fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-memory-ingest.test.ts

@@ -300,9 +300,16 @@ describe("internal: parseTranscriptJsonl + buildTranscriptPage shape", () => {
 
 describe("gstack-memory-ingest --limit", () => {
   it("respects --limit by stopping after N writes (mocked via --probe shortcut)", () => {
-    const r = runScript(["--probe", "--limit", "1"]);
+    // Hermetic home: against the operator's real HOME this walked the whole
+    // transcript corpus (and, post policy-parity, batch-checked its real
+    // policy store), making a pure arg-parsing assertion slow and flaky.
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const r = runScript(["--probe", "--limit", "1"], { HOME: home, GSTACK_HOME: gstackHome });
     // --limit doesn't apply to probe but argument should parse without error
     expect(r.exitCode).toBe(0);
+    rmSync(home, { recursive: true, force: true });
   });
 
   it("rejects --limit 0 with exit 1", () => {
@@ -1201,6 +1208,82 @@ describe("#2392: transcript ingest honors per-remote trust policy", () => {
     rmSync(home, { recursive: true, force: true });
   });
 
+  it("(f) probe policy parity: a denied remote's transcript lands in skipped_policy_deny, not new_count", () => {
+    // --probe used to count policy-denied transcripts as ingestible (it only
+    // applied attribution), so its numbers overstated what --bulk would write.
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+
+    const denyCwd = makeRepoWithRemote(home, "denied", "https://github.com/denyme/denied.git");
+    writeSessionForRepo(home, "work-denied", "denysess1", denyCwd);
+    setPolicy(gstackHome, "https://github.com/denyme/denied.git", "deny");
+
+    const r = runScript(["--probe"], { HOME: home, GSTACK_HOME: gstackHome });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain("Total files in window: 0");
+    expect(r.stdout).toMatch(/New \(never ingested\):\s+0/);
+    expect(r.stdout).toMatch(/Skipped \(policy deny\):\s+1/);
+    expect(r.stdout).not.toMatch(/Skipped \(policy read-only\)/);
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(g) probe policy parity: a read-only remote's transcript lands in skipped_policy_readonly", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+
+    const roCwd = makeRepoWithRemote(home, "readonly", "https://github.com/roorg/rorepo.git");
+    writeSessionForRepo(home, "work-readonly", "rosess1", roCwd);
+    setPolicy(gstackHome, "https://github.com/roorg/rorepo.git", "read-only");
+
+    const r = runScript(["--probe"], { HOME: home, GSTACK_HOME: gstackHome });
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toContain("Total files in window: 0");
+    expect(r.stdout).toMatch(/Skipped \(policy read-only\):\s+1/);
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(h) --limit counts policy-PERMITTED pages only: a denied-first corpus still writes the allowed page", () => {
+    // Walk order is deterministic here: Claude Code projects are walked
+    // BEFORE Codex sessions (walkAllSources), so the DENIED transcript is
+    // prepared first. Pre-fix, --limit 1 was applied to the unfiltered
+    // prepared array — the denied record consumed the limit and the permitted
+    // one starved (written: 0).
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir } = installFakeGbrain(home);
+
+    const denyCwd = makeRepoWithRemote(home, "denied", "https://github.com/denyme/denied.git");
+    writeSessionForRepo(home, "work-denied", "denysess1", denyCwd); // Claude Code: walked first
+    const okCwd = makeRepoWithRemote(home, "allowed", "https://github.com/okorg/okrepo.git");
+    const today = new Date();
+    const ymd = `${today.getFullYear()}-${String(today.getMonth() + 1).padStart(2, "0")}-${String(today.getDate()).padStart(2, "0")}`;
+    writeCodexSession(
+      home, ymd,
+      `{"type":"session_meta","payload":{"id":"oksess-codex","cwd":"${okCwd.replace(/\\/g, "\\\\")}"},"timestamp":"${today.toISOString()}"}\n`,
+    );
+    setPolicy(gstackHome, "https://github.com/denyme/denied.git", "deny");
+
+    const r = runScript(["--bulk", "--quiet", "--limit", "1"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).toMatch(/skipped \(policy deny\):\s+1/);
+    // The page that landed is the PERMITTED one (the Codex session), not
+    // whichever record happened to be walked first.
+    const sessions = stateSessions(gstackHome);
+    expect(sessions.length).toBe(1);
+    expect(sessions[0]).toContain("rollout-");
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
   it("artifacts are never policy-filtered, even when their project's remote is denied", () => {
     const home = makeTestHome();
     const gstackHome = join(home, ".gstack");