fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-question-log

@@ -71,7 +71,10 @@ if (!j.question_id || !/^[a-z0-9-]+\$/.test(j.question_id) || j.question_id.leng
 //   'auq-other'        — user picked 'Other' and typed free text (Layer 8)
 //   'auto-decided'     — PreToolUse enforcement hook substituted the answer (T6)
 //   'codex-import-marker' / 'codex-import-pattern' — T9 backfill from Codex
-const ALLOWED_SOURCES = ['agent', 'hook', 'auq-other', 'auto-decided', 'codex-import-marker', 'codex-import-pattern'];
+//   'spawned-env-deny'  — spawned-session AUQ deny (#2733): the model, not a
+//                         human, resolves the gate; tagged so /plan-tune never
+//                         trains on machine picks as if a human made them
+const ALLOWED_SOURCES = ['agent', 'hook', 'auq-other', 'auto-decided', 'codex-import-marker', 'codex-import-pattern', 'spawned-env-deny'];
 if (j.source !== undefined) {
   if (!ALLOWED_SOURCES.includes(j.source)) {
     process.stderr.write('gstack-question-log: invalid source, must be one of: ' + ALLOWED_SOURCES.join(', ') + '\n');

bin/gstack-session-kind

@@ -29,14 +29,7 @@
 # signals that actually discriminate are the host/orchestrator/CI env markers below.
 set -euo pipefail
 
-# 0. Explicit spawned marker — set per-command by a dispatching skill (e.g.
-#    /ship Step 18 prefixes the document-release subagent's gstack-skill-start
-#    with GSTACK_SESSION_KIND=spawned; #2733: Claude Code subagents inherit
-#    the parent env byte-for-byte, so ambient markers misclassify them as the
-#    parent's kind). Only "spawned" is honored: headless already has
-#    GSTACK_HEADLESS, and letting an env var force "interactive" over CI
-#    markers would be a misclassification footgun. Other values are reserved
-#    and ignored (fall through) — same contract as empty GSTACK_HEADLESS.
+# 0. Explicit spawned marker — full rationale and contract in the header above.
 if [ "${GSTACK_SESSION_KIND:-}" = "spawned" ]; then
   echo "spawned"
   exit 0

bin/gstack-skill-start

@@ -61,8 +61,19 @@ _sanitize() { sed -e 's/GSTACK_INSTRUCTION/GSTACK-INSTRUCTION-(stripped)/g' -e '
 
 echo "SKILL_START_PROTO: 1"
 
-_UPD=$("$_BIN/gstack-update-check" 2>/dev/null || true)
-[ -n "$_UPD" ] && printf '%s\n' "$_UPD" | _sanitize || true
+# Session kind resolves FIRST (env-only checks, cheap). Spawned sessions skip
+# the network-bound update-check: its only consumer (the upgrade-flow block)
+# is emission-gated on kind != spawned below, so the work would be discarded —
+# and running it would consume the one-shot just-upgraded marker meant for the
+# next human session (#2733 review).
+_SESSION_KIND=$("$_BIN/gstack-session-kind" 2>/dev/null || echo "interactive")
+case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
+
+_UPD=""
+if [ "$_SESSION_KIND" != "spawned" ]; then
+  _UPD=$("$_BIN/gstack-update-check" 2>/dev/null || true)
+  [ -n "$_UPD" ] && printf '%s\n' "$_UPD" | _sanitize || true
+fi
 
 mkdir -p "$_GH/sessions" 2>/dev/null || true
 touch "$_GH/sessions/$PARENT_PID" 2>/dev/null || true
@@ -83,9 +94,20 @@ REPO_MODE=""
 eval "$("$_BIN/gstack-repo-mode" 2>/dev/null)" 2>/dev/null || true
 REPO_MODE=${REPO_MODE:-unknown}
 echo "REPO_MODE: $REPO_MODE"
-_SESSION_KIND=$("$_BIN/gstack-session-kind" 2>/dev/null || echo "interactive")
-case "$_SESSION_KIND" in spawned|headless|interactive) ;; *) _SESSION_KIND="interactive" ;; esac
 echo "SESSION_KIND: $_SESSION_KIND"
+# Tamper visibility (#2733 review): a repo-provided settings env block or a CI
+# wrapper could set GSTACK_SESSION_KIND or OPENCLAW_SESSION for a real human's
+# session, silently flipping every gate to auto-choose. Surface the env-driven
+# override loudly, naming the driver, so the transcript shows WHY this session
+# is spawned. Gated on the RESOLVED kind so a broken session-kind fallback
+# never prints a contradictory override line next to SESSION_KIND: interactive.
+if [ "$_SESSION_KIND" = "spawned" ]; then
+  if [ "${GSTACK_SESSION_KIND:-}" = "spawned" ]; then
+    echo "SPAWNED_OVERRIDE: env (GSTACK_SESSION_KIND)"
+  elif [ -n "${OPENCLAW_SESSION:-}" ]; then
+    echo "SPAWNED_OVERRIDE: env (OPENCLAW_SESSION)"
+  fi
+fi
 # Conductor host: AskUserQuestion is unreliable there (native disabled, MCP
 # variant flaky); skills render decisions as prose. Gated on !headless so an
 # eval/CI run INSIDE Conductor still BLOCKs rather than rendering prose to
@@ -99,9 +121,12 @@ _ACTIVATED=$([ -f "$_GH/.activated" ] && echo "yes" || echo "no")
 _FIRST_LOOP_SHOWN=$([ -f "$_GH/.first-loop-tip-shown" ] && echo "yes" || echo "no")
 echo "ACTIVATED: $_ACTIVATED"
 echo "FIRST_LOOP_SHOWN: $_FIRST_LOOP_SHOWN"
-# First-run project detection: only on the first-ever skill run (off the hot path after).
+# First-run project detection: only on the first-ever skill run (off the hot
+# path after). Spawned excluded like headless (#2733 review): spawned sessions
+# never write .activated, so without the exclusion the ~17-subprocess probe
+# would re-run on EVERY spawned start while its only consumers stay suppressed.
 _FIRST_TASK=""
-if [ "$_ACTIVATED" = "no" ] && [ "$_SESSION_KIND" != "headless" ]; then
+if [ "$_ACTIVATED" = "no" ] && [ "$_SESSION_KIND" != "headless" ] && [ "$_SESSION_KIND" != "spawned" ]; then
   _FIRST_TASK=$("$_BIN/gstack-first-task-detect" 2>/dev/null || true)
 fi
 printf 'FIRST_TASK: %s\n' "$_FIRST_TASK" | _sanitize