audit: use the transcript's own markers for what the human actually sent

[EdbertChan]

Two shapes were each counted as a second human message.

A line carrying two slash commands writes the same command-args twice; the
transcript marks the second row stackedExpansion, and both skill bodies are
already marked isMeta. Typing while the agent is busy writes an enqueue row
and, minutes later, a delivery row with identical text; the gap between them
read as the user re-sending in frustration.

Both are now dropped by those markers rather than by a timing guess. On the
session that motivated this: 8 of 23 flagged with a verbatim-repeat becomes
7 of 22 with none.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01KU2pPKob4MJ1NqjsfTNyYJ

Depends-On: #510

---

Note

Low Risk
Changes only how reflect scripts classify Claude transcript rows for counting direct human messages; no runtime auth, persistence, or user-facing API impact.

Overview
Reflect transcript provenance now treats certain Claude transcript rows as non–direct-human using native markers, so audit/intervention logic does not double-count a single user send.

_claude_utterances skips user rows with stackedExpansion, so one submission like /reflect /cat-mode … is one human message (the duplicate command-args expansion is ignored; skill bodies stay isMeta/hook).

New JSONL fixtures and tests cover stacked slash commands, queued enqueue + later delivery, and enqueue-only (undelivered) cases—asserting direct_human_utterances returns a single utterance when include_queue_operations=True for queue shapes (pairing with enqueue normalization already in this module).

^{Reviewed by Cursor Bugbot for commit 9ffcdb1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_95860b49-8e43-48a2-85cc-29f8bf842347)

[EdbertChan]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	hook: a script handed to the user is a claim that it runs	#506
2	audit(token_audit): count "bogus" and "it didn't run" as the same class	#507
3	hook: refuse a quoted command string passed through a login shell	#508
4	gate: a branch taken per operating system needs a test that injects one	#509
5	audit(token_audit): one submission carrying two slash commands is one message	#510
6	audit: use the transcript's own markers for what the human actually sent	#511	👈