feat(moments): mount the corpus by proposal - a pass and an open-after-moment signal, both stopping at the operator (milestone 458 step 7, #4925)

A rule written before moments existed is mounted on nothing. Step 7 records,
per (rule, moment), whether it belongs there and who said so:

- rule_moment_judgments (migration 0118, backup v23): suggested / confirmed /
  rejected, from a pass, the signal, or an edit. Moment "" is "no moment fits".
- The pass: rules_to_mount lists unjudged rules; propose_rule_moments records
  suggestions that mount nothing; rule_moment_proposals and
  judge_rule_moments put them to the operator. A confirm mounts, a reject is
  kept so the pair is never proposed again. Same service behind REST and a
  "Waiting on you" panel in Settings > Moments.
- Edits are judgments: set_rule_moments, the one mount write path, confirms
  what was added and rejects what was removed in the same transaction.
- The signal: scribe_moment.sh keeps a per-session acts ledger; when a rule
  is opened, scribe_record_opened.sh sends the last three minutes of it to
  /api/plugin/rule-opened. The acts resolve through the install's mappings;
  work.run and work.change are not evidence. Counted per distinct session
  with lesson_rules' evidence model, and once due the open returns one line
  asking the reader to offer the mount.
- scribe_session_end.sh removes the session's scribe-moment files.

Plugin 2026.10.05.2003.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/mcp/server.py

@@ -159,6 +159,10 @@ _READ_ONLY_TOOLS = frozenset({
     # retrieval_telemetry's reason, and needed by a read key so that a line
     # naming a moment can be understood by whoever was shown it.
     "list_moments",
+    # The pass over the corpus and its queue (milestone 458 step 7): which
+    # rules are unjudged and which proposals wait. Reads of the caller's own
+    # rules, as list_rules is.
+    "rules_to_mount", "rule_moment_proposals",
 })
 
 # Every tool that WRITES, by name. Nothing reads this set at runtime — a tool
@@ -210,6 +214,9 @@ _WRITE_TOOLS = frozenset({
     # Which actions reach which moment on this install (milestone 458). Each
     # changes what fires for every later session, so a read key is refused.
     "map_action", "unmap_action",
+    # Proposing moments for a rule writes a judgment row; judging one mounts
+    # or unmounts the rule (step 7).
+    "propose_rule_moments", "judge_rule_moments",
     # A reviewer's verdicts on logged menu lines (#4772) — rows carrying free
     # prose the agent authored, `rule_outcome`'s reason for being a write.
     "judge_menu",

src/scribe/mcp/tools/moments.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 from scribe.mcp._context import current_user_id
 from scribe.services import moment_actions as actions_svc
 from scribe.services import moments as moments_svc
+from scribe.services import rule_moment_judgments as judgments_svc
 
 
 async def list_moments() -> dict:
@@ -105,7 +106,73 @@ async def unmap_action(tool: str, moment: str, match: str = "", reason: str = ""
     )
 
 
+async def rules_to_mount(limit: int = 25, offset: int = 0) -> dict:
+    """The rules nobody has decided the moments of — the pass over the corpus, a page at a time.
+
+    A rule written before moments existed is mounted on nothing and arrives
+    only when its words resemble the work. Read each rule here, decide WHEN it
+    applies, and record the answer with `propose_rule_moments`: the moments it
+    belongs on, or that none fits because it is about WHAT is done rather than
+    when. A rule leaves this list as soon as any answer is recorded, so the
+    next call returns the next unread rules.
+
+    Returns `rules` (id, title, kind, statement, when_to_apply, home),
+    `total_unjudged`, and the `catalog` to choose from.
+    """
+    return await judgments_svc.unjudged_rules(current_user_id(), limit=limit, offset=offset)
+
+
+async def propose_rule_moments(proposals: list[dict]) -> dict:
+    """Propose the moments rules belong on — for the operator to confirm, never mounted by this call.
+
+    Each item is either
+    `{"rule_id": N, "moments": ["work.finish", "reply.report"], "why": "…"}`
+    or `{"rule_id": N, "none": "why no moment fits"}`.
+
+    Propose a moment when the rule governs that point in the work whatever
+    the work is about — a rule about when work counts as done belongs where
+    work is finished, delivered, verified and reported. Say none fits when
+    the rule is about a subject (a library, a file, a style) and is best
+    reached by meaning. `why` is shown to the operator beside the proposal;
+    write it so they can say yes or no without opening the rule.
+
+    A moment proposal waits as `suggested` until judged; show the operator
+    what you proposed (`rule_moment_proposals`) and let them decide. A pair
+    already mounted or judged is skipped and listed under `skipped`; a bad
+    item is refused alone under `refused`.
+    """
+    return await judgments_svc.propose(current_user_id(), proposals)
+
+
+async def rule_moment_proposals(rule_id: int = 0) -> dict:
+    """The moment proposals waiting on the operator, grouped by rule.
+
+    Each rule carries what it is mounted on now and its proposals: the moment,
+    where the proposal came from (`pass` — read from the rule; `signal` — the
+    rule kept being opened just after that moment fired), the reason, and the
+    evidence counts. `rule_id` narrows to one rule.
+    """
+    return await judgments_svc.pending(current_user_id(), rule_id=rule_id or None)
+
+
+async def judge_rule_moments(judgments: list[dict]) -> dict:
+    """Confirm or reject moment proposals — on the operator's word, since a confirm mounts the rule.
+
+    Each item is `{"rule_id": N, "moment": "work.finish", "verdict":
+    "confirm" | "reject", "note": "why"}`. Confirm mounts the rule on that
+    moment beside what it already has; reject records that it does not belong
+    there (and unmounts it if it was mounted), so neither the pass nor the
+    signal proposes the pair again. Moment `""` judges a "no moment fits"
+    answer. Put the operator's reason in `note`.
+    """
+    return await judgments_svc.judge(current_user_id(), judgments)
+
+
 def register(mcp) -> None:
     mcp.tool(name="list_moments")(list_moments)
     mcp.tool(name="map_action")(map_action)
     mcp.tool(name="unmap_action")(unmap_action)
+    mcp.tool(name="rules_to_mount")(rules_to_mount)
+    mcp.tool(name="propose_rule_moments")(propose_rule_moments)
+    mcp.tool(name="rule_moment_proposals")(rule_moment_proposals)
+    mcp.tool(name="judge_rule_moments")(judge_rule_moments)

src/scribe/models/__init__.py

@@ -82,6 +82,8 @@ from scribe.models.rulebook import (  # noqa: E402, F401
 )
 # After notes and rules: it foreign-keys both (milestone 440).
 from scribe.models.lesson_rule_link import LessonNoRule, LessonRuleLink  # noqa: E402, F401
+# After rules: it foreign-keys them (milestone 458 step 7).
+from scribe.models.rule_moment_judgment import RuleMomentJudgment  # noqa: E402, F401
 from scribe.models.repo_binding import RepoBinding  # noqa: E402, F401
 from scribe.models.forge_connection import ForgeConnection  # noqa: E402, F401
 from scribe.models.code_shape import CodeShape, CodeShapeConsumer, CodeShapeEvent, CodeShapeUse  # noqa: E402, F401

src/scribe/models/rule_moment_judgment.py

@@ -0,0 +1,81 @@
+from datetime import datetime
+
+from sqlalchemy import BigInteger, DateTime, ForeignKey, Text, UniqueConstraint
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import Mapped, mapped_column
+
+from scribe.models import Base
+from scribe.models.base import CreatedAtMixin, iso
+from scribe.models.lesson_rule_link import CONFIRMED, LINK_STATES, REJECTED, SUGGESTED
+
+# The same three states as a lesson's link to a rule, for the same reasons —
+# re-exported so a reader of this table need not know where they were first
+# named. CHECK ck_rule_moment_judgments_state (migration 0118, rule 36).
+JUDGMENT_STATES = LINK_STATES
+__all__ = [
+    "CONFIRMED", "JUDGMENT_STATES", "NO_MOMENT", "REJECTED", "SUGGESTED",
+    "SOURCES", "RuleMomentJudgment",
+]
+
+# The moment recorded for "this rule is about WHAT, not WHEN": no moment in
+# the catalog is when it applies, and it is right to reach it by meaning. A
+# row rather than an absence, for the reason LessonNoRule is one — a rule
+# looked at and found to have no moment must not read as one nobody looked at,
+# or every pass over the corpus would propose it again.
+NO_MOMENT = ""
+
+# Where a judgment came from. `pass` — an agent read the rule and proposed;
+# `signal` — the rule kept being opened just after a moment fired; `edit` — a
+# person changed the rule's moments directly, which is a judgment too.
+SOURCES = ("pass", "signal", "edit")
+
+
+class RuleMomentJudgment(Base, CreatedAtMixin):
+    """Whether a rule belongs on a moment, and who said so (milestone 458 step 7).
+
+    A mount (`rule_moments`) is the current answer; this is the reasoning
+    behind it and the answers that are NOT mounts. One row per (rule, moment):
+
+    - ``suggested`` — proposed by a pass, or by repeated opens after the
+      moment fired. Delivers nothing: a suggestion that mounted itself would
+      manufacture the opens it counts.
+    - ``confirmed`` — a judgment put the rule on the moment. The mount exists.
+    - ``rejected`` — a judgment said it does not belong there, kept with its
+      reason so the pair is never proposed again, by either source.
+
+    Moment ``""`` (NO_MOMENT), confirmed, is "no moment fits this rule".
+    """
+
+    __tablename__ = "rule_moment_judgments"
+
+    id: Mapped[int] = mapped_column(BigInteger, primary_key=True)
+    rule_id: Mapped[int] = mapped_column(
+        BigInteger, ForeignKey("rules.id", ondelete="CASCADE"), index=True,
+    )
+    moment: Mapped[str] = mapped_column(Text)
+    state: Mapped[str] = mapped_column(Text, default=SUGGESTED, server_default=SUGGESTED)
+    source: Mapped[str] = mapped_column(Text, default="pass", server_default="pass")
+    # Why — for a suggestion, what the proposer read in the rule; for a
+    # judgment, why it was confirmed or rejected.
+    note: Mapped[str | None] = mapped_column(Text, nullable=True)
+    # The co-occurrence evidence (signal source), in lesson_rules' shape.
+    evidence: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+    judged_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True,
+    )
+
+    __table_args__ = (
+        UniqueConstraint("rule_id", "moment", name="uq_rule_moment_judgments_pair"),
+    )
+
+    def to_dict(self) -> dict:
+        return {
+            "rule_id": self.rule_id,
+            "moment": self.moment,
+            "state": self.state,
+            "source": self.source,
+            "note": self.note or "",
+            "evidence": self.evidence or {},
+            "judged_at": iso(self.judged_at),
+            "created_at": iso(self.created_at),
+        }

src/scribe/routes/plugin.py

@@ -17,6 +17,7 @@ from scribe.services import moment_delivery as moment_delivery_svc
 from scribe.services import plugin_context as plugin_ctx_svc
 from scribe.services import repo_bindings as repo_bindings_svc
 from scribe.services import report_check as report_check_svc
+from scribe.services import rule_moment_judgments as judgments_svc
 from scribe.services import shape_check as shape_check_svc
 from scribe.services import task_claims as task_claims_svc
 from scribe.services.embeddings import memoized_query_embeddings
@@ -294,6 +295,35 @@ async def moment():
     })
 
 
+@plugin_bp.post("/rule-opened")
+@login_required
+async def rule_opened():
+    """A session opened a rule shortly after these acts (milestone 458 step 7).
+
+    Body: `{"rule_id", "session_id", "acts": [<PreToolUse event>, ...]}` —
+    the calls the plugin saw in the window before the `get_rule`. Each is
+    resolved to its moments, and the open is counted as evidence that the
+    rule belongs on them; once a pair has repeated across enough distinct
+    sessions, `context` carries the line asking the reader to offer the
+    mount. Nothing is mounted here. `repo` / `project_id` scope the evidence.
+    """
+    data = await request.get_json(silent=True) or {}
+    if not isinstance(data, dict):
+        return jsonify({"moments": [], "context": ""})
+    try:
+        rule_id = int(data.get("rule_id") or 0)
+    except (TypeError, ValueError):
+        rule_id = 0
+    acts = data.get("acts")
+    if rule_id <= 0 or not isinstance(acts, list):
+        return jsonify({"moments": [], "context": ""})
+    project_id, _repo, _unbound = await _project_scope()
+    return jsonify(await judgments_svc.opened_after(
+        g.user.id, rule_id, acts, session_id=str(data.get("session_id") or ""),
+        project_id=project_id or None,
+    ))
+
+
 @plugin_bp.post("/reply-rules")
 @login_required
 @memoized_query_embeddings

src/scribe/routes/retrieval.py

@@ -20,6 +20,7 @@ from quart import Blueprint, jsonify, request
 from scribe.auth import get_current_user_id, login_required
 from scribe.services import moment_actions as moment_actions_svc
 from scribe.services import moments as moments_svc
+from scribe.services import rule_moment_judgments as judgments_svc
 from scribe.services import rulebooks as rulebooks_svc
 from scribe.services.retrieval_telemetry import moment_usage
 from scribe.services.retrieval_tuning import set_dial, current_settings, tuning_history
@@ -177,3 +178,27 @@ async def map_action_route():
 @login_required
 async def unmap_action_route():
     return await _mapping_change(moment_actions_svc.unmap_action)
+
+
+@retrieval_bp.route("/moments/proposals", methods=["GET"])
+@login_required
+async def moment_proposals_route():
+    """The moment proposals waiting on a judgment (milestone 458 step 7) —
+    `rule_moment_proposals`' payload, from the same service. `?rule_id=`
+    narrows to one rule, for the rule editor."""
+    try:
+        rule_id = int(request.args.get("rule_id") or 0)
+    except ValueError:
+        return jsonify({"error": "rule_id must be a whole number"}), 400
+    return jsonify(await judgments_svc.pending(get_current_user_id(), rule_id=rule_id or None))
+
+
+@retrieval_bp.route("/moments/proposals/judge", methods=["POST"])
+@login_required
+async def judge_moment_proposals_route():
+    """Confirm or reject proposals: `{"judgments": [{rule_id, moment, verdict,
+    note}]}` — `judge_rule_moments` from the browser. A confirm mounts."""
+    data = await request.get_json(silent=True)
+    if not isinstance(data, dict) or not isinstance(data.get("judgments"), list):
+        return jsonify({"error": "Expected {\"judgments\": [...]}"}), 400
+    return jsonify(await judgments_svc.judge(get_current_user_id(), data["judgments"]))

src/scribe/services/backup.py

@@ -21,6 +21,7 @@ from scribe.models.rulebook import (
     RuleRelation, rule_moments as rule_moments_t, rule_systems as rule_systems_t,
 )
 from scribe.models.lesson_rule_link import LessonNoRule, LessonRuleLink
+from scribe.models.rule_moment_judgment import RuleMomentJudgment
 from scribe.models.code_shape import CodeShape, CodeShapeEvent, CodeShapeUse
 from scribe.models.project import Project
 from scribe.models.repo_binding import RepoBinding
@@ -104,8 +105,12 @@ logger = logging.getLogger(__name__)
 # arrives at. A mount is a judgment about when a rule applies that nothing in
 # the rule's text records, and losing it would put back exactly the misses the
 # mounts were made to fix.
+# v23 (2026-10) added rule_moment_judgments (milestone 458 step 7): the
+# proposals waiting on a mount, and the rejections and "no moment fits"
+# answers that stop a pass or the open-after-moment signal proposing the same
+# pair again. Losing them puts every answered question back on the list.
 # Bump when the serialized schema changes.
-BACKUP_VERSION = 22
+BACKUP_VERSION = 23
 
 # Every table this backup carries, by its REAL name. Paired with _NOT_INCLUDED
 # below, these two lists must together account for the entire schema — which is
@@ -154,6 +159,8 @@ _BACKED_UP = [
     "moment_mappings",
     # v22 (2026-10): the moments each rule arrives at (milestone 458).
     "rule_moments",
+    # v23 (2026-10): proposals and judgments about those mounts (step 7).
+    "rule_moment_judgments",
 ]
 
 # Tables intentionally NOT in the backup, surfaced in the payload so the gap is
@@ -253,6 +260,8 @@ _COLUMN_EXCLUSIONS: dict[str, set[str]] = {
     "rule_relations": {"id", "created_at"},
     # The pair is the row; everything else is the judgment and its evidence.
     "lesson_rule_links": {"id"},
+    # The same shape: the (rule, moment) pair is the row.
+    "rule_moment_judgments": {"id"},
     # Keyed by the lesson itself; nothing to exclude, every column travels.
     "lesson_no_rule": set(),
     "note_usage_events": {"id"},
@@ -346,6 +355,7 @@ _IMPORT_COLUMN_EXCLUSIONS: dict[str, set[str]] = {
     "note_supersessions": {"id", "created_at"},
     "rule_relations": {"id", "created_at"},
     "lesson_rule_links": {"id"},
+    "rule_moment_judgments": {"id"},
     "lesson_no_rule": set(),
     "note_usage_events": {"id"},
     "rule_usage_events": {"id"},
@@ -755,6 +765,20 @@ def _rule_moment_rows(rows) -> list[dict]:
     return [{"rule_id": rule_id, "moment": moment} for rule_id, moment in rows]
 
 
+def _rule_moment_judgment_rows(rows) -> list[dict]:
+    """Proposals and judgments about a rule's moments (v23). The rule id is a
+    SOURCE id, remapped at restore; the moment is a catalog name."""
+    return [
+        {
+            "rule_id": r.rule_id, "moment": r.moment, "state": r.state,
+            "source": r.source, "note": r.note, "evidence": r.evidence,
+            "judged_at": r.judged_at.isoformat() if r.judged_at else None,
+            "created_at": r.created_at.isoformat() if r.created_at else None,
+        }
+        for r in rows
+    ]
+
+
 def _rule_system_rows(rows) -> list[dict]:
     """A rule's area tags, carried by canonical SLUG for the same reason the
     Systems are: the catalog is global and its ids are per-install."""
@@ -850,6 +874,9 @@ async def export_full_backup() -> dict:
         rule_moment_rows = (await session.execute(
             select(rule_moments_t.c.rule_id, rule_moments_t.c.moment)
         )).all()
+        rule_moment_judgments = (await session.execute(
+            select(RuleMomentJudgment)
+        )).scalars().all()
         rule_relations = (await session.execute(select(RuleRelation))).scalars().all()
         lesson_rule_links = (await session.execute(select(LessonRuleLink))).scalars().all()
         lesson_no_rule = (await session.execute(select(LessonNoRule))).scalars().all()
@@ -917,6 +944,7 @@ async def export_full_backup() -> dict:
         "canonical_systems": _canonical_system_rows(canonical_systems),
         "rule_systems": _rule_system_rows(rule_system_rows),
         "rule_moments": _rule_moment_rows(rule_moment_rows),
+        "rule_moment_judgments": _rule_moment_judgment_rows(rule_moment_judgments),
         "rule_relations": _rule_relation_rows(rule_relations),
         "lesson_rule_links": _lesson_rule_link_rows(lesson_rule_links),
         "lesson_no_rule": _lesson_no_rule_rows(lesson_no_rule),
@@ -1055,6 +1083,9 @@ async def export_user_backup(user_id: int) -> dict:
             select(rule_moments_t.c.rule_id, rule_moments_t.c.moment)
             .where(rule_moments_t.c.rule_id.in_(_rule_ids))
         )).all() if _rule_ids else []
+        rule_moment_judgments = (await session.execute(
+            select(RuleMomentJudgment).where(RuleMomentJudgment.rule_id.in_(_rule_ids))
+        )).scalars().all() if _rule_ids else []
         # Scoped through the RULE, not the version's user_id. That column is
         # the ACTOR (milestone 323), so filtering on it would carry the
         # versions this user wrote on someone ELSE's rule and drop the ones
@@ -1137,6 +1168,7 @@ async def export_user_backup(user_id: int) -> dict:
         "canonical_systems": _canonical_system_rows(canonical_systems),
         "rule_systems": _rule_system_rows(rule_system_rows),
         "rule_moments": _rule_moment_rows(rule_moment_rows),
+        "rule_moment_judgments": _rule_moment_judgment_rows(rule_moment_judgments),
         "rule_relations": _rule_relation_rows(rule_relations),
         "lesson_rule_links": _lesson_rule_link_rows(lesson_rule_links),
         "lesson_no_rule": _lesson_no_rule_rows(lesson_no_rule),
@@ -1535,6 +1567,25 @@ def _build_lesson_rule_link(row: dict, maps: _Maps) -> LessonRuleLink | None:
     )
 
 
+def _build_rule_moment_judgment(row: dict, maps: _Maps) -> RuleMomentJudgment | None:
+    """Skipped when its rule did not restore — the judgment is about that
+    rule, and a remap miss would hang it on whatever took the number."""
+    rule = maps.rules.get(row.get("rule_id", 0))
+    if rule is None or row.get("moment") is None:
+        return None
+    return RuleMomentJudgment(
+        rule_id=rule,
+        moment=row["moment"],
+        state=row.get("state") or "suggested",
+        source=row.get("source") or "pass",
+        note=row.get("note") or None,
+        evidence=row.get("evidence"),
+        # Absent stays absent: a suggestion was never judged.
+        judged_at=_dt_or_none(row.get("judged_at")),
+        created_at=_dt(row.get("created_at")),
+    )
+
+
 def _build_rule_version(row: dict, maps: _Maps) -> RuleVersion | None:
     rid = maps.rules.get(row.get("rule_id", 0))
     if rid is None:
@@ -1949,7 +2000,7 @@ async def _restore_v2(data: dict) -> dict:
         "repo_bindings": 0,
         "note_supersessions": 0, "code_shapes": 0, "code_shape_events": 0,
         "code_shape_uses": 0, "canonical_systems": 0,
-        "rule_systems": 0, "rule_moments": 0,
+        "rule_systems": 0, "rule_moments": 0, "rule_moment_judgments": 0,
         "rule_relations": 0, "rule_versions": 0,
         "retrieval_tuning_events": 0, "lesson_rule_links": 0,
         "lesson_no_rule": 0, "moment_mappings": 0,
@@ -2160,6 +2211,15 @@ async def _restore_v2(data: dict) -> dict:
             ))
             stats["rule_moments"] += 1
 
+        # Proposals and judgments about those mounts (v23); archives before
+        # v23 carry none, and every rule restores unjudged.
+        for rj in data.get("rule_moment_judgments", []):
+            judgment = _build_rule_moment_judgment(rj, maps)
+            if judgment is None:
+                continue
+            session.add(judgment)
+            stats["rule_moment_judgments"] += 1
+
         for rr in data.get("rule_relations", []):
             relation = _build_rule_relation(rr, maps)
             if relation is None:

src/scribe/services/lesson_rules.py

@@ -485,16 +485,18 @@ async def attach_rule_lessons(user_id: int, data: dict, rule_id: int) -> None:
 def situation_key(arm: str, text: str) -> str:
     """A fingerprint of one situation, so a repeat counts once.
 
-    `arm` is part of the key — "p" for a prompt, "w" for a file being written
-    — because the two name different kinds of situation and must not collide.
+    `arm` is part of the key — "p" for a prompt, "w" for a file being written,
+    "s" for a session (the rule↔moment signal, milestone 458 step 7) —
+    because each names a different kind of situation and must not collide.
     On the prompt arm the text is the prompt: lowercased, split into word
     tokens of _MIN_TOKEN or more, de-duplicated and sorted, so the same ask
     re-sent with different spacing, punctuation, case or word order is one
     situation. On the write arm the text is the PATH, not the code: every
     edit to one file is one situation, however much the code differs between
-    them. Empty when there is nothing to key on.
+    them. The session arm keys on the session id as given. Empty when there
+    is nothing to key on.
     """
-    if arm == "w":
+    if arm in ("w", "s"):
         basis = (text or "").strip()
     else:
         tokens = sorted({t for t in re.findall(r"[a-z0-9]+", (text or "").lower())

src/scribe/services/rule_moment_judgments.py

@@ -0,0 +1,527 @@
+"""Which rules belong on which moments — proposals and judgments (milestone 458 step 7).
+
+A rule written before moments existed is mounted on nothing, and reaches a
+session only when its words resemble the work. Mounting the corpus is a
+judgment about each rule — WHEN does it apply? — and nothing in a rule's row
+says whether that judgment was ever made. This service records it, from two
+sources that both stop at a proposal:
+
+- THE PASS. An agent reads the rules nobody has judged (`unjudged_rules`),
+  proposes moments for each, or says none fits (`propose`). A proposal mounts
+  nothing; a person confirms it (`judge`).
+- THE SIGNAL. A rule a session OPENS shortly after a moment fired is evidence
+  it belongs on that moment. Recorded per distinct session with the evidence
+  model lesson↔rule soft links use (lesson_rules: three situations, a
+  cooldown), and once it crosses the bar the next open asks the reader to
+  offer the mount (`co_occurred`).
+
+Neither source mounts anything by itself. A suggestion that delivered its rule
+would manufacture the opens it counts, and the operator's corpus is theirs to
+mount.
+
+EDITS ARE JUDGMENTS TOO. A person changing a rule's moments directly says
+which moments it belongs on, so `record_mount_change` (called from the one
+write path, `rulebooks.set_rule_moments`) confirms what was added and rejects
+what was removed — a moment taken off a rule must not be proposed straight
+back by the signal.
+
+ACL (rule 78): rules are owner-scoped, and every read and write here goes
+through `rulebooks._owned_rules_clause` / `_fetch_owned_rule`.
+"""
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timezone
+
+from sqlalchemy import exists, func, not_, select
+from sqlalchemy.exc import IntegrityError
+
+from scribe.models import async_session
+from scribe.models.rule_moment_judgment import (
+    CONFIRMED, NO_MOMENT, REJECTED, SUGGESTED, RuleMomentJudgment,
+)
+from scribe.models.rulebook import Rule, rule_moments as rule_moments_t
+from scribe.services import lesson_rules
+from scribe.services import moments as moments_svc
+
+logger = logging.getLogger(__name__)
+
+# What a caller says to judge one pair — acts, not the states they produce.
+VERDICTS = {"confirm": CONFIRMED, "reject": REJECTED}
+
+# Recorded on the rows an edit wrote, so a reader can tell a direct change from
+# an accepted proposal.
+_MOUNTED_NOTE = "mounted by an edit"
+_UNMOUNTED_NOTE = "unmounted by an edit"
+# On a "no moment fits" answer a later mount overturned.
+_OVERTURNED_NOTE = "a moment was mounted after all"
+
+# How many unjudged rules one pass page hands over. Enough to batch the
+# reading, few enough that every rule is actually read.
+PASS_PAGE = 25
+# How long after a moment an open still counts as following it. Long enough
+# for a session to see a line, decide it matters and open the rule; short
+# enough that the moment is still what the work is doing.
+SIGNAL_WINDOW_SECONDS = 180
+# Moments too ubiquitous to say anything about the rule opened after them:
+# nearly every open follows a command or a change, so counting them would
+# propose every rule onto both.
+SIGNAL_SKIP = frozenset({"work.run", "work.change"})
+
+
+def _clean_moment(name) -> str:
+    """A catalog moment, normalised; "" stays "" (no moment fits)."""
+    raw = (name or "").strip() if isinstance(name, str) else ""
+    if raw == NO_MOMENT:
+        return NO_MOMENT
+    return moments_svc.require_moment(raw)
+
+
+def _int(v) -> int | None:
+    try:
+        i = int(v)
+    except (TypeError, ValueError):
+        return None
+    return i if i > 0 else None
+
+
+async def _owned_rules(session, user_id: int, rule_ids) -> dict[int, Rule]:
+    from scribe.services.rulebooks import _owned_rules_clause
+
+    ids = [i for i in (_int(r) for r in rule_ids or []) if i]
+    if not ids:
+        return {}
+    rows = (await session.execute(
+        select(Rule).where(Rule.id.in_(ids)).where(_owned_rules_clause(user_id))
+    )).scalars().all()
+    return {r.id: r for r in rows}
+
+
+async def _mounts(session, rule_ids) -> dict[int, set[str]]:
+    if not rule_ids:
+        return {}
+    rows = (await session.execute(
+        select(rule_moments_t.c.rule_id, rule_moments_t.c.moment)
+        .where(rule_moments_t.c.rule_id.in_(list(rule_ids)))
+    )).all()
+    out: dict[int, set[str]] = {}
+    for rid, moment in rows:
+        out.setdefault(rid, set()).add(moment)
+    return out
+
+
+async def _rows(session, rule_ids) -> dict[tuple[int, str], RuleMomentJudgment]:
+    if not rule_ids:
+        return {}
+    rows = (await session.execute(
+        select(RuleMomentJudgment).where(RuleMomentJudgment.rule_id.in_(list(rule_ids)))
+    )).scalars().all()
+    return {(r.rule_id, r.moment): r for r in rows}
+
+
+def _brief(rule: Rule) -> dict:
+    return {
+        "id": rule.id,
+        "title": rule.title,
+        "kind": rule.kind or "rule",
+        "statement": rule.statement,
+        "when_to_apply": rule.when_to_apply or "",
+        "home": "project" if rule.project_id else "global",
+    }
+
+
+# ── The pass ─────────────────────────────────────────────────────────────────
+
+
+def _unjudged_clause():
+    """No mount and no judgment row of any kind — a rule nobody has looked at."""
+    mounted = exists().where(rule_moments_t.c.rule_id == Rule.id)
+    judged = exists().where(RuleMomentJudgment.rule_id == Rule.id)
+    return not_(mounted), not_(judged)
+
+
+async def unjudged_rules(user_id: int, limit: int = PASS_PAGE, offset: int = 0) -> dict:
+    """The caller's rules with no moment and no judgment, a page at a time.
+
+    A rule leaves this list the moment any answer is recorded for it — a
+    proposal, a mount, or "no moment fits" — so a pass run in pieces, or by
+    two sessions, does not read the same rule twice.
+    """
+    from scribe.services.rulebooks import _owned_rules_clause
+
+    limit = max(1, min(int(limit or PASS_PAGE), 100))
+    offset = max(0, int(offset or 0))
+    clauses = (_owned_rules_clause(user_id), *_unjudged_clause())
+    async with async_session() as session:
+        total = (await session.execute(
+            select(func.count()).select_from(Rule).where(*clauses)
+        )).scalar_one()
+        rows = (await session.execute(
+            select(Rule).where(*clauses).order_by(Rule.id).limit(limit).offset(offset)
+        )).scalars().all()
+    return {
+        "rules": [_brief(r) for r in rows],
+        "total_unjudged": int(total),
+        "offset": offset,
+        "catalog": moments_svc.catalog(),
+    }
+
+
+async def propose(user_id: int, proposals: list[dict]) -> dict:
+    """Record a pass's proposals: moments for a rule, or that none fits.
+
+    Each item is `{rule_id, moments: [...], why}` or `{rule_id, none: "why"}`.
+    A moment proposal lands `suggested` and mounts nothing. "No moment fits"
+    lands as the agent's own answer (confirmed, moment ""): it changes nothing
+    that surfaces, and it is what keeps the rule off the next pass — the
+    signal can still propose a moment for it later, on evidence.
+
+    A pair already mounted or already judged is skipped and said so; a pair
+    already suggested has its reason refreshed. A bad item is refused alone,
+    with why, and the rest are written.
+    """
+    now = datetime.now(timezone.utc)
+    proposed, no_moment = 0, 0
+    skipped: list[dict] = []
+    refused: list[dict] = []
+    async with async_session() as session:
+        owned = await _owned_rules(session, user_id, [p.get("rule_id") for p in proposals or []
+                                                      if isinstance(p, dict)])
+        mounts = await _mounts(session, list(owned))
+        existing = await _rows(session, list(owned))
+        for item in proposals or []:
+            if not isinstance(item, dict):
+                refused.append({"item": item, "error": "each proposal is an object"})
+                continue
+            rid = _int(item.get("rule_id"))
+            if rid is None or rid not in owned:
+                refused.append({"rule_id": item.get("rule_id"),
+                                "error": "not a rule you own"})
+                continue
+            none_why = (item.get("none") or "").strip() if isinstance(item.get("none"), str) else ""
+            names = item.get("moments")
+            if none_why and names:
+                refused.append({"rule_id": rid, "error": (
+                    "moments and none are the two answers to \"when does this rule "
+                    "apply?\" — give the one that holds")})
+                continue
+            if none_why:
+                if mounts.get(rid):
+                    skipped.append({"rule_id": rid, "moment": NO_MOMENT,
+                                    "why": "already mounted on " + ", ".join(sorted(mounts[rid]))})
+                    continue
+                row = existing.get((rid, NO_MOMENT))
+                if row is None:
+                    row = RuleMomentJudgment(rule_id=rid, moment=NO_MOMENT, source="pass")
+                    session.add(row)
+                    existing[(rid, NO_MOMENT)] = row
+                row.state, row.note, row.judged_at = CONFIRMED, none_why, now
+                no_moment += 1
+                continue
+            try:
+                wanted = moments_svc.require_moments(names if names is not None else []) or []
+            except ValueError as exc:
+                refused.append({"rule_id": rid, "error": str(exc)})
+                continue
+            if not wanted:
+                refused.append({"rule_id": rid, "error": (
+                    "name at least one moment, or say none fits with none=\"why\"")})
+                continue
+            why = (item.get("why") or "").strip() if isinstance(item.get("why"), str) else ""
+            for moment in wanted:
+                if moment in mounts.get(rid, set()):
+                    skipped.append({"rule_id": rid, "moment": moment, "why": "already mounted"})
+                    continue
+                row = existing.get((rid, moment))
+                if row is not None and row.state != SUGGESTED:
+                    skipped.append({"rule_id": rid, "moment": moment,
+                                    "why": f"already {row.state}" + (f": {row.note}" if row.note else "")})
+                    continue
+                if row is None:
+                    row = RuleMomentJudgment(rule_id=rid, moment=moment, state=SUGGESTED, source="pass")
+                    session.add(row)
+                    existing[(rid, moment)] = row
+                row.note = why or row.note
+                proposed += 1
+        await session.commit()
+    return {"proposed": proposed, "no_moment": no_moment,
+            "skipped": skipped, "refused": refused}
+
+
+async def pending(user_id: int, rule_id: int | None = None, limit: int = 200) -> dict:
+    """The proposals waiting on a judgment, grouped by rule.
+
+    Each rule carries what it is mounted on now, so a proposal is read beside
+    the mounts it would add to.
+    """
+    from scribe.services.rulebooks import _owned_rules_clause
+
+    limit = max(1, min(int(limit or 200), 500))
+    async with async_session() as session:
+        stmt = (
+            select(RuleMomentJudgment, Rule)
+            .join(Rule, Rule.id == RuleMomentJudgment.rule_id)
+            .where(RuleMomentJudgment.state == SUGGESTED, _owned_rules_clause(user_id))
+        )
+        if rule_id:
+            stmt = stmt.where(Rule.id == int(rule_id))
+        rows = (await session.execute(
+            stmt.order_by(Rule.id, RuleMomentJudgment.moment).limit(limit)
+        )).all()
+        mounts = await _mounts(session, {r.id for _, r in rows})
+    order = {name: i for i, name in enumerate(moments_svc.MOMENTS)}
+    grouped: dict[int, dict] = {}
+    for judgment, rule in rows:
+        entry = grouped.setdefault(rule.id, {
+            **_brief(rule),
+            "mounted": sorted(mounts.get(rule.id, set()),
+                              key=lambda n: (order.get(n, len(order)), n)),
+            "proposals": [],
+        })
+        entry["proposals"].append({
+            "moment": judgment.moment,
+            "source": judgment.source,
+            "why": judgment.note or "",
+            "evidence": lesson_rules.evidence_summary(judgment.evidence),
+            "created_at": judgment.created_at.isoformat() if judgment.created_at else None,
+        })
+    rules = list(grouped.values())
+    return {"rules": rules, "total": sum(len(r["proposals"]) for r in rules)}
+
+
+async def judge(user_id: int, judgments: list[dict]) -> dict:
+    """Confirm or reject proposals — or any (rule, moment) pair, proposed or not.
+
+    Confirm MOUNTS the rule on the moment (alongside what it already has);
+    reject records that it does not belong there and, if it was mounted,
+    unmounts it. Both go through `rulebooks.set_rule_moments`, the one write
+    path, which records the judgment with this item's `note`. A moment of ""
+    judges the "no moment fits" answer itself. A bad item is refused alone.
+    """
+    from scribe.services.rulebooks import list_rule_moments, set_rule_moments
+
+    done: list[dict] = []
+    refused: list[dict] = []
+    for item in judgments or []:
+        if not isinstance(item, dict):
+            refused.append({"item": item, "error": "each judgment is an object"})
+            continue
+        rid = _int(item.get("rule_id"))
+        state = VERDICTS.get(str(item.get("verdict") or "").strip().lower())
+        if rid is None or state is None:
+            refused.append({"rule_id": item.get("rule_id"), "moment": item.get("moment"),
+                            "error": f"needs rule_id and a verdict, one of {sorted(VERDICTS)}"})
+            continue
+        try:
+            moment = _clean_moment(item.get("moment"))
+        except ValueError as exc:
+            refused.append({"rule_id": rid, "error": str(exc)})
+            continue
+        note = (item.get("note") or "").strip() if isinstance(item.get("note"), str) else ""
+        if moment == NO_MOMENT:
+            ok = await _judge_no_moment(user_id, rid, state, note)
+        else:
+            current = (await list_rule_moments([rid])).get(rid, [])
+            after = (current + [moment] if state == CONFIRMED and moment not in current
+                     else [m for m in current if m != moment] if state == REJECTED
+                     else current)
+            ok = await set_rule_moments(rid, user_id, after, note=note, judged=[moment],
+                                        verdict=state) is not None
+        if not ok:
+            refused.append({"rule_id": rid, "moment": moment, "error": "not a rule you own"})
+            continue
+        done.append({"rule_id": rid, "moment": moment, "state": state})
+    return {"judged": done, "refused": refused}
+
+
+async def _judge_no_moment(user_id: int, rule_id: int, state: str, note: str) -> bool:
+    now = datetime.now(timezone.utc)
+    async with async_session() as session:
+        if not await _owned_rules(session, user_id, [rule_id]):
+            return False
+        row = (await _rows(session, [rule_id])).get((rule_id, NO_MOMENT))
+        if row is None:
+            row = RuleMomentJudgment(rule_id=rule_id, moment=NO_MOMENT, source="edit")
+            session.add(row)
+        row.state, row.judged_at = state, now
+        row.note = note or row.note
+        await session.commit()
+    return True
+
+
+async def record_mount_change(
+    session, rule_id: int, before, after, *, note: str = "",
+    judged=(), verdict: str | None = None,
+) -> None:
+    """Record the judgments a change of mounts makes, in the caller's session.
+
+    Added moments are confirmed, removed ones rejected — a mount taken off
+    must not be proposed straight back. `judged` names moments a `judge`
+    call decided explicitly, so a rejection of a moment that was never
+    mounted is recorded too. A suggestion that was accepted keeps its source,
+    so the record still says where the idea came from. Any mount overturns a
+    "no moment fits" answer.
+    """
+    before, after = set(before or ()), set(after or ())
+    added = after - before
+    removed = before - after
+    explicit = {m for m in judged or () if m} - added - removed
+    if not (added or removed or explicit):
+        return
+    now = datetime.now(timezone.utc)
+    rows = await _rows(session, [rule_id])
+
+    def put(moment: str, state: str, default_note: str) -> None:
+        row = rows.get((rule_id, moment))
+        if row is None:
+            row = RuleMomentJudgment(rule_id=rule_id, moment=moment, source="edit")
+            session.add(row)
+            rows[(rule_id, moment)] = row
+        row.state, row.judged_at = state, now
+        row.note = note or default_note or row.note
+
+    for moment in added:
+        put(moment, CONFIRMED, _MOUNTED_NOTE)
+    for moment in removed:
+        put(moment, REJECTED, _UNMOUNTED_NOTE)
+    for moment in explicit:
+        if verdict in (CONFIRMED, REJECTED):
+            put(moment, verdict, "")
+    if after:
+        none_row = rows.get((rule_id, NO_MOMENT))
+        if none_row is not None and none_row.state == CONFIRMED:
+            none_row.state, none_row.judged_at = REJECTED, now
+            none_row.note = _OVERTURNED_NOTE
+
+
+# ── The signal ───────────────────────────────────────────────────────────────
+
+
+def _proposal_line(rule: Rule, moment: str, evidence: dict) -> str:
+    counts = lesson_rules.evidence_summary(evidence)
+    kind = rule.kind or "rule"
+    return (
+        f"> {kind.capitalize()} #{rule.id} \"{rule.title}\" has been opened just after "
+        f"`{moment}` in {counts['situations']} distinct sessions — it may belong on "
+        f"that moment, where it would arrive without being searched for. Offer the "
+        f"operator the mount in one line; on their yes, `judge_rule_moments("
+        f"[{{\"rule_id\": {rule.id}, \"moment\": \"{moment}\", \"verdict\": \"confirm\", "
+        f"\"note\": \"why\"}}])` mounts it; on a no, `\"reject\"` with their why stops "
+        f"the asking."
+    )
+
+
+def signal_moments(moments) -> list[str]:
+    """The moments an open may be counted against: catalog or procedure
+    moments, minus the ubiquitous ones, de-duplicated in order."""
+    out: list[str] = []
+    for m in moments or []:
+        name = (m or "").strip().lower() if isinstance(m, str) else ""
+        if name and name not in SIGNAL_SKIP and moments_svc.is_moment(name) and name not in out:
+            out.append(name)
+    return out
+
+
+async def co_occurred(
+    user_id: int, rule_id: int, moments, *, situation: str,
+    project_id: int | None = None,
+) -> str:
+    """Record that a rule was opened shortly after these moments fired, and
+    return a proposal line once a (rule, moment) pair has earned one.
+
+    `situation` is what makes two opens distinct — the session, so a rule
+    opened after every push in one long session counts once. A pair already
+    mounted or judged gathers nothing. One proposal per open at most. Fails
+    open: this rides a hook, and bookkeeping must never break the read.
+    """
+    try:
+        return await _co_occurred(user_id, rule_id, moments, situation, project_id)
+    except Exception:
+        logger.warning("rule/moment co-occurrence could not be recorded", exc_info=True)
+        return ""
+
+
+async def _co_occurred(user_id, rule_id, moments, situation, project_id) -> str:
+    wanted = signal_moments(moments)
+    key = lesson_rules.situation_key("s", situation)
+    rid = _int(rule_id)
+    if not wanted or not key or rid is None:
+        return ""
+    now = datetime.now(timezone.utc)
+    proposal = None
+    async with async_session() as session:
+        owned = await _owned_rules(session, user_id, [rid])
+        rule = owned.get(rid)
+        if rule is None:
+            return ""
+        mounted = (await _mounts(session, [rid])).get(rid, set())
+        existing = await _rows(session, [rid])
+        for moment in wanted:
+            if moment in mounted:
+                continue
+            row = existing.get((rid, moment))
+            if row is not None and row.state != SUGGESTED:
+                continue
+            if row is None:
+                row = RuleMomentJudgment(rule_id=rid, moment=moment, state=SUGGESTED, source="signal")
+                session.add(row)
+            ev = lesson_rules.add_evidence(row.evidence, key, project_id, now)
+            if proposal is None and lesson_rules.proposal_due(ev, now):
+                ev["proposed_at"] = now.isoformat()
+                ev["proposed_count"] = int(ev.get("proposed_count") or 0) + 1
+                proposal = (moment, ev)
+            row.evidence = ev
+        try:
+            await session.commit()
+        except IntegrityError:
+            # Two opens created the same pair at once; the other stands.
+            await session.rollback()
+            return ""
+    if proposal is None:
+        return ""
+    return _proposal_line(rule, *proposal)
+
+
+# The most acts one open is checked against. The hook sends only the window's
+# acts, so this bounds a misbehaving client rather than an ordinary session.
+_ACTS_CAP = 30
+
+
+async def opened_after(
+    user_id: int, rule_id: int, acts, *, session_id: str,
+    project_id: int | None = None,
+) -> dict:
+    """A rule was opened; `acts` are the tool calls that came just before it.
+
+    Each act is a PreToolUse event as the plugin recorded it (`tool_name`,
+    `tool_input`), resolved to its moments by the same mappings delivery
+    uses — so a moment counted here is one that fired, on this install, for
+    that call. Returns `moments` (what the window reached, after the skip
+    list) and `context` (a proposal line, or "").
+    """
+    from scribe.services.moment_actions import moments_for
+
+    reached: list[str] = []
+    for act in list(acts or [])[:_ACTS_CAP]:
+        if not isinstance(act, dict):
+            continue
+        tool = str(act.get("tool_name") or "").strip()
+        if not tool:
+            continue
+        tool_input = act.get("tool_input")
+        try:
+            hits = await moments_for(user_id, tool, tool_input if isinstance(tool_input, dict) else {})
+        except Exception:
+            logger.debug("acts before an open could not be resolved", exc_info=True)
+            continue
+        for hit in hits:
+            name = hit.get("moment") if isinstance(hit, dict) else None
+            if name and name not in reached:
+                reached.append(name)
+    moments = signal_moments(reached)
+    context = ""
+    if moments and (session_id or "").strip():
+        context = await co_occurred(
+            user_id, rule_id, moments, situation=session_id.strip(), project_id=project_id,
+        )
+    return {"moments": moments, "context": context}

src/scribe/services/rulebooks.py

@@ -1111,7 +1111,8 @@ async def set_rule_systems(
 
 
 async def set_rule_moments(
-    rule_id: int, user_id: int, moments: list[str],
+    rule_id: int, user_id: int, moments: list[str], *,
+    note: str = "", judged=(), verdict: str | None = None,
 ) -> list[str] | None:
     """Replace which MOMENTS a rule arrives at (milestone 458). None if not owned.
 
@@ -1119,15 +1120,24 @@ async def set_rule_moments(
     Every name is checked against the catalog first and the whole write is
     refused on the first unknown one — a typo stored as a mount would read
     back as attached and never fire, the silent miss moments exist to end.
+
+    THE ONE WRITE PATH for mounts, so it is also where a change is recorded as
+    a judgment (step 7): what was added is confirmed, what was removed is
+    rejected, in the same transaction as the mounts. `note`, `judged` and
+    `verdict` come from `rule_moment_judgments.judge`, which says why.
     """
     from scribe.models.rulebook import rule_moments as rule_moments_t
     from scribe.services.moments import require_moments
+    from scribe.services.rule_moment_judgments import record_mount_change
 
     wanted = require_moments(moments) or []
     async with async_session() as session:
         rule = await _fetch_owned_rule(session, rule_id, user_id)
         if rule is None:
             return None
+        before = (await session.execute(
+            select(rule_moments_t.c.moment).where(rule_moments_t.c.rule_id == rule_id)
+        )).scalars().all()
         await session.execute(
             sql_delete(rule_moments_t).where(rule_moments_t.c.rule_id == rule_id)
         )
@@ -1135,6 +1145,9 @@ async def set_rule_moments(
             await session.execute(
                 insert(rule_moments_t).values(rule_id=rule_id, moment=moment)
             )
+        await record_mount_change(
+            session, rule_id, before, wanted, note=note, judged=judged, verdict=verdict,
+        )
         await session.commit()
         return wanted