test+booking: real-pair assertions follow the suppression fix; row 8 and backlog updated

The output-form test's real-pair values were the PRE-fix signature by
design (edit@31, 61 kB); post-suppression the pair diverges at 48 with a
marker-sized residual (ttl-management relocation, not a defect), and the
new upper-bound assertion turns a suppression regression into a red test.
Matrix row and backlog book the build (c5d870d), the two spec
corrections (output-guard owes no exemption; the literal acceptance
criterion encoded a single-divergence assumption), and the named
remainders: deploy step, five unclassified spliced pairs, three sibling
migrations, consumer grep.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZxGrF1LRBvmb7cFXmS2DH

Author: Gunther-Schulz

BACKLOG.md

@@ -52,29 +52,38 @@ bullet, evidence pointer included.
   the metric newly exposes FIVE more output-spliced pairs (~0.6 MB,
   ordinals in the mitigation report) — classify against
   blockMigration after (c) lands, they may be a different mechanism.
-  (c) READY,
-  serialized behind (b) on tools/replay.mjs ownership — the BUILD:
-  in insertion-normalization's positional rebuild, suppress the
-  migrated standalone message when its content equals the pinned
-  block after wrapper-normalization (the census's unwrap + string->
-  block fold; the raw bytes differ by the <system-reminder> wrapper
-  by observation); genuine change (normalized bytes differ) -> no
-  suppression, forward + reset per the existing rule; suppression
-  state rides the conversation sub-key; declared exemption in the
-  live output-guard AND replay's safety gate (message-count change
-  is deliberate — the tool_addition-announcement pattern); one
-  event line per suppression to the insertion event log; red-green
-  on the REAL pair: replaying the day's capture under new code must
-  turn n=26->28 into outputPreserved:true / rebilledOut 0 with the
-  safety gate green. Known residuals, accepted: a proxy restart
-  drops suppression pins -> one bust per active migration at the
-  boundary (row 3, stated at restart); post-restart first-seen form
-  re-anchors. Deployment coupling: proxy/** -> dotfiles pin bump +
-  restart at a stated session boundary + gate run (dev-loop).
+  (c) DONE 2026-07-30 (c5d870d, sonnet build;
+  dispatcher-verified: suites green, full-corpus gate 0/0/0/0 under
+  boot-record gates, real pair edit@31 ~61 kB -> edit@48 ~5 kB).
+  Two spec corrections booked from the build, both verified: the
+  "declared exemption in the live output-guard" clause was written
+  against a check that does not exist (output-guard has no
+  message-count invariant BY DESIGN — its directive line 58; 0
+  fires over 1190 requests) — no exemption owed; and the literal
+  acceptance criterion "outputPreserved:true / rebilledOut 0" was
+  unreachable by this fix alone — the residual divergence at 48 is
+  ttl-management relocating its cache_control marker off the old
+  tail (messages differ in ONLY that key, direct diff), expected
+  behavior of a different extension. The stability gate needed the
+  same declared exemption as the safety gate and the brief did not
+  name it (67 false fires before the fix, caught by full-corpus
+  replay) — lesson: a message-COUNT change gets checked against all
+  four replay invariants, not the two a brief happens to name.
+  Suppression is re-detected per request from the on-disk pin set
+  (no new state file). Remaining, named: (1) DEPLOY — proxy/** ->
+  dotfiles pin bump + restart at a stated session boundary + gate
+  run (dev-loop); row 8 closes on the live non-event, not the
+  build. (2) The five other output-spliced pairs are confirmed NOT
+  block migrations (census post-fix: exactly 4, none of the five)
+  — a different, still-unclassified mechanism, still open. (3) The
+  three sibling migrations (n=105->107, 107->108, 108->109) were
+  covered only by the aggregate gate, not individually verified.
+  (4) grep for consumers of the new suppressed/suppressions stats
+  fields not run (prior equivalent check on outputForm found none).
 
 - **READY — replay warns on gateless runs of gated captures**
-  (2026-07-29; serialized behind the suppress build on
-  tools/replay.mjs). Design: replay.mjs already parses the boot
+  (2026-07-29; was serialized behind the suppress build, now
+  unblocked — tools/replay.mjs free). Design: replay.mjs already parses the boot
   record's `gates`; when the capture declares gates and none of them
   is set in the effective env, print one unmissable warning line
   ("replaying DEFAULT gates; this traffic was served with N gates —

docs/directives/robustness-threat-matrix.md

@@ -367,24 +367,30 @@ cause classes. Coverage verdicts, each measured where possible:
   CORRECTED same day (sonnet probe + fingerprint check): the earlier
   "mitigation kind null, passed through" reading came from a replay
   under DEFAULT gates — the dev-loop's replay-the-serving-config
-  violation, instrument error; under the capture's own boot-record
-  gates the pair replays MITIGATED (normalized, 0 re-billed), the
-  one mitigated row of 7. The serving process ran current code
+  violation, instrument error; the serving process ran current code
   (source-fingerprint 8349b0e665c8 = /health = disk; note the
   fingerprint is sha256-content, NOT a git tree — comparing it to
   git hashes is the hand-rolled-identity error, made twice before
-  being checked). cdf3179's positional canonical rebuild names this
-  exact mechanism and absorbs it offline. OPEN, named precisely:
-  live-unabsorbed vs replay-absorbed — a replay-fidelity gap; prime
-  suspects: per-conversation state divergence (live proxy served a
-  concurrent second session; cross-key interference is a known
-  collision class) and pin state at n=26. Evidence for the state
-  hypothesis: census (5cdf51b) finds FOUR block migrations in this
-  session's capture, only ONE of which produced a worktime cold
-  event — same shape, different live outcomes. Check: compare
-  replay's n=28 output against the session-mirror's wire bytes at
-  indices 30/31. Census annotation shipped: blockMigration on splice
-  and edit rows (5cdf51b, red-tested, fires on all four).
+  being checked). RESOLVED same evening (fidelity probe): replay is
+  byte-faithful to the wire (outSha match), and "mitigated:true" was
+  the METRIC's input-side blindness — the pipeline's real behavior
+  was restore-the-pin AND forward the duplicate, a splice at 31 that
+  re-billed 124k. MITIGATION BUILT 2026-07-30 (c5d870d, decision B
+  pin-and-suppress): the positional rebuild suppresses a standalone
+  message whose wrapper-normalized bytes equal a live pinned block;
+  red-green on the real pair edit@31 ~61 kB -> edit@48 ~5 kB (the
+  residual is ttl-management's cache_control relocation at the old
+  tail — a different extension, expected); full-corpus gate under
+  boot-record gates 0/0/0/0; declared exemptions in replay's safety
+  AND stability gates (the stability one was unbriefed — found by
+  full-corpus replay, 67 false fires before the fix); output-guard
+  needs none (no message-count invariant by design, its directive
+  line 58, 0 fires over 1190 requests). Census annotation shipped:
+  blockMigration on splice and edit rows (5cdf51b, red-tested,
+  fires on all four in this capture — only ONE produced a live cold
+  event). BUILT, NOT YET SERVING: pending proxy restart (dotfiles
+  pin bump, stated session boundary). Row closes on the live
+  non-event, not on the build.
 - COVERED (mechanism now attributed) — mid-history nudge anchoring
   (#78660, #68140, #80604): row 4 above.
 - NEUTRALIZED BY CONFIG — subagent 5-minute TTL pinning (#74318): outcome

test/mitigation-output-form.test.mjs

@@ -177,28 +177,28 @@ test(
       // input-side self-report claims full mitigation.
       assert.equal(row.mitigated, true, "input-side self-report: normalized, 0 rebilled");
       assert.equal(row.rebilledBytes, 0);
-      // Output-side reality: the forwarded prefix is stable through index 30
-      // (fidelity report Fact 2/5 — n=26's own index 30 hash equals n=28's
-      // reconstructed index 30) and diverges at 31, where the standalone
-      // system message is spliced in ahead of n=26's carried-forward tail
-      // (fidelity report "What's actually happening"). The census classifies
-      // this specific pair as "replace/edit" rather than pure
-      // "splice/insert-mid" — one of n=26's forwarded messages is entirely
-      // ABSENT from n=28's output (missing=1, added=1: confirmed by a direct
-      // set-membership diff of the two outHash arrays, independent of this
-      // implementation's classification branch), so `outputForm` lands on
-      // the `edit@N` branch rather than `splice@N` — both are the
-      // non-append buckets the brief names as acceptable, and the load-
-      // bearing fact is the INDEX (31) and non-append, not which of the two
-      // labels.
+      // Output-side reality with suppression active (c5d870d): the migrated
+      // reminder duplicate that used to splice at 31 is suppressed, so the
+      // forwarded arrays are byte-identical through index 47 and diverge at
+      // 48 — n=26's message[48] carries ttl-management's cache_control
+      // marker (it was the tail then), n=28's does not (the conversation
+      // grew past it). The two messages differ ONLY in that key (direct
+      // diff, suppression build report (c)4) — an expected relocation by a
+      // different extension, not part of decision B, so the pair stays
+      // non-append with a marker-sized residual instead of the 61 kB
+      // reminder splice.
       assert.notEqual(row.outputForm, "append", "the output is NOT a clean tail append");
       assert.equal(
         row.outputForm,
-        "edit@31",
-        "byte evidence (fidelity report Fact 2/5 + missing-message diff): divergence at 31, not a pure splice",
+        "edit@48",
+        "post-suppression divergence is ttl-management's marker relocation at 48",
       );
       assert.equal(row.outputPreserved, false);
-      assert.ok(row.rebilledOutBytes > 0, "the splice re-bills everything from index 31 on");
+      assert.ok(row.rebilledOutBytes > 0, "the marker delta re-bills the tail from 48 on");
+      assert.ok(
+        row.rebilledOutBytes < 10 * 1024,
+        "residual is marker-sized (~5 kB), not the 61 kB reminder splice — suppression regressed if this grows",
+      );
     } finally {
       process.stderr.write = origStderr;
       for (const k of Object.keys(saved)) {