@@ -6,6 +6,8 @@ dist/
 # `graft build` locally (it re-adds this line itself), so the folder is a
 # personal cache like node_modules, never a shared artifact.
 graft/
+# Except the graft skill's SKILL.md fixture, which CI checks against the spec.
+!test/fixtures/skills/graft/
 
 # Env
 .env
 
@@ -0,0 +1,143 @@
+/**
+ * D120 (2): the install record, `<trail home>/state/installed/<checkout hash>.json`:
+ * the repo paths `trail init` wrote in one checkout, each with the sha256 of what
+ * it wrote (null for a file it deleted). The clean-tree ready probe ignores a
+ * dirty path only while it is in this record and still holds those bytes, so any
+ * later edit blocks again.
+ *
+ * A path counts as init's when init changed it and it was clean in git just
+ * before (or the last record already had it, unchanged since). A path the person
+ * had dirty before init stays theirs, whatever init then wrote into it. Links,
+ * FIFOs and files over 1 MB are never recorded or vouched for.
+ */
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { closeSync, fstatSync, lstatSync, readSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+import { trailPath, writePrivate } from '../util/private-fs.js';
+import { openPlain, readPlain } from './plain-file.js';
+
+const MAX_FILE = 1024 * 1024;
+const MAX_PATHS = 200;
+const REL = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))[\w.@+-]+(?:\/[\w.@+-]+)*$/;
+const SHA = /^[0-9a-f]{64}$/;
+
+/** What a recorded path holds: a sha256, or null for "init deleted it". */
+export type InstallFiles = Record<string, string | null>;
+
+export interface InstallSnap {
+  checkout: string;
+  rels: string[];
+  before: Map<string, string | null | false>;
+  dirty: Set<string>;
+  prior: InstallFiles | null;
+}
+
+function real(checkout: string): string {
+  try {
+    return realpathSync.native(checkout);
+  } catch {
+    return checkout;
+  }
+}
+
+export function installRecordPath(checkout: string, env?: NodeJS.ProcessEnv): string {
+  const key = createHash('sha256').update(real(checkout)).digest('hex').slice(0, 16);
+  return trailPath(env, 'state', 'installed', `${key}.json`);
+}
+
+/** The sha256 of a plain file's bytes; null when nothing is there; false for a link, a FIFO, a folder or a big file. */
+export function fileSha(path: string): string | null | false {
+  try {
+    if (!lstatSync(path).isFile()) return false;
+  } catch {
+    return null;
+  }
+  let fd = -1;
+  try {
+    fd = openPlain(path);
+    const size = fstatSync(fd).size;
+    if (size > MAX_FILE) return false;
+    const buf = Buffer.alloc(size);
+    let off = 0;
+    while (off < size) {
+      const n = readSync(fd, buf, off, size - off, off);
+      if (n <= 0) break;
+      off += n;
+    }
+    return createHash('sha256').update(buf.subarray(0, off)).digest('hex');
+  } catch {
+    return false;
+  } finally {
+    if (fd >= 0) closeSync(fd);
+  }
+}
+
+/** The record for this checkout, or null when there is none or it names another checkout. */
+export function readInstallRecord(checkout: string, env?: NodeJS.ProcessEnv): InstallFiles | null {
+  let raw: unknown;
+  try {
+    const text = readPlain(installRecordPath(checkout, env), MAX_FILE);
+    if (text === null) return null;
+    raw = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const r = raw as { v?: unknown; checkout?: unknown; files?: unknown };
+  if (!r || r.v !== 1 || r.checkout !== real(checkout) || !r.files || typeof r.files !== 'object' || Array.isArray(r.files)) return null;
+  const out: InstallFiles = {};
+  for (const [rel, sha] of Object.entries(r.files as Record<string, unknown>).slice(0, MAX_PATHS)) {
+    if (REL.test(rel) && (sha === null || (typeof sha === 'string' && SHA.test(sha)))) out[rel] = sha;
+  }
+  return out;
+}
+
+/** Whether `rel` is a path init recorded here that still holds what init left (absent, for one it deleted). */
+export function initLeftIt(files: InstallFiles | null, checkout: string, rel: string): boolean {
+  if (!files || !Object.hasOwn(files, rel) || !REL.test(rel)) return false;
+  return fileSha(join(checkout, rel)) === files[rel];
+}
+
+/** The paths of `git status --porcelain -z` (a rename's both sides), for the paths asked about. */
+function dirtyPaths(checkout: string, rels: string[], env: NodeJS.ProcessEnv): Set<string> | null {
+  if (!rels.length) return new Set();
+  const r = spawnSync('git', ['status', '--porcelain', '-z', '--untracked-files=all', '--', ...rels], {
+    cwd: checkout, encoding: 'utf8', timeout: 10_000, env: { ...env, GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0' },
+  });
+  if (r.status !== 0 || typeof r.stdout !== 'string') return null;
+  const out = new Set<string>();
+  const parts = r.stdout.split('\0');
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i]!;
+    if (p.length < 4) continue;
+    out.add(p.slice(3));
+    if (p[0] === 'R' || p[0] === 'C') out.add(parts[++i] ?? '');
+  }
+  return out;
+}
+
+/** Before init writes: what each path holds, which were dirty already, and the last record. */
+export function snapInstall(checkout: string, rels: string[], env: NodeJS.ProcessEnv = process.env): InstallSnap {
+  const list = [...new Set(rels.filter((r) => REL.test(r)))].slice(0, MAX_PATHS);
+  const dirty = dirtyPaths(checkout, list, env);
+  const before = new Map(list.map((rel) => [rel, fileSha(join(checkout, rel))] as const));
+  // When git can't say, every path counts as dirty: nothing is vouched for that the probe couldn't check either.
+  return { checkout, rels: list, before, dirty: dirty ?? new Set(list), prior: readInstallRecord(checkout, env) };
+}
+
+/** After init wrote: record the paths it made its own, and return them. */
+export function recordInstall(snap: InstallSnap, env: NodeJS.ProcessEnv = process.env): string[] {
+  const files: InstallFiles = {};
+  for (const rel of snap.rels) {
+    const before = snap.before.get(rel);
+    const after = fileSha(join(snap.checkout, rel));
+    if (before === false || after === false) continue;
+    const vouched = !!snap.prior && Object.hasOwn(snap.prior, rel) && snap.prior[rel] === before;
+    if (vouched || (before !== after && !snap.dirty.has(rel))) files[rel] = after ?? null;
+  }
+  // Nothing init wrote, and nothing there before: no record at all.
+  const kept = Object.keys(files);
+  if (!kept.length && !snap.prior) return kept;
+  writePrivate(installRecordPath(snap.checkout, env), `${JSON.stringify({ v: 1, checkout: real(snap.checkout), files }, null, 2)}\n`);
+  return kept;
+}
@@ -0,0 +1,88 @@
+/**
+ * Every-repo personal learnings (design 1.0, P21, R6): learnings that hold
+ * on this machine in every repo, in `<trail home>/learnings/`. A kept
+ * guardrail, a preference the person typed in many repos, a machine wall's
+ * lesson. Beside `notes.ts`, which keeps a personal learning per repo.
+ *
+ * A guardrail template has a fixed file name (`no-timeout.md`,
+ * `push-over-ssh.md`) so the PreToolUse fast path can read that one file
+ * without listing the folder (R4, R56). Every path goes through
+ * `trailPath(env)`, never a home path (0 rule 11).
+ */
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { flatLine } from "./flatten.js";
+import { EVERY_REPO, liveLearnings, newLearningId, readLearningFields, type LearningFields } from "./learning-fields.js";
+import { parseNote, renderNote, type Note, type WriteNoteInput } from "./notes.js";
+import { ensurePrivateDir, trailPath, writePrivate } from "../util/private-fs.js";
+import { refuseLinkedIntoCheckout } from "./linked-learnings.js";
+
+/** What a new every-repo learning is written from: phase 0's input plus 1b's fields. Its id, scope and status come from where it is written. */
+export type LearningInput = WriteNoteInput & Pick<LearningFields, "skill" | "check" | "enforce" | "wall">;
+
+/** A plain file name: no folder, no leading dot, `.md`. */
+const FILE_NAME = /^[a-z0-9][a-z0-9._-]{0,80}\.md$/;
+/** A learning is a few lines; a bigger file is not one Trail wrote, and is skipped rather than read at every start. */
+const MAX_FILE = 64 * 1024;
+
+/** `<trail home>/learnings` (P21). */
+export function everyRepoDir(env: NodeJS.ProcessEnv = process.env): string {
+  return trailPath(env, "learnings");
+}
+
+/**
+ * Writes one every-repo personal learning (0600 in a 0700 folder), id from its file name, `applies: every repo`
+ * whatever the input says. A file of that name is replaced: a guardrail template keeps its one file; callers
+ * pick other names so they don't meet. Returns the path.
+ */
+export function writeEveryRepo(input: LearningInput, fileName: string, env: NodeJS.ProcessEnv = process.env): string {
+  if (typeof fileName !== "string" || !FILE_NAME.test(fileName) || fileName.includes("..")) {
+    throw new Error("writeEveryRepo: a plain .md file name is needed");
+  }
+  const dir = everyRepoDir(env);
+  // D114 (1): a linked folder is fine (dotfiles), unless it leads into a Trail checkout.
+  refuseLinkedIntoCheckout(dir, env);
+  ensurePrivateDir(dir);
+  const note: Omit<Note, "path"> = {
+    title: flatLine(input.title),
+    author: flatLine(input.author, 80),
+    date: input.date,
+    branch: input.branch,
+    cost: input.cost,
+    touches: input.touches ?? [],
+    body: input.body,
+    ...(input.standing ? { standing: true } : {}),
+    ...readLearningFields({ ...input, id: newLearningId(fileName), scope: "personal", applies: EVERY_REPO, status: "active" }, fileName),
+  };
+  const path = join(dir, fileName);
+  writePrivate(path, renderNote(note));
+  return path;
+}
+
+/**
+ * Active, not replaced, kind not lesson: what session start loads in every repo (R47). A file that says it holds
+ * in one repo, a link, or anything that doesn't parse is left out.
+ */
+export function everyRepoLearnings(env: NodeJS.ProcessEnv = process.env): Note[] {
+  const dir = everyRepoDir(env);
+  let files: string[];
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return [];
+  }
+  const out: Note[] = [];
+  for (const f of files) {
+    const path = join(dir, f);
+    try {
+      const st = lstatSync(path);
+      if (!st.isFile() || st.size > MAX_FILE) continue;
+      const n = parseNote(readFileSync(path, "utf8"), path);
+      if (!n || (n.applies && n.applies !== EVERY_REPO)) continue;
+      out.push({ ...n, scope: "personal", applies: EVERY_REPO });
+    } catch {
+      /* unreadable: skip */
+    }
+  }
+  return liveLearnings(out).filter((n) => n.kind !== "lesson");
+}
@@ -0,0 +1,40 @@
+/**
+ * The learning a kept guardrail writes (design 2.2): the catalog's template
+ * text, never model-written. `no-timeout` is a machine fact, so it holds in
+ * every repo whatever `applies` says (R49), and carries the check the
+ * PreToolUse fast path enforces; `push-over-ssh` is text only and holds
+ * where it was kept.
+ */
+import { flatLine } from "./flatten.js";
+import { EVERY_REPO } from "./learning-fields.js";
+import type { LearningInput } from "./every-repo.js";
+import { WALLS } from "../trace/walls.js";
+import type { WallClass } from "../trace/types.js";
+
+/** YYYY-MM-DD of `d` in local time (days are local dates). */
+function localDay(d: Date): string {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+}
+
+/**
+ * The learning a kept guardrail writes (2.2). Template text only; never model-written. Throws for a class with no
+ * template. `author` is '' (the person kept it at init; the screen named it).
+ */
+export function guardrailLearning(cls: WallClass, applies: string, evidence: string, now: Date = new Date()): LearningInput {
+  const w = WALLS.find((x) => x.cls === cls);
+  const g = w?.guardrail;
+  if (!w || !g) throw new Error(`guardrailLearning: ${String(cls)} has no guardrail`);
+  const where = g.applies === "every repo" ? EVERY_REPO : applies;
+  return {
+    title: g.title,
+    body: g.text,
+    author: "",
+    date: localDay(now),
+    kind: "guardrail",
+    applies: where,
+    src: "error-class",
+    ...(g.check ? { check: g.check, enforce: "sure-fail" as const } : {}),
+    wall: cls,
+    evidence: flatLine(evidence, 160),
+  };
+}