v3.2.3

Normalize uses one predictable private location for new rewrite backups.

Changed

• New backups use Agent Helm/normalize/<run-id>/ under the OS user’s home directory. Earlier backups and registered handoffs remain usable.
• Acceptance checks cover the fixed recovery location and reject non-private destinations.

Full changelog