fix: close stale-decision races, honor user edges, normalize --at, refuse truncating exports

[Da7-Tech]

What & why

Independent re-audit of the v6.2.8 hardening release: one line-by-line auditor over the whole file, one differential regression hunter that first reproduced v6.2.7's defects to validate the 6.2.8 fixes, one claims-and-channels auditor, plus a full maintainer read of every file. All of 6.2.8's headline numbers reproduced exactly (213/213 tests, fuzz 420/420, recall@1/@5 = 1.00, multilang 24/24, discrim 12/12, soak 15/15 & 0/256 & 7/8, mutation 39% = 47/120, published sha256 matches). The fixes below close what was still standing — each was proven red with a regression test before the change:

• The last stale-decision races. The merge now keeps a per-node disk-freshness baseline (_loaded_view: last_accessed/access_count as of our last disk read) and re-validates stale decisions against the current disk copy inside the lock: a dream on a stale view can no longer prune a memory another process confirmed meanwhile (GRACE_DAYS holds under concurrency), a stale decayed weight no longer min()s down a fresh confirm, and a duplicate-remember confidence upgrade merges max-wins as its own field instead of marking the node _dirty (6.2.8's way of persisting confidence whole-copied stale counters over a concurrent confirm — reproduced: expected access_count 2, got 1). Prune events journal after the save, only for prunes that actually landed.
• Conflict scan flags without clobbering: an existing user link keeps its relation and earned weight.
• recall --at normalization: compact (20260101) and tz-aware forms parsed on 3.11+ but compared lexicographically against dashed stamps ('-' < '0'), returning wrong-era results; all forms now normalize before comparison.
• Missing END guard: export leaves the damaged file untouched and reports it, instead of silently truncating everything after BEGIN.
• One boost number: the reopen path persisted +0.2 while the delta replay persisted +0.15; both are BOOST_PER_ACCESS.

Checklist

• python3 -m unittest discover -s tests passes (220/220)
• behavior changes come with regression tests that fail before the fix (7 new tests, each proven red first)
• measured claims in README/SKILL still true (bench 1.00/1.00, discrim 12/12, multilang 24/24, fuzz 420/420, soak 15/15 & 0/256 & 7/8 rerun on this branch; mutation remeasured on the final file: 42% = 50/120)
• zero new dependencies