fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/bin-context-windows-slug.test.ts

@@ -326,6 +326,35 @@ describe("walk-up parity with bin/gstack-slug (outermost project root)", () => {
     expect(fs.readFileSync(cacheFile, "utf-8")).toBe("garrytan-gstack");
   });
 
+  test("package.json wrapper root (no .git): sticky basename slug is PRESERVED — heal is stray-repo-shape only", () => {
+    // Legit #2212 shape: a monorepo wrapper anchored by package.json used
+    // gstack before an inner dir grew a remote-bearing repo. The degraded-
+    // ancestor heal must NOT fire — it is restricted to marker roots anchored
+    // by a .git entry whose origin does NOT resolve (the live-bug shape).
+    const wrapper = path.join(tmp, "wrapperproj");
+    const inner = path.join(wrapper, "apps", "web");
+    fs.mkdirSync(inner, { recursive: true });
+    fs.writeFileSync(path.join(wrapper, "package.json"), '{"name":"wrapper"}\n');
+    spawnSync("git", ["init", "-q", inner]);
+    spawnSync("git", ["-C", inner, "remote", "add", "origin", "https://github.com/acme/web.git"]);
+
+    const cacheDir = path.join(nativeHome(), "slug-cache");
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const cacheFile = path.join(cacheDir, toMsysPath(inner).replace(/\//g, "_"));
+    fs.writeFileSync(cacheFile, "wrapperproj"); // legit sticky identity
+
+    expect(slugFromEnvironment(nativeHome(), inner)).toBe("wrapperproj"); // NOT healed to acme-web
+    expect(fs.readFileSync(cacheFile, "utf-8")).toBe("wrapperproj");
+
+    // The bash implementation agrees on the same fixture (own home, seeded cache).
+    if (HAS_BASH) {
+      const bashCacheDir = path.join(tmp, "bash-home", ".gstack", "slug-cache");
+      fs.mkdirSync(bashCacheDir, { recursive: true });
+      fs.writeFileSync(path.join(bashCacheDir, toMsysPath(inner).replace(/\//g, "_")), "wrapperproj");
+      expect(bashSlug(inner)).toBe("wrapperproj");
+    }
+  });
+
   test("sticky identity preserved (#2212): a remote adopted AT the marker root is NOT healed", () => {
     // Legit sticky shape: the repo that adopted the remote IS the marker root
     // (remote root == project root), so the degraded-ancestor heal must not