The check runs before the model emits a token, so a 400 here is deterministic rather than flaky [1]. A retry loop will reproduce it faithfully for as long as you care to fund it. The token counting endpoint applies the same verification [2], which makes it the cheap place to reproduce a mismatch. Read the error path before anything else: `messages.5.content.0` names the first thinking block that no longer matches, and the message can additionally name the first changed message, which is the diagnostic worth logging [3].
What the signature covers is wider than the word "history" suggests. It records the model that produced the block, the top-level system prompt, the `tools` array, every message in front of it, and a link to the previous thinking block, and the API compares that prefix byte for byte when the transcript comes back [4]. Updating the current date in a system prompt is therefore an edit [5]. So is adding or removing a tool mid-session [6], injecting a per-turn reminder or a remaining-token line that you strip on the next request [7], and serving an image by a URL that later returns different bytes, since the binding is to the bytes and not the URL string; a rotated signed URL that returns identical bytes still validates [8].
Deletion is asymmetric. A leading run of thinking blocks can be dropped, oldest first, while a block in the middle cannot be removed if you want to keep the ones after it [9]. That falls out of the chaining: each block commits to everything ahead of it, so shortening the front of the chain is expressible and cutting into its middle is not [25].
The parameters outside the signed surface are still yours: `max_tokens`, `output_config` including `effort`, `tool_choice`, `metadata`, and adding, moving or removing `cache_control` [10]. New instructions go into appended `role: "system"` messages instead of edits to the old system prompt [11], and expired turn-scoped messages stay in place rather than being pruned [12]. Server-side compaction and context editing stay valid even when they delete thinking blocks, because the API validates the conversation as you sent it, before the server rewrites it, and after compaction the check starts from the compaction block [13]. Client-side compaction that keeps recent turns verbatim behind a summary is precisely the pattern that fails [24].
The error text names two remedies, and both cost you the reasoning you were preserving: remove the offending block, or set `thinking.block_binding.prefix_mismatch_behavior` to `drop_block` with the value `thinking-binding-controls-2026-08-01` in the `anthropic-beta` header [19][26]. Finding out whether your account enforces takes one request with edited history and no beta header; a 400 that names that header means enforcement is on [14]. If the message lacks the clause about being bound to a different conversation, `prefix_mismatch_behavior` does not apply, and the signature itself is altered or cannot be decrypted [18].
One caution on provenance. These four write-ups are the same guide in four languages, each citing Anthropic's preserved thinking documentation and the What's new in Claude Fable 5.1 page, where the check is described as the third of three breaking changes and the only one that can degrade a harness quietly [15]. Read it as one account of the docs, not four confirmations. Three conditions decide whether the number transfers to you: the account was created on or after 31 August 2026 [16]; your code assembles the `messages` array itself rather than going through Claude Code or the Agent SDK [17][21]; and you replay thinking blocks instead of stripping them out [19].
