fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-settings-hook

@@ -104,7 +104,7 @@ case "$ACTION" in
           hooks: [{ type: "command", command: hookCmd }]
         });
       }
-      const tmp = settingsPath + ".tmp";
+      const tmp = settingsPath + ".tmp." + process.pid; // per-process: parallel writers must not share a tmp
       fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
       fs.renameSync(tmp, settingsPath);
     '
@@ -130,7 +130,7 @@ case "$ACTION" in
         if (settings.hooks.SessionStart.length === 0) delete settings.hooks.SessionStart;
         if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
       }
-      const tmp = settingsPath + ".tmp";
+      const tmp = settingsPath + ".tmp." + process.pid; // per-process: parallel writers must not share a tmp
       fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
       fs.renameSync(tmp, settingsPath);
     ' 2>/dev/null
@@ -218,7 +218,19 @@ case "$ACTION" in
         return sameMatcher && sameCommand;
       };
 
-      let existing = settings.hooks[event].find(matchesEntry);
+      // Collect ALL matches, not just the first: pre-existing installs can
+      // carry two entries with the same (event, _gstack_source) from the old
+      // matcher-keyed dedup. `.find()` updated only the first and left the
+      // stale twin running forever. Keep ONE canonical entry (the first),
+      // remove the rest in the same atomic write.
+      const matched = settings.hooks[event].filter(matchesEntry);
+      let existing = matched.length > 0 ? matched[0] : undefined;
+      let collapsed = 0;
+      if (matched.length > 1) {
+        const extras = new Set(matched.slice(1));
+        settings.hooks[event] = settings.hooks[event].filter((e) => !extras.has(e));
+        collapsed = matched.length - 1;
+      }
       const hookEntry = { type: "command", command: cmd };
       if (timeoutRaw) {
         const n = Number(timeoutRaw);
@@ -270,7 +282,10 @@ case "$ACTION" in
         // Atomic tmp+rename: the settings file is either the old JSON (with
         // the old single registration) or the new JSON (with the replaced
         // one) — a failed update can never leave zero or two registrations.
-        const tmp = settingsPath + ".tmp";
+        // Per-process tmp suffix: a fixed settings.json.tmp let two parallel
+        // writers consume one another. (No apostrophes here: this JS lives
+        // inside a bash single-quoted string.)
+        const tmp = settingsPath + ".tmp." + process.pid;
         fs.writeFileSync(tmp, after + "\n");
         fs.renameSync(tmp, settingsPath);
       } catch (e) {
@@ -280,6 +295,9 @@ case "$ACTION" in
         console.error("error: could not update " + settingsPath + ": " + (e && e.message ? e.message : e));
         process.exit(1);
       }
+      if (collapsed > 0) {
+        console.error("collapsed " + collapsed + " duplicate (event, source) hook entr" + (collapsed === 1 ? "y" : "ies") + " for " + event + " (source: " + source + ")");
+      }
       if (ensure && existing) {
         console.log("OK: " + event + " hook re-pointed (source: " + source + ")");
       } else {
@@ -318,7 +336,7 @@ case "$ACTION" in
         if (settings.hooks[event].length === 0) delete settings.hooks[event];
       }
       if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
-      const tmp = settingsPath + ".tmp";
+      const tmp = settingsPath + ".tmp." + process.pid; // per-process: parallel writers must not share a tmp
       fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
       fs.renameSync(tmp, settingsPath);
       console.log("OK: removed " + removed + " hook entry/entries tagged source=" + source);