book the PR-prep dispatch: two STOP findings confirmed, slices prepared and HELD

The sanitizer misses image bytes one level down (source.data) —
confirmed by execution against the committed reset-move fixture; the
flap fixture predates the scrub homomorphism and keeps operator
prose raw. Both get READY fix items; the prepared branches
(a0a051f, fbec02f) hold until the fixtures are clean and the cnighswonger#272
reviewer's sanitization-path ask is answered on-thread. Prep
artifacts persisted to docs/audits/pr-prep-2026-07-31/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0171Mpvi9GsSnJjBNnbfxU2u

Author: Gunther-Schulz

BACKLOG.md

@@ -1120,7 +1120,52 @@ bullet, evidence pointer included.
   in the PARKED reserved-entry-residuals entry; verdict-ab self-test
   its own READY item.
 
-- **READY — verdict-ab self-test (report gap c5).**
+- **READY — harvest scrub misses image bytes: scrubBlock stops one
+  level above `source.data` (STOP finding, pr-prep report,
+  dispatcher-CONFIRMED by execution: harvest.mjs:169 tokenizes
+  `block.data`; wire images nest base64 at `block.source.data`;
+  reset-move fixture carries 5 raw PNGs, magic `iVBORw0KGgo`).**
+  Content verified benign (operator's own terminal prose, viewed),
+  but the sanitizer claim on the fixture is false as written and the
+  bug is generic. Build: (1) scrubBlock recurses into `source`
+  (`source.data` → `data_<sha10>` token, keep type/media_type
+  shape); (2) red-first bite that goes red on the committed
+  reset-move fixture's raw bytes BEFORE the fix; (3) re-scrub the
+  committed fixture in place and verify verdict-neutrality by
+  replay (images are not join constituents — same actions, same
+  suppression indices, same stability result); (4) corpus sweep:
+  every harvested fixture grepped for raw base64 under source.data,
+  results in the commit. Load-bearing (sanitizer, public repo).
+
+- **READY — flap fixture rebuilt SANITIZED via the scrub
+  homomorphism (pr-prep STOP finding 2).**
+  flap-s-0d6f38ba-86.json keeps 6 operator hook-prose strings raw
+  (quoting dispatch-discipline §1 / CLAUDE-maintenance by name) —
+  the raw retention pre-dated bffcb05's join-preserving scrub, and
+  the reset-move fixture's own header names this precedent as the
+  reason it deviated. Rebuild the fixture through scrubMessage with
+  the merged message re-joined from sanitized constituents (the
+  reset-move fixture's documented method); verifier: the three flap
+  pairs reproduce identical verdicts/suppression indices and
+  test/insertion-join-move.test.mjs + replay-gate-selfcheck stay
+  green. Fork main first; the upstream slices then carry the clean
+  fixture.
+
+- **HOLD — prepared PR-slice branches, push blocked on two
+  conditions (operator-visible).** State: pr/verification-tools
+  advanced 53761a3 → a0a051f (15 commits, tools/ byte-equal to fork
+  main) in worktree cache-fix-pr4; NEW pr/insertion-join-moves at
+  fbec02f (b713b2f + merge of a0a051f + 7 commits, extension
+  byte-equal to fork main) in worktree cache-fix-pr12; both merge
+  clean onto upstream/main 0817302; suites green except the
+  pre-existing proxy-read-dedupe failure (#272 open blocker 4,
+  proven pre-existing at 53761a3). Drafts + exact push/gh commands:
+  docs/audits/pr-prep-2026-07-31/. Conditions before any push:
+  (1) the two fixture items above land on fork main; (2) #272's
+  reviewer asked for an agreed sanitization path before more
+  fixture movement — respond on-thread first. Also fold in at
+  push time: the stacked PR body should name #273 as the third
+  stacked parent (the merge carries deferred-tool-rewrite.mjs).
   `tools/verdict-ab.mjs` has no committed test: its COULD-NOT-VERIFY
   exit-2 path was demonstrated red by execution and its fixture
   reader was corrected after a real 2-of-6-corpora miss (report

docs/audits/pr-prep-2026-07-31/pr-prep-actions.md

@@ -0,0 +1,138 @@
+# Dispatcher actions — prepared 2026-07-31
+
+Everything below is prepared and unpushed. Two worktrees hold the work:
+
+| worktree | branch | head | state |
+|---|---|---|---|
+| `/home/g/dev/vendor/cache-fix-pr4` | `pr/verification-tools` | `a0a051f` | 15 commits appended to `53761a3` |
+| `/home/g/dev/vendor/cache-fix-pr12` | `pr/insertion-join-moves` | `fbec02f` | new branch: `b713b2f` + merge of `a0a051f` + 7 commits |
+
+Both merge cleanly onto `upstream/main` (`0817302`) — `git merge-tree
+--write-tree` exits 0 for each, so no rebase is needed.
+
+---
+
+## STOP — decide this before step 1
+
+The two harvested fixtures these branches carry contain material that the OPEN
+sanitization blocker on #272 is about. **Both are already on `origin/main`** (so
+they are already public in the fork), but pushing them into an upstream-facing PR
+extends the exposure into `cnighswonger`'s repo while that blocker is unresolved,
+and #272's reviewer explicitly asked us not to move on fixture sanitization
+before agreeing a path.
+
+1. **`test/fixtures/harvested/reset-move-s-dc3f8071-196-197.json` embeds a real
+   screenshot, five times.** Five identical `image/png` blocks, 13,060 base64
+   chars each (~9.8 kB decoded, 951×55), PNG `tEXt` chunks reading
+   `Creation Time: Mi 29 Jul 2026 16:46:01 CEST` and `Software: gnome-screenshot`.
+   Decoded and viewed: it shows a terminal line of the operator's own prose
+   ("So: when I write PR #184 — do you see just PR #184, or ..."). Benign content,
+   but it is unsanitized real capture, plus a locale + desktop-environment
+   fingerprint and a wall-clock stamp — and the fixture's own `_sanitization`
+   header claims it "keeps no raw text at all". That claim is false as written.
+
+   **Root cause, and it is a tool bug, not a fixture slip:** `tools/harvest.mjs:169`
+   redacts `block.data`, but an Anthropic image block nests the base64 at
+   `block.source.data` — one level below where the scrubber looks. Every image in
+   every harvested fixture passes through raw. The fix belongs in `scrubBlock`
+   (recurse into `source`), and it needs a bite that goes red on this fixture
+   first.
+
+2. **`test/fixtures/harvested/flap-s-0d6f38ba-86.json` retains raw operator hook
+   prose.** Its `_sanitization` header says the participating reminder texts are
+   kept RAW on purpose. Six of the eight raw strings are the operator's own hook
+   text, quoting private files by name — `dispatch-discipline.md §1`,
+   `CLAUDE-maintenance.md Provenance` — and paraphrasing private corpus rules.
+   Only "The task tools haven't been used recently…" is genuine harness text.
+   The *later* `reset-move` fixture's header states it deviated from this
+   precedent for exactly this reason: "two of the three constituents here are the
+   operator's own hook texts rather than harness-generated reminders, so raw
+   retention would put operator prose in a public repo."
+
+   So the fork's own standard, set one day later, is not met by the fixture the
+   verification slice would now carry upstream.
+
+Both fixtures are load-bearing for tests on these branches: `flap-…` is read by
+`test/insertion-join-move.test.mjs` and `test/replay-gate-selfcheck.test.mjs`,
+`reset-move-…` by `test/insertion-join-move.test.mjs`. Dropping them means those
+checks lose their real-capture leg. **This is an operator decision — go / re-scrub
+/ hold — and nothing below should run until it is made.**
+
+Everything else scanned clean on both deltas: no IPv4 or IPv6 literals, no `ssh
+user@host` lines, no non-loopback `host:port`, no absolute user paths, no
+`sk-ant-` / `Bearer` / `ghp_` shapes, no fork-only files
+(`BACKLOG.md`, `FORK-NOTES.md`, `CLAUDE.local.md`, `docs/directives/**`,
+`docs/audits/**`, `docs/code-reviews/**`, `docs/release-tests/**`,
+`test/fixtures/harvested/LEDGER-*.json`).
+
+---
+
+## 1 — push the verification-tools update
+
+```bash
+cd /home/g/dev/vendor/cache-fix-pr4
+git push origin pr/verification-tools
+```
+
+Fast-forward: the 15 new commits sit on top of the pushed `53761a3`, no force
+needed.
+
+## 2 — comment on #276
+
+```bash
+cd /home/g/dev/vendor/claude-code-cache-fix
+gh pr comment 276 --repo cnighswonger/claude-code-cache-fix \
+  --body-file /tmp/claude-1000/-home-g-dev-vendor-claude-code-cache-fix/adf6cadb-d98f-49c5-ae2c-578f4596ca9a/scratchpad/pr-prep-comment-276.md
+```
+
+## 3 — push the new branch
+
+```bash
+cd /home/g/dev/vendor/cache-fix-pr12
+git push -u origin pr/insertion-join-moves
+```
+
+## 4 — open the draft PR
+
+Title and body live in `pr-prep-body-join-moves.md`; the file's first section is
+the title, the rest (from `# BODY`) is the body. Strip the two headers before
+posting, e.g.:
+
+```bash
+SP=/tmp/claude-1000/-home-g-dev-vendor-claude-code-cache-fix/adf6cadb-d98f-49c5-ae2c-578f4596ca9a/scratchpad
+sed -n '/^# BODY$/,$p' $SP/pr-prep-body-join-moves.md | tail -n +3 > $SP/pr-prep-body-join-moves.rendered.md
+
+cd /home/g/dev/vendor/claude-code-cache-fix
+gh pr create --repo cnighswonger/claude-code-cache-fix --draft \
+  --base main \
+  --head Gunther-Schulz:pr/insertion-join-moves \
+  --title "feat(insertion-normalization): un-merge CC's join-moves, and stop a re-served entry from re-binding" \
+  --body-file $SP/pr-prep-body-join-moves.rendered.md
+```
+
+## 5 — cross-link on #272
+
+Not drafted as a separate file; one line is enough, and it should only go up
+after step 4 so it can carry the real number:
+
+> The join-move / reserved-entry work that this branch's pinning made possible
+> is now up as #NNN (draft, stacked on this branch and on #276). It closes the
+> identity mis-binding where one extra copy of a recurring reminder re-binds an
+> entry CC has stopped sending — corpus A/B: stability violations 10 → 2, and
+> both survivors belong to `deferred-tool-rewrite` and are identical in both
+> trees.
+>
+> 🤖 Generated with [Claude Code](https://claude.com/claude-code)
+
+## Cleanup
+
+Both worktrees have an untracked `node_modules` symlink pointing at the fork
+main checkout's, added so the suites could run (`hpagent` etc. are not installed
+per-worktree). Remove if you want the trees pristine:
+
+```bash
+rm /home/g/dev/vendor/cache-fix-pr4/node_modules /home/g/dev/vendor/cache-fix-pr12/node_modules
+```
+
+Note `.gitignore` has `node_modules/` with a trailing slash, so a *symlink* of
+that name shows as untracked rather than ignored. It was never staged.

docs/audits/pr-prep-2026-07-31/pr-prep-body-join-moves.md

@@ -0,0 +1,140 @@
+# TITLE
+
+feat(insertion-normalization): un-merge CC's join-moves, and stop a re-served entry from re-binding
+
+# BODY
+
+> **DRAFT — stacks on #272 and #276, review alongside them.** This branch is
+> cut from #272's head (`b713b2f`) and merges #276's updated head, because its
+> tests assert against `tools/replay.mjs`'s gate functions. Base is
+> `upstream/main`, so the diff shown by GitHub includes both parents' content;
+> the material new to *this* PR is the six commits after the merge. Same
+> precedent as #281.
+
+## What this is
+
+CC sometimes **merges a `<system-reminder>` message and its immediate
+standalone neighbour into a single message** mid-history, then sometimes
+un-merges them again a few requests later. Every one of those flips rewrites
+history the model has already seen, which busts the prefix cache and re-bills
+the whole conversation.
+
+#272 gave the proxy the ability to recognise a message across
+re-serializations and to pin the first-seen bytes. This PR closes the two
+cases that pinning alone could not:
+
+**1. The join-move un-merge.** When we recognise that a message CC used to send
+standalone has been absorbed into its neighbour, we serve the first-seen
+(un-merged) form upstream instead of the newly merged bytes. The join grammar
+is a single `"\n\n"` separator — the same literal the duplicate-suppression
+path already keys on — and the probe is byte-exact: the merged wire message's
+text must equal `pinnedReminderText(predecessor) + "\n\n" + absorbed.text`, both
+messages must be `role: "system"`, and the absorbed entry's neighbourhood
+bounds must resolve on the current wire. Anything else fails closed: no
+substitution, raw forward, today's behaviour.
+
+**2. The identity fix — a re-served entry leaves the wire-identity space.**
+This is the part that took a rebuild rather than a patch. Pinned entries are
+keyed by `(content-hash, role, occurrence-ordinal-within-the-request)`. A
+recognised move keeps the absorbed entry alive in *our* canonical while CC has
+stopped sending it — so its ordinal is a claim about an array it is not in.
+The moment a later request carries **one more copy of the same recurring text**
+(measured: a fresh tail reminder taking `o=7`), the stale entry binds to that
+unrelated copy at an inverted position, which both removes it from the dropped
+set — so no move recognition can fire — and trips the subsequence check. The
+merged message then goes out raw and *our* bytes flip at an index where CC's
+were identical.
+
+The fix marks such an entry `rs: true` and takes it out of `(h, r, o)` matching
+entirely. Its identity becomes its stored first-seen bytes plus the canonical
+slot where we last forwarded them. Each request it gets exactly one of three
+dispositions, checked in order: **re-fire** (the merged form is present again →
+re-serve), **reclaim** (CC flipped back to the original form → clear the mark
+and rebind as an ordinary matched entry), **lapse** (neither form present → the
+entry is dropped, never re-served into a region CC no longer carries). Entries
+that were never re-served keep absolute `(h, r, o)` matching byte-for-byte.
+
+## Measured — A/B over the live corpus
+
+Two detached worktrees differing only by this diff, replayed over 8.5 GB of
+real capture (36 captures, ~10 000 requests) under the serving gate set:
+
+| capture | before | after | requests (identical both runs) |
+|---|---|---|---|
+| s-dc3f8071 | 2 | **0** | 769 |
+| s-58c979ce | 2 | **0** | 2073 |
+| s-633915a8 | 2 | **0** | 2630 |
+| s-9f9d8a9d | 1 | **0** | 209 |
+| s-0d6f38ba | 3 | **2** | 1058 |
+| **corpus total** | **10** | **2** | |
+
+Cross-request byte-stability violations go **10 → 2**, and the two survivors
+are attributed by the gate's own attribution line to a *different* extension
+(`deferred-tool-rewrite`) and are byte-for-byte the same two pairs in both
+trees. **Zero insertion-normalization stability violations remain in the whole
+corpus.** Safety, conservation, sequence and canonical order read 0 on every
+capture in both trees.
+
+Worth stating plainly: the same ordinal collision was firing on **four**
+captures, not the one it was found on. That only became visible because the
+measurement was corpus-wide rather than fixture-wide.
+
+Two honesty notes about the sweep as an A/B. The capture *count* differs (33 vs
+36) — three tiny captures (2, 13 and 1 requests) were present only for the
+second run, all clean, none in the failing set. And several captures are live
+and still growing, so two sequential 8 GB sweeps are confounded in principle —
+but the per-capture request counts are identical for every capture in the table,
+so for the captures the comparison is about, both trees replayed the same input.
+
+**Old-canon compatibility** was measured, not argued: `tools/verdict-ab.mjs
+--seed-from-a` replays decisions over canon files written by the pre-change
+code and is **identical across 44 verdict lines / 6 corpora**. `rs` is a new
+optional field; canon files from the old code contain none, and under the new
+code they take identical decisions. A restart shipping this is
+cache-transparent for every existing conversation.
+
+## Non-Functional Requirements
+
+- **Size/complexity budget.** ~590 added lines in
+  `proxy/extensions/insertion-normalization.mjs` (no new production file, no
+  new abstraction, no new env var — it extends `classifyPinned`,
+  `resetKeepingPins` and `findJoinMoves` in place). The originating directive
+  budgeted 120–200 LOC; the overrun is the reconciliation with #272's
+  reset-path duplicate suppression, which had to unify two declaration paths
+  rather than add a second one. Tests: ~1,170 lines across three files, plus a
+  20.6k-line harvested fixture — see the fixture caveat below.
+- **Threat model.** Conversation fidelity is the protected property; the
+  conservation and stability gates are the enforcement. The new risk this
+  design introduces is re-serving stored bytes into a context CC has pruned or
+  compacted away. The lapse disposition is the mitigation and it fails **closed**
+  — no re-serve — whenever its preconditions are not byte-established on the
+  current wire. No new persisted state shape beyond `rs`, one optional boolean
+  on an existing entry.
+- **Maintainability.** The join grammar stays single-copy (`JOIN_SEPARATOR`);
+  the merged-form probe is the same literal the duplicate suppression already
+  uses, seen from the other side.
+- **Performance/reliability.** The disposition pass is O(reserved entries ×
+  neighbourhood) per request; reserved entries measured at 1–2 per conversation
+  in every observed instance.
+- **Load-bearing? YES.** It changes canonical state entries and the bytes
+  forwarded on the wire.
+
+## Open, and inherited from #272
+
+- **#272's four blockers are not addressed here.** In particular the
+  reminder-only-edit case (blocker 1) and the canon-file permissions (blocker 3)
+  are properties of the base this branch sits on. Whatever lands there lands
+  here.
+- **`test/proxy-read-dedupe.test.mjs:505` is red on this branch**, exactly as it
+  is on #272 — the extension-order adjacency assertion. Reproduced at #272's
+  head before any commit here: 41/42 on that file alone. Left for the
+  deliberate fix #272's review asked for (move the order, or update the
+  assertion) rather than patched in a stacked PR.
+- **Fixture sanitization is an open question, not a settled one.** This branch
+  carries `test/fixtures/harvested/reset-move-s-dc3f8071-196-197.json` (the
+  reset leg) and, via the #276 merge, `flap-s-0d6f38ba-86.json` (the
+  oscillation leg). #272's review flagged the harvested-fixture class as a
+  blocker and asked us to agree a path before pushing changes. Neither fixture
+  should be treated as reviewed on that axis by this PR.
+
+🤖 Generated with [Claude Code](https://claude.com/claude-code)