harvest: scrub wrapped reminders with their own token, not a fixed constant

Deviation found while validating the first real --pin (capture s-633915a8,
n=26->28): scrubText collapsed every <system-reminder>-wrapped block to the
literal constant "REDACTED", regardless of its real content. That breaks
insertion-normalization's wrap/unwrap cross-identity check
(findSuppressibleDuplicate/unwrapVolatileText, proxy/extensions/
insertion-normalization.mjs) -- CC sometimes migrates a reminder OUT of its
wrapper into a standalone duplicate message, and suppression fires only
when the wrapped original's stripped bytes hash-match the standalone
duplicate's bytes. Under the fixed constant, the wrapped original always
hashed to "REDACTED" while the unwrapped duplicate hashed its real text
independently, so the two never matched post-scrub.

Measured directly: replaying the sanitized n=26->28 fixture through the
real pipeline gave suppressed=0 / outputForm="splice@31" (the pre-fix
defect shape) instead of the live capture's suppressed=1 /
outputForm="append". The committed pinned fixture would have silently
reproduced stale, wrong behaviour once the live capture rotated away --
worse than the SKIP it was meant to replace.

Fix: a wrapped reminder now re-wraps scrubText's own recursive token for
its inner text instead of a fixed placeholder. The wrapper tags still
survive verbatim (any check that only tests for wrapper PRESENCE is
unaffected -- verified against test/harvest.test.mjs's existing
"wrappers survive" test, unchanged and still green), and two reminders
with equal real bytes -- wrapped or not -- now hash equal after scrubbing,
matching what the sanitizer already guarantees for ordinary text.

Verified: test/harvest.test.mjs (14/14, no regression), and the fixed
scrubber's output re-run through the actual pipeline (findMitigationGaps,
findSafetyViolations) reproduces the live capture's real values exactly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
(cherry picked from commit fda83cc)

Author: Gunther-Schulz

tools/harvest.mjs

@@ -49,8 +49,14 @@
 // only the arrangement matters.
 //
 // Two things survive verbatim, because for them the content IS the class:
-//   - <system-reminder> wrappers (the volatile-block detector matches on
-//     the wrapper, so replacing it would erase the very property under test)
+//   - <system-reminder> WRAPPER TAGS (the volatile-block detector matches on
+//     the wrapper, so replacing it would erase the very property under
+//     test); the text they wrap is still tokenized like any other text
+//     (scrubText), not replaced by a fixed placeholder — a fixed
+//     placeholder made every reminder hash identically regardless of real
+//     content, which breaks the separate class where a reminder migrates
+//     OUT of its wrapper into a standalone duplicate message and must still
+//     hash-match its wrapped original post-scrub (see scrubText's comment)
 //   - structural ids: tool_use_id / id pairs, which must stay consistent or
 //     the tool-adjacency invariant breaks
 //
@@ -94,14 +100,33 @@ const sha = (s) => createHash("sha256").update(s).digest("hex");
 
 // --- Sanitization ---
 
-const VOLATILE_WRAP = /^<system-reminder>\n[\s\S]*\n<\/system-reminder>\s*$/;
+const VOLATILE_WRAP = /^<system-reminder>\n([\s\S]*)\n<\/system-reminder>\s*$/;
 
 // Deterministic placeholder: same input text always yields the same token, so
 // a message that repeats across requests still compares equal — which is the
 // whole point, since identity matching is what we are testing.
+//
+// A wrapped reminder re-wraps its OWN deterministic token instead of a fixed
+// constant. A fixed constant ("REDACTED" for every reminder regardless of
+// content) was tried first and is wrong: CC sometimes migrates a reminder
+// OUT of its wrapper into a standalone duplicate message
+// (insertion-normalization.mjs's findSuppressibleDuplicate/
+// unwrapVolatileText compares the wrapped original's stripped bytes against
+// the standalone copy's bytes to suppress the duplicate). A fixed constant
+// made the wrapped original hash to "REDACTED" while the unwrapped
+// duplicate — never matching VOLATILE_WRAP — hashed its real text
+// independently, so the two never matched post-scrub and the suppression
+// class became unobservable in any fixture built from it (measured
+// empirically while building the harvest --pin fixture for capture
+// s-633915a8 n=26->28: suppressed count 1->0, outputForm "append"->
+// "splice@31" under the fixed-constant scrub). Recursing scrubText on the
+// captured inner text keeps both sides deterministic and equal when their
+// real bytes were equal, wrapped or not — the wrapper tags still survive
+// verbatim, so a check that only tests for wrapper PRESENCE is unaffected.
 function scrubText(text) {
   if (typeof text !== "string") return text;
-  if (VOLATILE_WRAP.test(text)) return "<system-reminder>\nREDACTED\n</system-reminder>";
+  const wrapped = VOLATILE_WRAP.exec(text);
+  if (wrapped) return `<system-reminder>\n${scrubText(wrapped[1])}\n</system-reminder>`;
   if (text === "") return "";
   return `t_${sha(text).slice(0, 12)}_${text.length}`;
 }