2 files changed, 33 insertions, 7 deletions
diff --git a/modules/core/module-memory-graph.js b/modules/core/module-memory-graph.js
index ffc79e0..093d2e4 100644
--- a/modules/core/module-memory-graph.js
+++ b/modules/core/module-memory-graph.js
@@ -469,9 +469,16 @@ class MemoryGraphModule {
             // v4.5.90b fix: Use configurable _decayDays (P1 from review)
             const staleThreshold = this._decayDays * 24 * 60 * 60 * 1000;
             var stale = [];
+            var untracked = [];
             for (var name of Object.keys(index)) {
                 var stats = index[name] || {};
                 if (stats.immune) continue;
+                // A skill with no usage telemetry has never been measured. Calling it stale is how
+                // the audit came to recommend archiving the system's entire procedural memory.
+                if (stats.lastUsed === undefined && stats.useCount === undefined) {
+                    untracked.push(name);
+                    continue;
+                }
                 var useCount = stats.useCount || 0;
                 var lastUsed = stats.lastUsed ? new Date(stats.lastUsed).getTime() : 0;
                 if (useCount === 0 && (now - lastUsed > staleThreshold || lastUsed === 0)) {
@@ -479,12 +486,17 @@ class MemoryGraphModule {
                     stale.push({ name: name, daysUnused: daysUnused });
                 }
             }
+            this._untrackedSkills = untracked;
             return stale;
         } catch (e) {
             return [];
         }
     }
 
+    getUntrackedSkills() {
+        return Array.isArray(this._untrackedSkills) ? this._untrackedSkills : [];
+    }
+
     // v4.5.89: Configure decay policy
     decayConfig(args) {
         if (args.length < 2) {
diff --git a/modules/core/module-world-model.js b/modules/core/module-world-model.js
index cbfd1fb..4e88f59 100644
--- a/modules/core/module-world-model.js
+++ b/modules/core/module-world-model.js
@@ -580,14 +580,28 @@ class WorldModelModule {
             if (prevModel) { try { fs.fsWriteJSON('/system/world-model.prev.json', prevModel); } catch (_) {} }
             // v4.5.89b fix: Clean stale temp from previous crash (P1 from review)
             try { fs.deleteFile('/system/world-model.tmp.json'); } catch (_) {}
-            fs.fsWriteJSON('/system/world-model.tmp.json', this._model);
-            const tmp = fs.fsReadJSON('/system/world-model.tmp.json');
-            if (tmp) {
-                fs.fsWriteJSON('/system/world-model.json', tmp);
-                fs.deleteFile('/system/world-model.tmp.json');
-            } else {
-                console.error('[WorldModel] Save failed: temp file corrupt after write');
+            // Atomic + verified: never promote a write we did not read back byte-for-byte.
+            // Measured 2026-10-23: the old block promoted /system/world-model.json even when every
+            // write returned false, and logged nothing — that is how a graph got replaced by a
+            // partial model. fs.fsWriteJSON() returns a boolean; ignoring it hides quota failures.
+            const payload = JSON.stringify(this._model);
+            const wrote = fs.writeFile('/system/world-model.tmp.json', payload);
+            if (!wrote) {
+                console.error('[WorldModel] Save failed: write returned false (storage quota?)');
+                return;
             }
+            const back = fs.readFile('/system/world-model.tmp.json');
+            if (back !== payload) {
+                console.error('[WorldModel] Save failed: read-back mismatch ('
+                    + (back ? back.length : 0) + '/' + payload.length + ' bytes) — keeping previous model');
+                return;
+            }
+            const promoted = fs.writeFile('/system/world-model.json', back);
+            if (!promoted) {
+                console.error('[WorldModel] Save failed: promote returned false');
+                return;
+            }
+            fs.deleteFile('/system/world-model.tmp.json');
         } catch (e) {
             console.error('[WorldModel] Save error:', e.message);
         }