fix(review): address PR #16 code-review findings

#1 ingest: normalize the pinned caller id (_norm_cited_id) so a non-bare DOI caller cannot store a URL-form papers.id that defeats DQ-5 idempotency / the startswith(10.) recovery gates. #2 quality.section_label: collapse to a controlled bucket only for an EXACT canonical heading; descriptive titles ('Abstract Nonsense...') keep their real title instead of being mislabelled. #4 ra_grobid_backfill: release the read connection before the slow GROBID network loop, fresh connection for the write (no idle-in-transaction across the loop over the flaky tunnel).

#5/#10 tex: flatten_inputs strips unresolved input/include at the depth cap (no literal leak on cycles); _norm_texkey strips only a single leading ./ . #6/#7 arxiv.fetch_source: keep non-.tex members resolvable for input; pick primary on an UN-commented documentclass line. #13 is_arxiv_id: also exclude http:// and arXiv-DOI forms. Tests added/updated for each.

Left as deliberate decisions: #3 (pre-section text drop is pre-existing in extract_sections; abstract stored separately), #8 (script normalizer is intentionally self-contained, already documented), #9/#11/#12 (no current trigger / tightening the gzip heuristic would reject valid old LaTeX like documentstyle / title truncation is by design on a write-only column). ruff + mypy clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codex/parsing/tex.py

@@ -170,7 +170,9 @@ def _norm_texkey(name: str) -> str:
     ``.tex`` so ``\\input{sections/intro}`` matches the archive member
     ``sections/intro.tex``.
     """
-    n = name.strip().lstrip("./")
+    n = name.strip()
+    if n.startswith("./"):  # a single leading "./" only — don't eat "../" or ".hidden"
+        n = n[2:]
     return n[:-4] if n.endswith(".tex") else n
 
 
@@ -188,7 +190,9 @@ def flatten_inputs(primary: str, files: dict[str, str]) -> str:
 
     def _expand(text: str, depth: int) -> str:
         if depth > 10:
-            return text
+            # Cap reached (likely an \input cycle): strip any still-unresolved
+            # directives rather than leak a literal "\input{…}" into the parsed text.
+            return _INPUT_RE.sub("", text)
 
         def _repl(match: re.Match[str]) -> str:
             content = norm.get(_norm_texkey(match.group(1)))