chore: TODOS.md — strike the six wave-fixed residuals, add two follow-ups

The v1.67 adversarial-review residuals section shrinks to the one item the
wave couldn't reach (iOS tap routing — needs real-device verification). New
entries: skillify structural isolation (a prose warning is not a boundary for
page-derived generated code) and the slug store migration (pre-fix sessions
on stray-marker machines filed data under the degraded slug; post-fix reads
go to the correct store, so history needs a merge/alias).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

TODOS.md

@@ -47,37 +47,17 @@ wave"). Each was explicitly deferred with rationale, not dropped:
 
 ### P2: v1.67 adversarial-review residuals (verified, deferred with rationale)
 
-Filed at v1.67 ship time from the Codex + Claude adversarial passes. Each was
-verified real but needs design input or device access the wave lacked:
+Filed at v1.67 ship time from the Codex + Claude adversarial passes. Six of
+the seven landed in the v1.68 fix wave (brain-sync spool-dir queue, pair-agent
+consent gate, bin-context walk-up parity, per-project MCP scoping +
+precedence flip, next-version ls-remote fallback + width pin, stop-hook
+global-path registration + re-point). Remaining:
 
-- **brain-sync enqueue lock** — the drain's surgical rewrite closes the reader
-  side, but a lockless producer appending between the live re-read and the
-  tmp+mv can still orphan one record. Needs a shared enqueue/drain lock
-  (mkdir-style, like the drain's). Effort S.
 - **iOS tap routing across windows** — Bridges template's frontmostWindow can
   swallow taps when a keyboard/menu/transparent overlay window is topmost but
   doesn't handle the coordinate. Needs hit-test-aware routing + real-device
   verification. Effort M. (Related: the multi-window rewrite has no static
   pins — see the test-gap backlog below.)
-- **pair-agent implicit --force-restart** — pair-agent auto-kills a healthy
-  headless daemon (tabs/cookies) with no consent, contradicting the #2219
-  iron rule it now sits beside. Needs a consent prompt or explicit-flag
-  requirement; UX call. Effort S.
-- **bin-context slugFromEnvironment walk-up parity (win32)** — the native
-  fallback slugs the INNERMOST repo while bash gstack-slug walks to the
-  outermost canonical remote; nested/vendored repos split stores. Effort S.
-- **hasRemoteOnlyGbrainMcp is machine-global** — one project's remote gbrain
-  registration reclassifies broken local engines as thin-client everywhere;
-  also confirm Claude Code's user-vs-project MCP precedence against
-  brain-cache's user-first assumption. Effort S.
-- **next-version git-fallback breadth** — the degraded path counts every
-  remote-tracking ref on every remote (stale experiment branches inflate the
-  allocation) and a failed 3-digit base read flips width to 4. Warned today;
-  tighten to origin + width-pin. Effort S.
-- **Stop-hook registration pins the setup-time absolute path** — registering
-  from a dev worktree bakes that path into settings.json; deleting the
-  worktree leaves a dead hook erroring on every session stop until removed.
-  Register the global-install path or re-point on upgrade. Effort S.
 - **Accepted threat-model notes (documented, no action planned):**
   redact-prepush treats content pushed to ANY private remote as already-left
   (accident-only threat model); a parcel-shaped twin within 400 chars can
@@ -85,6 +65,37 @@ verified real but needs design input or device access the wave lacked:
   codex-probe's 400-signature grep can misread a transient proxy 400 as
   MODEL_UNUSABLE (bounded by the 15-min negative-cache TTL).
 
+### P2: skillify structural isolation (filed from the v1.68 wave reviews)
+
+**What:** /skillify turns scraped page content into durable executable skill
+code on disk. The v1.68 wave added the untrusted-content warning to its prose
+(#2441), but a warning is not a boundary — generated actions derived from
+hostile page content need structural isolation, sanitization of synthesized
+selectors/names, or an explicit approval step scoped to the generated code.
+
+**Why:** A poisoned page could steer the generated script.ts toward actions
+the user never reviewed; the current gate is the Step 9 approval, which shows
+the code but doesn't highlight page-derived strings.
+
+**Effort:** M → S with CC. **Priority:** P2. **Depends on:** none.
+
+### P2: slug store migration — merge pre-fix `projects/garrytan/` data (v1.68 follow-up)
+
+**What:** The v1.68 slug-parity fix (gstack-slug now matches remote-slug's
+owner-repo form) means machines that hit the degraded-slug bug (stray strong
+marker above a repo, e.g. an empty ~/.git) have historical decisions /
+timeline / ceo-plans / learnings filed under the marker-basename store
+(observed: `~/.gstack/projects/garrytan/`) instead of per-repo stores. Define
+and ship the merge/alias: attribute each misfiled record to its repo where
+derivable (timeline entries carry branch; decisions carry scope), else leave
+in place with a pointer file.
+
+**Why:** Post-fix sessions read the CORRECT store, so pre-fix history is
+invisible to Context Recovery until migrated.
+
+**Effort:** M → S with CC. **Priority:** P2. **Depends on:** the v1.68 wave
+(shipped the fix + parity tests).
+
 ### P2: v1.67 coverage-audit test-gap backlog (5-agent sweep, ranked)
 
 The wave's Step-7 coverage audit (5 subsystem agents, ~700 changed paths,