fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/session-update-autostash.test.ts

@@ -245,10 +245,36 @@ describe('gstack-session-update lock identity + TTL (#2613)', () => {
     const src = fs.readFileSync(SCRIPT, 'utf8');
     const mvAside = src.match(/mv "\$LOCK_DIR" "\$LOCK_DIR\.reap\.\$\$" 2>\/dev\/null \|\| \{ log_entry "SKIP lock_contested"; exit 0; \}/g) || [];
     expect(mvAside.length).toBe(2); // TTL branch + dead-PID branch
-    // The only rm -rf of the live lock dir is the holder's EXIT trap.
+    // The only rm -rf of the live lock dir is the holder's EXIT trap — and
+    // even that one is ownership-checked (see the static pin below).
     const bareRms = src.match(/rm -rf "\$LOCK_DIR"(?!\.)/g) || [];
     expect(bareRms.length).toBe(1);
-    expect(src).toContain(`trap 'rm -rf "$LOCK_DIR" 2>/dev/null' EXIT`);
+    expect(src).toContain(
+      `trap 'kill "$HB_PID" 2>/dev/null; [ "$(cat "$LOCK_DIR/pid" 2>/dev/null)" = "$MYPID" ] && rm -rf "$LOCK_DIR" 2>/dev/null' EXIT`,
+    );
+  });
+
+  test('EXIT trap is ownership-checked and a heartbeat runs during pull/setup (static pins)', () => {
+    const src = fs.readFileSync(SCRIPT, 'utf8');
+    // (a) After a TTL reclaim by another updater, $LOCK_DIR belongs to the
+    // NEW holder — the old holder's trap must remove the lock ONLY while the
+    // pidfile still contains ITS pid (MYPID captured at write time).
+    const trapLine = src.split('\n').find((l) => l.includes("trap '") && l.includes('rm -rf "$LOCK_DIR"'));
+    expect(trapLine).toBeDefined();
+    expect(trapLine!).toContain('[ "$(cat "$LOCK_DIR/pid" 2>/dev/null)" = "$MYPID" ] && rm -rf "$LOCK_DIR"');
+    // MYPID is written to the pidfile (the identity the trap compares against).
+    expect(src).toContain('MYPID="${BASHPID:-$(sh -c \'echo $PPID\')}"');
+    expect(src).toContain('echo "$MYPID" > "$LOCK_DIR/pid"');
+    // (b) In-flight heartbeat: the step-boundary touches only fire AFTER the
+    // pull / setup return, so a legitimately-slow step past the 30-min TTL
+    // got reclaimed while ALIVE. The loop re-checks ownership each beat and
+    // exits instead of touching a reclaimed holder's pidfile.
+    expect(src).toMatch(
+      /while :; do sleep 300; \[ "\$\(cat "\$LOCK_DIR\/pid" 2>\/dev\/null\)" = "\$MYPID" \] \|\| exit 0; touch "\$LOCK_DIR\/pid" 2>\/dev\/null; done/,
+    );
+    expect(src).toContain('HB_PID=$!');
+    // The trap stops the heartbeat so it can never outlive the holder.
+    expect(trapLine!).toContain('kill "$HB_PID"');
   });
 
   test('an expired-TTL lock is reclaimed even when its pid is alive (PID reuse)', async () => {