Step 6: extract Cache & Scans + Duplicate Review from options.js

Splits the 3133-line options.js into three vanilla scripts loaded in
order at the bottom of options.html:

  options-cache.js        161 lines  (Cache & Scans block)
  options-dupe-review.js  616 lines  (Duplicate Review + Keep Ranking)
  options.js             2356 lines  (everything else)

No behavior change. Cross-file references work because classic <script>
tags share the global declarative environment: top-level `let` bindings
in options-cache.js (_configuredScanRoots, _cacheSkippedByRemote) are
visible by bare reference in options.js, where Library Issues still
reads them. Calls into options.js from the extracted files
(escapeHtml, openModal/closeModal, keepActionViewport,
clearNativeRepairCard, renderNativeMessagingFailure) all occur inside
event handlers, resolved at call time after options.js parses.

node --check passes on each file individually and on the concatenation
of all three in load order. Brace counts balanced.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

AGENTS.md

@@ -135,12 +135,13 @@ Done in rc-jav catalog loading. Catalog CSV/XML paths are normalized from Window
 2. **CSS extracted from options.html.** Embedded `<style>` block moved to `options.css`, linked via `<link rel="stylesheet">`. options.html went 1179 → 794 lines. Inline `style="..."` attributes intentionally left for later (step 6 territory).
 3. **Transfer Assistant wizard deleted.** "Setup & Transfer" pane renamed to "Setup". Replacement: Extension ID display + Copy button added to Diagnostics → Native host registration fieldset (always visible, not failure-gated). Sidebar entry, fieldset, modal, and ~107 lines of JS removed.
 5. **Recent Activity + Search Troubleshooting moved to new Debug Tools pane.** Verified Recent Activity is search-trigger-only by reading `background.js` — `recordActivity()` is NOT called from `delete-file` handler. No audit-value split needed. New sidebar entry "Debug Tools" under System group; new `pane-debug` houses both fieldsets.
+6. **options.js split — Cache & Scans + Duplicate Review paired extraction.** `options.js` 3133 → 2356 lines. New files: `options-cache.js` (161 lines, Cache & Scans block), `options-dupe-review.js` (616 lines, Dup Review + Keep Ranking incl. bottom `loadKeepRanking()` call). Script-tag order in `options.html`: cache → dupe-review → options.js (body bottom). Cross-script binding visibility (vanilla classic scripts share global declarative env): Library Issues code still in options.js reads `_configuredScanRoots` / `_cacheSkippedByRemote` / calls `rememberConfiguredScanRoots` from cache file by bare reference. Calls to `escapeHtml` / `openModal` / `closeModal` / `keepActionViewport` / `clearNativeRepairCard` / `renderNativeMessagingFailure` from extracted files all occur inside event handlers (resolved at call time, after options.js parses). Repo `git init`'d before this step; baseline commit `f8e781f` is the rollback point. Verified by `node --check` on each file and on concatenated script.
 
-(Step 4 in the plan is a paired-extraction sub-task of step 6; not a separate ship.)
+(Step 4 in the plan is a paired-extraction sub-task of step 6; folded into step 6 ship.)
 
 **Pending (in execution order):**
 
-- **Step 6 — options.js split, Cache & Scans + Duplicate Review paired.** Biggest, riskiest step. `options.js` is currently 3133 lines. Pair these two together because Dup Review reads cache state — extracting one while the other stays in monolith creates cross-module gap. Continue with Debug Tools, Library Issues, Settings sub-tabs after the pair lands.
+- **Step 6b — continue options.js split with Library Issues, Debug Tools handlers, Settings sub-tabs.** Library Issues is the next obvious ~450-line block (lines 1505–1957 in pre-split numbering, now in options.js mid-section). Reads `_configuredScanRoots` and `_cacheSkippedByRemote` from `options-cache.js` — cross-file binding already exercised, so the extraction is lower risk than the first pair.
 - **Step 7a — Bulk Check standalone window.** New `bulk-check.html` opened as detached `chrome.windows.create({ type: 'popup', width: 640, height: 540 })` from a "Bulk Check" launcher button in the popup. Single canonical entry path — NOT a Console sidebar tab. Window dedup via `chrome.storage.session`, last-paste persisted via `chrome.storage.local`.
 - **Step 8 — Shared fixture corpus.** Top-level `D:\DEV\Project\rclone-jav\fixtures\` (neutral location, NOT inside Python or extension repo). JSON cases for query-ID extraction (extension), filename ID extraction (Python), shared normalization.
 - **Step 9 — Cache contract design.** CACHE_VERSION already exists (currently 3). Add ID_RULES_VERSION concept: schema bump = force rebuild, rules bump = warn-and-mark-stale.