bugs(C5): fail-all P3 batch from the 2026-09-25 hunt

[Juliusolsson05]

P3 fail-all findings from the read-only C5 hunt. Details are in temp/quality-loop/hunt-c5.md (rows 8–15). They are not yet verified; split any row out when it is picked up.

• 8. One unreadable Codex rollout empties the Codex conversation list (conversations/sources/codex.ts:172). The readline iterator throws on stream errors.
• 9. One unknown incident or operation row drops the whole run's data (MonitorHistoryStore.ts:684-705).
• 10. One malformed Pi JSONL line blocks switch, duplicate and rewind (providerSwitch/piTranscript.ts:48-56).
• 11. One invalid workflow-source approval blocks every repository workflow (WorkflowSourceApprovalStore.ts:73-86).
• 12. One bad tldrIdentity empties every TLDR in Agent Activity (tldr/ipc.ts:19,147,173).
• 13. One bad legacy bundle-ledger row stops all debug pruning (debugRetention.ts:589,597).
• 14–15 (strict by design, recorded only): the key vault index, the agent-name registry, and tmux recovery on an unknown session kind.

[Juliusolsson05]

Closing: every row is delivered or recorded (B6, 2026-09-27).

• Rows 8, 9, 11 and 12 were fixed by fix: one bad record no longer fails the whole set (C5 rows 8–12, #1251) #1411 (merged in batch N, 1681e68).
• Row 13 (a bad legacy bundle-ledger row stopped all pruning) was fixed by fix: bound the small unbounded-growth items from the C6 hunt (#1278) #1417 (merged in batch T, b5e949d). Its ledger loader treats an absent or unreadable ledger as unknown and protected.
• Row 10 (Pi JSONL) is strict by design, and fix: one bad record no longer fails the whole set (C5 rows 8–12, #1251) #1411 recorded the reason.
• Rows 14 and 15 were recorded as strict by design in the hunt itself.

Reopen when: a new single-bad-record case is found that fails a whole set. File it as its own issue.