Review r1 P2-01: the only fragment case had '?' before '#', so degrading stripURLQuery to cut '?' alone stayed green and the '#'-first branch was unpinned. Add a scheme-less '#access_token=...' case (OAuth implicit flow shape) and correct the mutation comment to state which case each mutation actually kills.