fix(newos4): unmeasured skills are untracked, world-model writes verified, skill audit

External review packet (os4-external-review-v4.6.51.html) triaged against the code:
2 findings confirmed and fixed, 4 could not be reproduced and were recorded as such.

- module-memory-graph.js: getStaleSkills() treated a missing lastUsed as 999 days
  unused, so skill-audit recommended archiving every skill (22 of 22). Skills with no
  usage telemetry are now collected by getUntrackedSkills() and never counted stale.
  Live: "Stale: 0" + "Untracked: 22 (no usage telemetry — NOT stale)".
- module-world-model.js: _saveToVFS() ignored fsWriteJSON()'s return value and promoted
  whatever a truthy read returned. Now write -> read-back -> byte compare -> promote,
  with every return checked. Regression test modules/test/test-world-model-save.js
  (red on the old code: promoted=true with errs=[]; green now).
- scripts/newos4-skill-audit.py: 5 mechanical probes (version x3, read_file paging +
  context budget, selection symbols, required scripts, extKeys) + skill presence;
  exits non-zero on drift. 7/7 pass today. Weekly job cb6bc2a16216 runs it Mondays.

Not reproduced (recorded in admin/docs/newos4-external-review-verification-2026-10-23.md):
world_model_query empty-payload throw (live call returns JSON), pipes-as-command-names,
ls skills empty (23 entries via fs.readDir), ~66 agent dirs (4 live).

1 files changed, 24 insertions, 0 deletions

diff --git a/modules/test/test-world-model-save.js b/modules/test/test-world-model-save.js
new file mode 100644
index 0000000..eabba84
--- /dev/null
+++ b/modules/test/test-world-model-save.js
@@ -0,0 +1,24 @@
+// modules/test/test-world-model-save.js  — run: node modules/test/test-world-model-save.js
+const fs = require('fs'), path = require('path');
+const src = fs.readFileSync(path.join(__dirname, '../core/module-world-model.js'), 'utf8');
+const WorldModelModule = new Function(src + '\nreturn WorldModelModule;')();
+const wm = new WorldModelModule();
+wm._model = { version: 'test', nodes: 1 };
+
+const calls = [];
+const fake = {
+    readDir: () => [], mkdir: () => {},
+    readFile: () => '',
+    writeFile: (p) => { calls.push(p); return false; },      // every write fails
+    fsReadJSON: () => ({ version: 'test', nodes: 1 }),        // truthy: old code would promote
+    fsWriteJSON: (p) => { calls.push(p); return false; },
+    deleteFile: () => true,
+};
+const errs = []; const orig = console.error;
+console.error = (m) => errs.push(String(m));
+wm._saveToVFS(fake);
+console.error = orig;
+
+const promoted = calls.some(p => p === '/system/world-model.json');
+console.log(JSON.stringify({ calls, errs, promoted }));
+process.exit(promoted || errs.length === 0 ? 1 : 0);