- report: round SessionsPerMonth and floor an active user to 1 so a
  low-frequency user (e.g. 1 session in 31 days) no longer gets a silent
  $0.00/month estimate from integer truncation.
- mute: strip a multi-line YAML description's continuation lines (block and
  folded scalars) instead of leaving malformed frontmatter behind; key each
  backup by a hash of the skill name so names that sanitize to the same
  string no longer clobber each other's backup.
- hook: match our marker as a trailing shell comment rather than a substring
  so a foreign hook that merely mentions the marker survives install and
  uninstall; shell-quote the executable path in the installed command.
- cmd: guard state-mutating commands (keep/restore/mute/unmute/install-hook/
  uninstall-hook) when no Claude directory is resolved, instead of writing
  state into the current working directory.

The invocation key has always been the directory/file name (plus any plugin
prefix) — that is how skills and agents are addressed in transcripts. The
frontmatter name was parsed into a variable that was then discarded
(staticcheck SA4006). Remove the dead read and document that the name field
is metadata, not the invocation key.

- mute: `reap mute <name>` now resolves agents as well as skills (findItem);
  previously the named path filtered to skills only, so `reap mute <agent>`
  always failed with "no skill found" even though `--all` muted agents.
- mute: bare `reap mute` and `reap mute --all` now preview the candidates and
  prompt [Y/n] (honoring --yes), matching prune. Before, a bare `reap mute`
  with a forgotten name silently stripped every eligible skill and agent.
- mute: skip already-muted items in bulk via errors.Is(ErrAlreadyMuted)
  instead of comparing the formatted error string.
- factor the prune/mute confirmation prompt into a shared confirm helper.

Each destructive op mutated a file before recording the action, so a failure
to write the manifest/state left the change with no way to undo it.

- QuarantineItem: roll the moved item back to its original location if the
  manifest write fails.
- RemoveMCP: read the manifest before editing the config, and restore the
  original config if the manifest write fails.
- Mute: restore the original SKILL.md if the mute-state write fails, so a
  skill is never left stripped with no recorded way to unmute it.
- RestoreAll / UnmuteAll: persist the items already restored before returning
  a mid-iteration error, instead of discarding that progress. UnmuteAll now
  restores in sorted order for deterministic behavior.

Add internal/atomicfile, which writes via a temp file in the same directory
followed by a rename, so a crash mid-write leaves the complete old or new file
rather than a truncated one. Use it for the externally-shared configs whose
corruption would break the user's Claude Code setup: settings.json (hook
install/uninstall) and the MCP config file (RemoveMCP edit, its rollback, and
restore). Internal reaped/ metadata keeps direct writes — it is small and
already protected by the prune/mute rollback paths.

The sqlite3 CLI was invoked with the parent environment and no time bound.

- Bound it with a 60s context timeout so a huge or pathological database
  cannot hang reap indefinitely.
- Pass -init os.DevNull so a hostile ~/.sqliterc cannot run shell commands or
  load extensions when the CLI starts.
- Run with a minimal environment (only TMPDIR) so an inherited PATH or HOME
  cannot influence which binary runs or which config it reads. The binary is
  already resolved to an absolute path via LookPath.

- prune: validate paths from the manifest before acting on them. File moves
  must stay within the Claude directory and MCP config writes within the home
  tree, so a tampered manifest cannot turn `reap restore` into an arbitrary
  file move or overwrite (e.g. ~/.ssh/authorized_keys).
- write reap's state files (manifest.json, mute state.json, nudge-state.json,
  overrides.json) with 0600 instead of world-readable 0644.
- override: write overrides.json atomically.

The scanners read each config/markdown file whole before parsing; the line
scanners only bound per-line size. A crafted multi-gigabyte file placed under
the scan root could OOM the process. Route every scan read through readCapped,
which refuses files larger than 10 MiB (far above any real skill, agent, hook,
plugin, or CLAUDE.md file) and is treated like any other read error.

ScanProse walked ~/.claude/rules and stat'd every *.md, following symlinks. A
planted symlink could make reap surface a file outside the rules tree (its path
and size) in the report. Resolve each entry and skip any that resolves outside
the rules directory.

- New internal/safepath package dedupes WithinDir (was 3 copies) and
  Sanitize (was 2 copies) across scan/prune/mute so the confinement
  boundary can't drift between packages.
- mute: write the live SKILL.md and backup via atomicfile.Write
  (preserving the original file mode, backup owner-only) so a crash no
  longer leaves a corrupt skill file; rollback now restores the original
  and removes the orphan backup, surfacing any rollback failure.
- prune: RemoveMCP now surfaces a rollback failure instead of swallowing
  it, so a modified config is never left without a manifest record.
- atomicfile: fsync the parent directory after rename for crash durability.
- usage: Parse sets IncompleteEvidence on mid-walk read/stat errors and
  continues, instead of silently swallowing the failure.
- report: truncate() is now rune-aware so multibyte skill names don't
  emit invalid UTF-8; document the plugin/personal suffix collision in
  lookupUses.