+# own reason — named per hook rather than shared, because "this one is allowed
+# to speak" is exactly the kind of exemption that quietly grows to cover a hook
+# that is merely leaking.
+STATIC_EMITTERS = {
+    # The two-tier SessionStart design: the bundled static tier ships whatever
+    # the instance does, and that floor is the whole point of the split.
+    "scribe_session_context.sh": "static floor present",
+    # PreCompact's contract is INVERTED (#3680). Its stdout becomes the
+    # summarizer's custom instructions, and what must survive a summary is
+    # known without asking anything — so it needs no instance, and silence is
+    # the failure mode rather than the success one. Read as a generic hook it
+    # would look like a leak; it is the opposite.
+    "scribe_precompact_preserve.sh": "preservation instructions present",
+}
 # The hooks that say so when a configured instance does not answer (#2932).
 OUTAGE_SPEAKERS = {"scribe_prior_art.sh", "scribe_after_write.sh"}
 OUTAGE_LINE = "> Scribe did not answer the prior-art check"
@@ -398,14 +428,13 @@ def check_fail_open() -> None:
                      f"a recall aid may never fail the operator's action")
                 continue
             out = proc.stdout.strip()
-            if script.name == STATIC_FLOOR:
-                # Emits its bundled static tier regardless; that floor is the
-                # whole point of the two-tier design.
+            if script.name in STATIC_EMITTERS:
+                what = STATIC_EMITTERS[script.name]
                 if not out:
-                    fail(f"{rel} [{label}]: emitted nothing — the static "
-                         f"behavioural floor must survive having no credentials")
+                    fail(f"{rel} [{label}]: emitted nothing — this hook's "
+                         f"output must survive having no credentials ({what})")
                 else:
-                    ok(f"{rel} [{label}]: exit 0, static floor present")
+                    ok(f"{rel} [{label}]: exit 0, {what}")
             elif out and label == "unreachable" and script.name in OUTAGE_SPEAKERS:
                 # The only thing allowed here is the outage line itself.
                 try: