fix: pre-landing review round — 8 auto-fixes + 8 accepted findings hardened

The ship review army (4 specialists + red-team + checklist, 29 findings)
produced 8 mechanical auto-fixes and 11 decisions; the accepted set:

- win32 slug parity completed: lib/bin-context.ts gains the remote-first
  outermost walk + degraded-cache self-heal the bash side got this wave —
  the two implementations now agree on the stray-marker live-bug shape,
  pinned by shared fixtures (multi-specialist 9/10 finding).
- probe honors the plan's bounded-read decision: 256KB prefix, extraction
  semantics mirrored from parseTranscriptJsonl so probe/prepare can never
  diverge on the same file (>1MB transcript test).
- policy normalize parity: bash normalize() now matches canonicalizeRemote
  on .git/-trailing and uppercase-.GIT shapes (7-shape corpus pinned two
  ways) — a deny for those shapes could previously slip the transcript gate.
- session-update reclaim is TOCTOU-safe (atomic mv-aside on both branches).
- settings-hook: unparseable settings.json errors instead of being replaced
  with {}; ensure-event keys on (event, source) so matcher changes update
  in place — never zero or two registrations.
- dot-only slug guard at both parse sites (hostile 'url = ..' can't escape
  projects/); enqueue tmp-file janitor (1h TTL, inside the drain lock);
  brain-sync .migrating never clobbered; drop-queue/status count .migrating;
  snapshot -o warning correct + surfaced in diff mode; version-bump test
  order-dependence removed; uninstall clears the advance stamp.

Deferred with record: slug heal-probe cost sentinel (P3 TODO), FF_OK
conflation (noted, misdiagnosis-only).

270 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-memory-ingest.ts

@@ -1077,17 +1077,6 @@ export function readNewFailures(
 
 // ── Main ingest passes ─────────────────────────────────────────────────────
 
-/**
- * Lightweight attribution check: does a transcript have a resolvable git
- * remote for its cwd? Extracts the cwd from the first JSONL line that has
- * one (mirroring the logic in parseTranscriptJsonl) and calls
- * resolveGitRemote. Avoids the full parse (body rendering, message counting)
- * because probe only needs the yes/no answer.
- *
- * Non-transcript types (artifacts) always pass — the attribution filter in
- * preparePages only applies to transcripts (#2394).
- */
-
 /**
  * The ONE attribution gate (#2394): a transcript is attributable iff its cwd
  * resolves to a git remote. Both probeMode (via transcriptIsAttributable) and
@@ -1099,32 +1088,75 @@ function sessionIsAttributable(cwd: string | undefined | null): boolean {
   return resolveGitRemote(cwd) !== "";
 }
 
+/**
+ * Bounded prefix for the probe's cheap-parse (plan C7): transcripts run to
+ * tens of MB, and the probe only needs the cwd, which both agent formats put
+ * on the FIRST records. 256KB is orders of magnitude past any real header.
+ */
+const TRANSCRIPT_PROBE_MAX_BYTES = 256 * 1024;
+
+/**
+ * Lightweight attribution check: does a transcript have a resolvable git
+ * remote for its cwd? Reads a BOUNDED prefix (first 256KB, never the whole
+ * file — plan C7: the probe must stay a cheap parse on multi-MB transcripts),
+ * extracts the cwd with EXACTLY parseTranscriptJsonl's rules, and calls
+ * resolveGitRemote. Avoids the full parse (body rendering, message counting)
+ * because probe only needs the yes/no answer.
+ *
+ * Extraction MIRRORS parseTranscriptJsonl (the single source of truth for
+ * cwd semantics — keep the two in lockstep):
+ *   - the first PARSEABLE line decides the format (Codex: type=session_meta
+ *     or payload.id; else Claude Code);
+ *   - Codex cwd comes from that FIRST record ONLY (payload.cwd || cwd) —
+ *     a cwd appearing only on a later record is NOT used, exactly as
+ *     parseTranscriptJsonl ignores it, so probe and prepare can never
+ *     diverge on the same file;
+ *   - Claude Code cwd comes from the first record that carries one;
+ *   - unparseable lines are skipped (the truncated-tail case included).
+ *
+ * Non-transcript types (artifacts) always pass — the attribution filter in
+ * preparePages only applies to transcripts (#2394).
+ */
 function transcriptIsAttributable(path: string): boolean {
   let raw: string;
   try {
-    raw = readFileSync(path, "utf-8");
+    const fd = openSync(path, "r");
+    try {
+      const buf = Buffer.alloc(TRANSCRIPT_PROBE_MAX_BYTES);
+      const n = readSync(fd, buf, 0, buf.length, 0);
+      raw = buf.toString("utf-8", 0, n);
+    } finally {
+      closeSync(fd);
+    }
   } catch {
     return false;
   }
   const lines = raw.split("\n").filter((l) => l.trim().length > 0);
   if (lines.length === 0) return false;
 
-  // Detect format: Codex first line has type=session_meta, Claude Code
-  // has cwd on a user/assistant record.
   let cwd = "";
+  let sawFirstParseable = false;
   for (const line of lines) {
+    let rec: any;
     try {
-      const rec = JSON.parse(line);
-      if (rec?.type === "session_meta") {
+      rec = JSON.parse(line);
+    } catch {
+      continue; // mirrors parseTranscriptJsonl: unparseable lines are skipped
+    }
+    if (!sawFirstParseable) {
+      sawFirstParseable = true;
+      // Format detection mirrors parseTranscriptJsonl's `first` record check.
+      const isCodex = rec?.type === "session_meta" || rec?.payload?.id != null;
+      if (isCodex) {
+        // Codex: cwd comes from the session_meta FIRST record only.
         cwd = rec.payload?.cwd || rec.cwd || "";
         break;
       }
-      if (rec?.cwd) {
-        cwd = rec.cwd;
-        break;
-      }
-    } catch {
-      continue;
+    }
+    // Claude Code: first record with a cwd wins (the first record included).
+    if (rec?.cwd) {
+      cwd = rec.cwd;
+      break;
     }
   }
   if (!cwd) return false;