docs(code-reviews): two real session UUIDs leaked on main via PR #299 review artifacts

[vsits-proxy-builder]

Verified — Measured

Two real session UUIDs are on main in docs/code-reviews/, used as example arguments in commands Codex quoted in the PR #299 review:

• docs/code-reviews/pr-299-round-1-codex.md:16 — c8e70b6e-7ef4-40b6-9762-33b1e8a64236 (in ~/.claude/projects/*/<uuid>.jsonl command output demonstration)
• docs/code-reviews/pr-299-round-1-codex.md:21 — a27d470e-2b89-4077-9475-6de4fc347c14 (same shape, different session)
• docs/code-reviews/pr-299-round-2-codex.md — both of the above reappear (Codex quoted the round-1 evidence in round 2)

Landed in c8f7bb8 (2026-08-02, #299 code-review artifacts). Not sensitive on their own (no credentials, no tokens, no request contents) — the exposure class is correlation with capture-derived transcripts, same category as #292. Surfaced by tools/absence-scan.mjs from #276 as part of that PR's own test suite when it was rebased onto current main — the scanner found the leak in our tree first.

Why this is filed separately from #292

• test/fixtures/cc-transcript-shape-snapshot.json carries capture-derived identifiers (public history) #292 is a test-fixture leak (test/fixtures/cc-transcript-shape-snapshot.json) awaiting @Gunther-Schulz's rebuild PR.
• This is a docs leak (code-review artifacts committed as part of PR review workflow). Different file class, different remediation path.
• Both share the "capture-derived identifier reached a public commit" root — the pre-publication guards directive (#302) covers the class going forward. That directive's implementation would have caught this at pre-push.

Remediation

Same pattern as #292: history can't be scrubbed (public repo, immutable git history), so the practical fix is forward-looking replace-with-synthetic in the current file. The two UUIDs are burned; treat them as public.

Concrete edit:

• Replace both UUIDs in both files with synthetic session ids matching the shape (00000000-0000-4000-8000-*). The commands still demonstrate what they need to demonstrate — the value of the UUID is that it's a plausible session id, not that it's my session id.
• Add a note at the top of both files explaining the synthesized-not-redacted convention, so future code-review authors know the pattern.
• Consider a docs/code-reviews/README.md (or CONTRIBUTING.md clause) reminding review authors to tokenize any UUIDs in command examples before commit.

Not this issue

• The upstream guard (a pre-commit or pre-push hook that catches this at authoring time, not review time) is docs: directive for pre-publication guards against capture-derived data #302's scope.
• The scanner improvements (widen SCANNABLE to source, add SOURCE_SCANNABLE, boundary-anchor the NAME_UUID_PREFIX regex) are feat(tools): the verification stack — replay gate, census, harvest, scheduled sweep #276's scope.

Credit

Found by tools/absence-scan.mjs from @Gunther-Schulz's #276, running against main for the first time after his rebase. His comment on that PR (#276#issuecomment-…) refused to add an exemption for these files — which was the correct call and the reason this defect is now visible.

— Proxy Builder