fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/bin-context.ts

@@ -129,12 +129,16 @@ export function outermostRemoteRepo(startDir: string): { root: string; url: stri
  *      - old-bug shape (#1125): cached value equals basename(cwd) while the
  *        walk-up says cwd is NOT the project root; that cache came from the
  *        pre-walk-up resolver, so recompute and heal.
- *      - degraded-ancestor shape (2026-08-17): cached equals the marker root's
- *        basename while a remote-bearing repo BELOW the marker root exists —
- *        the pre-remote-first resolver degraded to a stray ancestor's basename
- *        (stray empty ~/.git → SLUG=<username>). Legit #2212 stickiness is
- *        safe: there the repo that adopted the remote IS the marker root
- *        (remote root == project root), so the heal never fires.
+ *      - degraded-ancestor shape (2026-08-17), STRAY-REPO shape ONLY: cached
+ *        equals the marker root's basename, the marker root is anchored by a
+ *        .git entry whose origin does NOT resolve (the stray empty ~/.git
+ *        live bug), and a remote-bearing repo BELOW it exists — the
+ *        pre-remote-first resolver degraded to that stray ancestor's basename
+ *        (SLUG=<username>). A marker root anchored by package.json /
+ *        pyproject etc. with NO .git is legit #2212 sticky identity and must
+ *        NOT be healed. Legit remote-adopting stickiness is safe too: there
+ *        the repo that adopted the remote IS the marker root (remote root ==
+ *        project root), so the heal never fires.
  *   3. Canonical remote-derived slug from the OUTERMOST remote-bearing repo
  *      (see outermostRemoteRepo — never PROJECT_ROOT, which may be a
  *      marker-only ancestor with no remote): [:/]<owner>/<repo>[.git] →
@@ -176,7 +180,16 @@ export function slugFromEnvironment(gstackHome?: string, cwd: string = process.c
           !oldBugShape &&
           projectRoot !== "" &&
           cached === rootBase &&
+          // STRAY-REPO shape only: the marker root must be anchored by a .git
+          // entry whose origin does NOT resolve. A root anchored by
+          // package.json etc. (no .git) is legit #2212 sticky identity.
+          existsSync(join(projectRoot, ".git")) &&
           (() => {
+            const rootOrigin = spawnSync("git", ["-C", projectRoot, "remote", "get-url", "origin"], {
+              encoding: "utf-8",
+            });
+            const rootUrl = rootOrigin.status === 0 ? (rootOrigin.stdout || "").trim() : "";
+            if (rootUrl) return false; // marker root's own origin resolves — not the stray shape
             const r = resolveRemote();
             return r.url !== "" && r.root !== projectRoot;
           })();