fix(substrate): correctness & performance hardening (Tranche A)

[CodeWithJuber]

What & why

First of four tranches from a full code + whitepaper review. Tranche A — pure correctness &
performance bug-fixes. No new behaviour to opt into; every off-by-default path is unchanged.

Correctness

• SECRET_RE no longer guts auth work. The bare-word arm (secret/password/api key)
  matched any prose, so a task or lesson mentioning those words was silently refused —
  disabling the LLM proposer (adjudicate) and blocking memory persistence (recall/lessons)
  for exactly the high-risk code you most want help on. The word arm now requires a value-shaped
  assignment (password = "…", SECRET_KEY: …); credential formats (sk-…, ghp_…, JWTs)
  stay refused. src/recall.js.
• One malformed file no longer takes down memory. lessons_store.load/readEpisodes and
  cortex_hook.readSession skip a corrupt lesson file / JSONL line instead of throwing (which
  had broken retrieval, routing, and the pre-edit advisory everywhere load is called).
• Honest writes. recordMistake returns refused (not created) when a save is rejected,
  so the Stop hook never distills a phantom lesson; applyDistillation/recordContradiction
  surface the real write result.
• Atlas emits inherits edges (class X extends Y; Python class X(Base)) — the edge
  weight was defined but never produced, so base-class changes were invisible to blast-radius.
• Atlas staleness. isStale() lets verify rebuild when the cached graph is out of date —
  post-edit hallucination detection was running on a stale atlas. A capped graph now degrades
  to "uncertain" rather than raising false "unknown symbol" / "not found in the code".

Performance

• resolveEdges is O(E) (was O(E·N) — a full node scan per edge).
• impact() memoizes one reverse-adjacency map across the up-to-8 calls per substrate run.
• Atlas incremental build — reuses per-file extraction by content hash (sidecar cache)
  instead of re-parsing the whole repo (verified 60ms → 25ms on this repo).
• substrate computes preflight once and threads the gap into routing — removes a duplicate
  pass and a redundant assumption model call under FORGE_LLM=1.

Checklist

• npm test passes (Node 18/20/22) — 204 tests (+12)
• npm run check passes (Biome lint + format)
• New public functions have a test (isStale, inherits edges, incremental, resilience, refused-save)
• Conventional commit message (fix:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency
• Substrate/docs updated where behaviour changed

Risk & rollback

• Risk level: low — bug-fixes with tests; the only behaviour changes are more correct
  (secrets, resilience, staleness). The atlas cache is a gitignored sidecar.
• Rollback plan: revert the commit. No migrations; a stale .forge/atlas.cache.json is
  self-healing (ignored on hash mismatch).

Extra checks

• npm run typecheck passes
• Input validated at boundaries; errors handled (skip-and-continue on bad records)
• Logs contain no secrets/PII — secret detection retained for real credential formats

Verification

Full suite + typecheck + Biome green. Manual on this repo: atlas.build emits 5 inherits
edges (was 0), incremental rebuild 60ms→25ms, isStale correct; routeTask with
FORGE_LLM=1 now fires exactly one model call (asserted in a test).

Next: Tranche B (whitepaper fidelity — M5 footprint, doom-loop breaker, consequence-sim classes).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HGZUYFdUb4EViXV5tRid19

---

Generated by Claude Code