Local tokenization does not always agree with the input_length the provider reports, which left the release row carrying a block count derived from our own count. Truncate or pad digest_hexes to the block count implied by the provider value. Padding digests are derived per request, so a padded block can never collide with another request and be scored as shared prefix reuse.