fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-next-version.test.ts

@@ -662,6 +662,102 @@ describe("fetchGitClaimed — non-mutating live remote query (ls-remote first)",
   });
 });
 
+describe("fetchGitClaimed — unfetched live claims (G2: ls-remote advertises SHAs without objects)", () => {
+  // `git ls-remote` lists a branch's tip sha without transferring objects, so
+  // a branch pushed AFTER the last local fetch has no local object and both
+  // VERSION reads fail. The old `continue` silently dropped that LIVE claim —
+  // the exact duplicate-allocation this fallback exists to prevent.
+  function git(cwd: string, ...args: string[]) {
+    return Bun.spawnSync(["git", "-c", "user.email=t@t", "-c", "user.name=t", ...args], { cwd });
+  }
+
+  function cloneFixture(): { root: string; origin: string; clone: string } {
+    const root = mkdtempSync(join(tmpdir(), "nextver-unfetched-"));
+    const origin = join(root, "origin");
+    mkdirSync(origin);
+    git(origin, "init", "-q", "-b", "main");
+    writeFileSync(join(origin, "VERSION"), "0.1.66.0\n");
+    git(origin, "add", "-A");
+    git(origin, "commit", "-qm", "v0.1.66.0 chore: base");
+    const clone = join(root, "clone");
+    git(root, "clone", "-q", origin, clone);
+    return { root, origin, clone };
+  }
+
+  test("a claim branch pushed after the last local fetch is read via a targeted fetch", () => {
+    const { root, origin, clone } = cloneFixture();
+    const cwd = process.cwd();
+    try {
+      // The claim lands on origin AFTER the clone — its objects are absent
+      // locally, so `git show <sha>:VERSION` and the remote-tracking read
+      // both fail until the targeted fetch runs.
+      git(origin, "checkout", "-q", "-b", "late-claim");
+      writeFileSync(join(origin, "VERSION"), "0.1.70.0\n");
+      git(origin, "add", "-A");
+      git(origin, "commit", "-qm", "v0.1.70.0 feat: late claim");
+      git(origin, "checkout", "-q", "main");
+
+      process.chdir(clone);
+      const warnings: string[] = [];
+      const claims = fetchGitClaimed("main", "VERSION", warnings);
+      expect(claims.map((c) => c.version)).toContain("0.1.70.0");
+      expect(warnings.join(" ")).not.toContain("UNKNOWN claim");
+    } finally {
+      process.chdir(cwd);
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("a claim STILL unreadable after the fetch surfaces as an UNKNOWN-claim warning, never silence", () => {
+    const { root, origin, clone } = cloneFixture();
+    const cwd = process.cwd();
+    try {
+      // A ref origin advertises but cannot serve: dangling sha written
+      // straight into refs/. ls-remote lists it; every local read fails, the
+      // targeted fetch fails ("not our ref"), and the object never appears.
+      writeFileSync(
+        join(origin, ".git", "refs", "heads", "ghost"),
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n",
+      );
+
+      process.chdir(clone);
+      const warnings: string[] = [];
+      const claims = fetchGitClaimed("main", "VERSION", warnings);
+      expect(claims.map((c) => c.branch)).not.toContain("origin/ghost");
+      const joined = warnings.join(" ");
+      expect(joined).toContain("origin/ghost");
+      expect(joined).toContain("UNKNOWN claim");
+    } finally {
+      process.chdir(cwd);
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("a live branch that simply carries no VERSION file is not a claim and not an UNKNOWN warning", () => {
+    const { root, origin, clone } = cloneFixture();
+    const cwd = process.cwd();
+    try {
+      // Branch exists BEFORE the clone (objects local), VERSION deleted on it:
+      // the read fails because the PATH is absent, not the object. Old
+      // semantics (skip quietly) must hold — no phantom UNKNOWN noise.
+      git(origin, "checkout", "-q", "-b", "docs-only");
+      git(origin, "rm", "-q", "VERSION");
+      git(origin, "commit", "-qm", "docs: no version file");
+      git(origin, "checkout", "-q", "main");
+      git(clone, "fetch", "-q", "origin");
+
+      process.chdir(clone);
+      const warnings: string[] = [];
+      const claims = fetchGitClaimed("main", "VERSION", warnings);
+      expect(claims.map((c) => c.branch)).not.toContain("origin/docs-only");
+      expect(warnings.join(" ")).not.toContain("docs-only");
+    } finally {
+      process.chdir(cwd);
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("width pinned on failed base read (3-digit repos)", () => {
   // readBaseVersion used to return a literal "0.0.0.0" when origin/<base> was
   // unreadable — a 4-digit string, which flipped versionWidth() to 4 and