fix: sanitize malformed thinking blocks before Anthropic serialization

[Michael J. Jabbour (michaeljabbour)]

Problem

Cross-provider sessions persist thinking-shaped blocks that the Anthropic API rejects on resume, causing 400 errors and bricked sessions. Two different producers have been observed creating malformed thinking blocks:

• Chat-completions producer: wraps reasoning_content in ThinkingBlock(signature: null)
• OpenAI Responses producer: generates thinking blocks with empty thinking field and missing/null signature

When these blocks persist into session history and get replayed to Anthropic on resume, strict validation fails with a 400 that terminates the session (real incidents from both producers confirmed).

Solution

Added _sanitize_thinking_blocks(messages) staticmethod in the shared request-construction path (_complete_chat_request, before _apply_message_cache_control). This method:

• Strips thinking blocks lacking a valid non-empty string signature
• Inserts a placeholder message if a message would empty
• Preserves valid thinking and redacted_thinking blocks unchanged
• Never raises exceptions (per-message try/except with logger.exception fallback)
• Emits WARNING log + provider:thinking_blocks_sanitized event
• Inherited by Fable subclass automatically (runs before cache logic)

Accuracy note: A hypothetical thinking block missing the thinking key entirely is structurally unreachable—amplifier_core.message_models.ThinkingBlock requires thinking by schema, and real producers always set it. The sanitizer targets only the shapes that actually reach the provider in practice.

Testing

• 19 new test cases covering both malformed shapes, placeholder insertion, mixed content, no-mutation guarantees, and defensive never-raise behavior
• Test suite: 545 passed, 3 pre-existing unrelated failures (test_tool_repair.py streaming mock issue, present on main)
• DTU end-to-end: An isolated environment injected a transcript with both malformed shapes and resumed successfully with Stripped 2 thinking block(s)… logged to stderr. Previously a guaranteed 400.

Compatibility

• No changes to mount(), complete(), or other public contracts
• Merges cleanly with the effort-clamp PR (fix/289) — disjoint init.py regions, validated in combined DTU test

Fixes microsoft-amplifier/amplifier-support#207