Reasoning replay treated a changed history as proof that a cached thought signature had become invalid, so a drifted context or a ledger miss dropped the signature and left the call on the bypass sentinel. Once that happened the damage cascaded: every later ledger item verifies its contextHash against the restored bytes of all preceding contents, so one broken link cost the whole tail of the conversation its reasoning. Testing the assumption directly against daily-cloudcode-pa.googleapis.com shows it does not hold. Gemini validates a thought signature's own integrity and nothing else -- corrupting one byte returns "Corrupted thought signature", while changing the system instruction, adding a tool, rewriting an earlier call's args, rewriting a tool result, or swapping two turns' signatures are all accepted. Only the newest functionCall group has to carry a signature at all, and the bypass sentinel satisfies that. Keeping the signature is worth doing rather than merely harmless: on an otherwise identical request, replacing every signature with the sentinel raises thoughtsTokenCount from 11-15 to 41-53, so a broken chain makes the model re-reason from scratch. Restore the signature on the identity-only path, and stop deleting the client's in-band signature while degrading unresolved provenance IDs. Argument integrity is unaffected: that is the opaque digest ID's job, not the signature's.