feat(moments): the reply moment holds a finished reply for one read (milestone 458 step 4b, #4922)

The reply is the one act no tool call marks, and it is where "let me
know if it works" gets said. A new Stop hook (scribe_reply_check.sh)
sends the finished reply to POST /api/plugin/reply-rules, which checks
it twice:

- mounted: every unopened RULE on reply.report, plus reply.ask when the
  reply asks a question. Deterministic.
- semantic: the reply's head and tail against every rule's trigger, on a
  new ranked surface, reply_rule. It is the backstop for whatever the
  earlier arms missed. Its floor is its stop bar (default 0.80, budget
  1), with its own Settings dials. The new stop_only stage records
  surfacing for the rule that holds and nothing else, because nothing
  else reached anyone.

Following the operator's ruling from 456 step 8, a rule that holds blocks
once, in the server's words. The hook blocks only on a reason it was
given, so an unreachable instance never stops a session, and it never
holds the rewrite. The ledger is the act checkpoint's own, so a rule
holds a session once across both doors and the per-session cap counts
both.

The turn reader moved from the report check into scribe_defs.sh
(scribe_turn_facts / scribe_turn_fact), so the two Stop hooks read a
turn the same way. The output was checked identical on a real transcript.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugin/hooks/scribe_report_check.sh

@@ -78,56 +78,9 @@ grep -q -E '"name":[[:space:]]*"([^"]*__)?(update|create)_task"' < <(tail -c 200
   exit 0
 }
 
-# The turn, parsed once. A window of recent lines, flattened record by record
-# and then read by scribe_turn.awk, which carries the turn-bounding rules. A
-# line that does not parse is dropped and the rest are still read — the first
-# line of a `tail -n 3000` window is routinely half a record. If the window
-# holds no prompt, the turn cannot be bounded, so the hook reports nothing and
-# stays out of the way.
-window() { tail -n 3000 "$transcript" 2>/dev/null; }
-turn_facts() { window | tail -n +"${1:-1}" | scribe_json_flat_lines \
-  | awk -f "$SCRIBE_HOOK_DIR/scribe_turn.awk" 2>/dev/null; }
-
-# WHERE THE TURN STARTS, FOUND BEFORE PARSING RATHER THAN AFTER. The window is
-# 3000 lines and routinely 7MB, of which a turn is the last few hundred lines
-# and about a sixth of the bytes — the rest is tool results this check never
-# looks at. The predecessor parsed all of it and threw most away, which jq
-# could afford and a parser written in awk cannot: measured at 6.5s for a 7MB
-# window against 94ms, on a hook that runs at the end of every turn.
-#
-# So grep — C, and reading a FIXED string — narrows first. A prompt record is
-# `"type":"user"` whose `content` is a STRING; a tool result is the same type
-# with an ARRAY, and the two are told apart by the character after `"content":`.
-#
-# WHY A FIXED STRING IS EXACT HERE, and not the usual regex-over-JSON guess.
-# Every quote inside a JSON string is backslash-escaped, so a needle carrying
-# UNESCAPED quotes cannot occur inside any string value — it can only match at
-# a record's own top level. `"message":{"role":"user","content":"` therefore
-# matches real prompt records and nothing else. Measured over a 27MB transcript
-# against a full JSON parse: 152 prompt records, 152 matches, no misses and no
-# extras. The looser `"content":"` matched 1101 lines, because a tool_result
-# block has a `content` key of its own — which is the trap this avoids.
-#
-# THE LAST MATCH, not a few before it, because the margin is not free: the
-# lines between two prompts are mostly tool results, and backing off three
-# matches took the window from 53KB to 1.3MB and the parse from 21ms to 2.6s.
-# The fallback below is the safety net instead — it is exact where a margin is
-# only approximate, and it costs nothing in the case that actually happens.
-#
-# The needle assumes a key ORDER that a future Claude Code could change. If it
-# does, grep matches nothing, `start` stays 1, and the whole window is read the
-# slow way — correct, and slow, which is the right way round for a check that
-# can block a stop.
-start=$(window | grep -n -F '"message":{"role":"user","content":"' 2>/dev/null \
-  | cut -d: -f1 | awk '{ last = $0 } END { if (NR) print last }')
-case "$start" in ''|*[!0-9]*) start=1 ;; esac
-
-facts=$(turn_facts "$start")
-fact() { printf '%s\n' "$facts" | awk -F'\t' -v k="$1" '$1 == k { print substr($0, index($0, "\t") + 1); exit }'; }
-
-if [ "$(fact bounded)" != "1" ] && [ "$start" != "1" ]; then
-  facts=$(turn_facts 1)
-fi
+# The turn, parsed once — scribe_turn_facts, shared with the reply check.
+facts=$(scribe_turn_facts "$transcript")
+fact() { scribe_turn_fact "$facts" "$1"; }
 
 [ "$(fact bounded)" = "1" ] || exit 0
 closed=$(fact closed)