feat(retrieval): the ledger records what was OPENED, not merely what was shown (#4100)

Milestone 386 made a repeat REFERENCED rather than withheld, and the line it
chose says "You saw it earlier this session". Nothing ever checked that. The
arms emit a TEASER — title, trigger, get_rule(N) — so a session can be shown a
rule twenty times and never read a word of it, and a compaction summarises the
teaser away leaving nothing behind. The server was asserting something about
the reader's context it had no way to know.

Three states now, where there were two:

  never surfaced   "it is not in this session's loaded set"
  named, unopened  "Mentioned earlier this session but not opened — read it…"
  opened           "You opened it earlier this session; pull it… again"

The middle one is the honest one and the one that was missing. It keeps the
full invitation, because a session that skipped a teaser is in nearly the
position of one never shown it.

HOW "OPENED" BECOMES OBSERVABLE. A new PostToolUse hook watches the get_rule
call itself and appends to `<sid>.opened.ids`. PostToolUse does fire for MCP
tools — the event's own output schema carries `updatedMCPToolOutput`, which
would be meaningless otherwise — and the matcher is `mcp__.*__get_rule` so the
server segment, which varies by install, is not pinned.

This is NOT the self-report 386 rejected. That objection was to ASKING a model
whether it holds a rule, which is unverifiable. A tool call is an event the
harness reports whether anyone asks. Recording what a session DID and believing
what it SAYS about itself are different kinds of evidence.

Both ledgers clear together on compact/clear. Keeping `.opened.ids` across a
compaction would have the arms telling a freshly-summarised session "you opened
it earlier" about a rule now nowhere in its context — a more confident version
of the bug being removed. Same reader (scribe_rules_live) for both, so ageing,
last-entry-wins and the bare-id format are defined once.

Also closes two smoke-coverage holes the checker was reporting as SKIP: the new
recorder, and scribe_precompact_preserve.sh from #3680. The latter needed
STATIC_FLOOR to become a set — PreCompact's contract is inverted, its stdout
BECOMES the summarizer's instructions, so silence is its failure mode and a
generic read of it looks like a leak.

Step 2 of milestone 416, and a hard prerequisite for step 4: while suppression
keys on shown, widening k marks records "seen" faster than they are read, and
the ledger would degrade in proportion to the improvement.

Plugin minted 2026.09.16.1232 -> 2026.09.16.2102.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_rule_usage_wiring.py

@@ -747,7 +747,13 @@ def test_the_hook_and_the_route_agree_on_every_parameter_name():
     # repo and `project_id=` where a `.scribe` marker names the project. Both
     # halves are one contract with the route, so both are pinned.
     assert "scribe_scope_query" in hook, "hook no longer asks for a project scope"
-    assert set(re.findall(r"printf '([a-z_]+)=", defs)) == {"repo", "project_id"}
+    # `held_rule_ids` joins them for the same reason (#4100): the OPENED ledger
+    # is read by a shared helper so its ageing and format cannot drift from the
+    # naming ledger's, which means the key is spelled in defs rather than here.
+    assert "scribe_held_query" in hook, "hook no longer sends the opened ledger"
+    assert set(re.findall(r"printf '([a-z_]+)=", defs)) == {
+        "repo", "project_id", "held_rule_ids",
+    }
 
     # Both scope keys are read by the shared _project_scope() helper, not inline.
     assert "_project_scope()" in handler
@@ -756,6 +762,11 @@ def test_the_hook_and_the_route_agree_on_every_parameter_name():
         assert f'request.args.get("{arg}"' in scope, (
             f"the hooks can send {arg!r} and the route never reads it"
         )
+    # Read by the handler itself, not the scope helper — it is about what the
+    # reader holds, not about which project the work belongs to.
+    assert 'request.args.get("held_rule_ids")' in handler, (
+        "the hook sends held_rule_ids and the route never reads it"
+    )
     for arg in ("tool", "command", "exclude_rule_ids"):
         assert f'request.args.get("{arg}")' in handler, (
             f"the hook sends {arg!r} and the route never reads it"