fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-settings-hook-schema-aware.test.ts

@@ -219,6 +219,77 @@ describe('add-event', () => {
   });
 });
 
+// ----------------------------------------------------------------------
+// ensure-event: duplicate (event, source) collapse
+// ----------------------------------------------------------------------
+
+describe('ensure-event collapses duplicate (event, source) entries', () => {
+  test('two same-source entries from the old matcher-keyed dedup collapse to ONE updated entry', () => {
+    // Pre-existing installs can carry two entries with the same
+    // (event, _gstack_source) — the old dedup keyed on the matcher too, so a
+    // matcher change pushed a second registration. `.find()` updated only the
+    // first and left the stale twin running forever.
+    const { spawnSync } = require('child_process');
+    fs.writeFileSync(settingsFile, JSON.stringify({
+      hooks: {
+        PostToolUse: [
+          { _gstack_source: 'plan-tune-cathedral', matcher: 'OldMatcherA', hooks: [{ type: 'command', command: '/old-a', timeout: 5 }] },
+          { matcher: 'Bash', hooks: [{ type: 'command', command: '/user-own-hook' }] },
+          { _gstack_source: 'plan-tune-cathedral', matcher: 'OldMatcherB', hooks: [{ type: 'command', command: '/old-b', timeout: 5 }] },
+        ],
+      },
+    }, null, 2));
+
+    const r = spawnSync('bash', [
+      SETTINGS_HOOK, 'ensure-event',
+      '--event', 'PostToolUse',
+      '--matcher', 'NewMatcher',
+      '--command', '/canonical',
+      '--source', 'plan-tune-cathedral',
+      '--timeout', '5',
+    ], { env: { ...process.env, GSTACK_SETTINGS_FILE: settingsFile }, encoding: 'utf-8', timeout: 15_000 });
+
+    expect(r.status).toBe(0);
+    // The collapse is reported on stderr, never silent.
+    expect(r.stderr).toContain('collapsed 1 duplicate');
+    const s = settings();
+    const mine = s.hooks.PostToolUse.filter((e: any) => e._gstack_source === 'plan-tune-cathedral');
+    expect(mine).toHaveLength(1); // ONE canonical entry — the stale twin is gone
+    expect(mine[0].matcher).toBe('NewMatcher');
+    expect(mine[0].hooks[0].command).toBe('/canonical');
+    // Unrelated user hook untouched.
+    const bash = s.hooks.PostToolUse.find((e: any) => e.matcher === 'Bash');
+    expect(bash.hooks[0].command).toBe('/user-own-hook');
+    expect(s.hooks.PostToolUse).toHaveLength(2);
+  });
+
+  test('no duplicates → no collapse message, single entry updated as before', () => {
+    const { spawnSync } = require('child_process');
+    fs.writeFileSync(settingsFile, JSON.stringify({
+      hooks: {
+        PostToolUse: [
+          { _gstack_source: 'plan-tune-cathedral', matcher: 'OldMatcher', hooks: [{ type: 'command', command: '/old', timeout: 5 }] },
+        ],
+      },
+    }, null, 2));
+
+    const r = spawnSync('bash', [
+      SETTINGS_HOOK, 'ensure-event',
+      '--event', 'PostToolUse',
+      '--matcher', 'NewMatcher',
+      '--command', '/new',
+      '--source', 'plan-tune-cathedral',
+      '--timeout', '5',
+    ], { env: { ...process.env, GSTACK_SETTINGS_FILE: settingsFile }, encoding: 'utf-8', timeout: 15_000 });
+
+    expect(r.status).toBe(0);
+    expect(r.stderr).not.toContain('collapsed');
+    const s = settings();
+    expect(s.hooks.PostToolUse).toHaveLength(1);
+    expect(s.hooks.PostToolUse[0].hooks[0].command).toBe('/new');
+  });
+});
+
 // ----------------------------------------------------------------------
 // remove-source
 // ----------------------------------------------------------------------