pwn 0.5.784 → 0.5.785

data/documentation/diagrams/plugin-ecosystem.svg

@@ -9,135 +9,135 @@
 <g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(43.2 636.7)">
 <title>PWN_Plugins</title>
 <polygon fill="#0f172a" stroke="none" points="-43.2,43.2 -43.2,-636.7 634.45,-636.7 634.45,43.2 -43.2,43.2"/>
-<text xml:space="preserve" text-anchor="start" x="8" y="-571.5" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">PWN::Plugins &#45; Selected categories from 107 plugin modules</text>
+<text xml:space="preserve" text-anchor="start" x="8" y="-571.5" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">PWN::Plugins &#45; Selected categories from 108 plugin modules</text>
 <g id="clust1" class="cluster">
 <title>cluster_cat</title>
 </g>
 <!-- Root -->
 <g id="node1" class="node">
 <title>Root</title>
-<path fill="#7dd3fc" stroke="#334155" stroke-width="2" d="M115.12,-303.25C115.12,-303.25 39.12,-303.25 39.12,-303.25 33.12,-303.25 27.12,-297.25 27.12,-291.25 27.12,-291.25 27.12,-279.25 27.12,-279.25 27.12,-273.25 33.12,-267.25 39.12,-267.25 39.12,-267.25 115.12,-267.25 115.12,-267.25 121.12,-267.25 127.12,-273.25 127.12,-279.25 127.12,-279.25 127.12,-291.25 127.12,-291.25 127.12,-297.25 121.12,-303.25 115.12,-303.25"/>
-<text xml:space="preserve" text-anchor="middle" x="77.12" y="-279.82" font-family="sans-Serif" font-size="14.00" fill="#0f172a">PWN::Plugins</text>
+<path fill="#7dd3fc" stroke="#334155" stroke-width="2" d="M108.38,-303.25C108.38,-303.25 32.38,-303.25 32.38,-303.25 26.38,-303.25 20.38,-297.25 20.38,-291.25 20.38,-291.25 20.38,-279.25 20.38,-279.25 20.38,-273.25 26.38,-267.25 32.38,-267.25 32.38,-267.25 108.38,-267.25 108.38,-267.25 114.38,-267.25 120.38,-273.25 120.38,-279.25 120.38,-279.25 120.38,-291.25 120.38,-291.25 120.38,-297.25 114.38,-303.25 108.38,-303.25"/>
+<text xml:space="preserve" text-anchor="middle" x="70.38" y="-279.82" font-family="sans-Serif" font-size="14.00" fill="#0f172a">PWN::Plugins</text>
 </g>
 <!-- Web -->
 <g id="node2" class="node">
 <title>Web</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M287.88,-546.25C287.88,-546.25 247.12,-546.25 247.12,-546.25 241.12,-546.25 235.12,-540.25 235.12,-534.25 235.12,-534.25 235.12,-522.25 235.12,-522.25 235.12,-516.25 241.12,-510.25 247.12,-510.25 247.12,-510.25 287.88,-510.25 287.88,-510.25 293.88,-510.25 299.88,-516.25 299.88,-522.25 299.88,-522.25 299.88,-534.25 299.88,-534.25 299.88,-540.25 293.88,-546.25 287.88,-546.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-524.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Web / Proxy</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M281.12,-546.25C281.12,-546.25 240.38,-546.25 240.38,-546.25 234.38,-546.25 228.38,-540.25 228.38,-534.25 228.38,-534.25 228.38,-522.25 228.38,-522.25 228.38,-516.25 234.38,-510.25 240.38,-510.25 240.38,-510.25 281.12,-510.25 281.12,-510.25 287.12,-510.25 293.12,-516.25 293.12,-522.25 293.12,-522.25 293.12,-534.25 293.12,-534.25 293.12,-540.25 287.12,-546.25 281.12,-546.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-524.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Web / Proxy</text>
 </g>
 <!-- Root&#45;&gt;Web -->
 <g id="edge1" class="edge">
 <title>Root&#45;&gt;Web</title>
-<path fill="none" stroke="#94a3b8" d="M87.93,-303.98C109.32,-343.65 163.42,-437.72 227.12,-501.25 228.56,-502.68 230.07,-504.08 231.64,-505.44"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="230,-506.82 235.98,-508.98 232.66,-503.56 230,-506.82"/>
+<path fill="none" stroke="#94a3b8" d="M81.18,-303.98C102.57,-343.65 156.67,-437.72 220.38,-501.25 221.81,-502.68 223.32,-504.08 224.89,-505.44"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="223.25,-506.82 229.23,-508.98 225.91,-503.56 223.25,-506.82"/>
 </g>
 <!-- Net -->
 <g id="node3" class="node">
 <title>Net</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M282.5,-492.25C282.5,-492.25 252.5,-492.25 252.5,-492.25 246.5,-492.25 240.5,-486.25 240.5,-480.25 240.5,-480.25 240.5,-468.25 240.5,-468.25 240.5,-462.25 246.5,-456.25 252.5,-456.25 252.5,-456.25 282.5,-456.25 282.5,-456.25 288.5,-456.25 294.5,-462.25 294.5,-468.25 294.5,-468.25 294.5,-480.25 294.5,-480.25 294.5,-486.25 288.5,-492.25 282.5,-492.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-470.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Network</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M275.75,-492.25C275.75,-492.25 245.75,-492.25 245.75,-492.25 239.75,-492.25 233.75,-486.25 233.75,-480.25 233.75,-480.25 233.75,-468.25 233.75,-468.25 233.75,-462.25 239.75,-456.25 245.75,-456.25 245.75,-456.25 275.75,-456.25 275.75,-456.25 281.75,-456.25 287.75,-462.25 287.75,-468.25 287.75,-468.25 287.75,-480.25 287.75,-480.25 287.75,-486.25 281.75,-492.25 275.75,-492.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-470.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Network</text>
 </g>
 <!-- Root&#45;&gt;Net -->
 <g id="edge2" class="edge">
 <title>Root&#45;&gt;Net</title>
-<path fill="none" stroke="#94a3b8" d="M92.99,-304.01C118.51,-335.58 173.13,-400.45 227.12,-447.25 229.38,-449.2 231.78,-451.14 234.24,-453.03"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="232.75,-454.55 238.83,-456.43 235.25,-451.17 232.75,-454.55"/>
+<path fill="none" stroke="#94a3b8" d="M86.24,-304.01C111.76,-335.58 166.38,-400.45 220.38,-447.25 222.63,-449.2 225.03,-451.14 227.49,-453.03"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="226,-454.55 232.08,-456.43 228.5,-451.17 226,-454.55"/>
 </g>
 <!-- Xpl -->
 <g id="node4" class="node">
 <title>Xpl</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M287.5,-438.25C287.5,-438.25 247.5,-438.25 247.5,-438.25 241.5,-438.25 235.5,-432.25 235.5,-426.25 235.5,-426.25 235.5,-414.25 235.5,-414.25 235.5,-408.25 241.5,-402.25 247.5,-402.25 247.5,-402.25 287.5,-402.25 287.5,-402.25 293.5,-402.25 299.5,-408.25 299.5,-414.25 299.5,-414.25 299.5,-426.25 299.5,-426.25 299.5,-432.25 293.5,-438.25 287.5,-438.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-416.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Exploitation</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M280.75,-438.25C280.75,-438.25 240.75,-438.25 240.75,-438.25 234.75,-438.25 228.75,-432.25 228.75,-426.25 228.75,-426.25 228.75,-414.25 228.75,-414.25 228.75,-408.25 234.75,-402.25 240.75,-402.25 240.75,-402.25 280.75,-402.25 280.75,-402.25 286.75,-402.25 292.75,-408.25 292.75,-414.25 292.75,-414.25 292.75,-426.25 292.75,-426.25 292.75,-432.25 286.75,-438.25 280.75,-438.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-416.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Exploitation</text>
 </g>
 <!-- Root&#45;&gt;Xpl -->
 <g id="edge3" class="edge">
 <title>Root&#45;&gt;Xpl</title>
-<path fill="none" stroke="#94a3b8" d="M103.82,-304.19C133.4,-325.91 183.52,-362.5 227.12,-393.25 229.09,-394.64 231.11,-396.05 233.16,-397.48"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="231.95,-399.2 238.08,-400.89 234.35,-395.74 231.95,-399.2"/>
+<path fill="none" stroke="#94a3b8" d="M97.07,-304.19C126.65,-325.91 176.77,-362.5 220.38,-393.25 222.34,-394.64 224.36,-396.05 226.41,-397.48"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="225.2,-399.2 231.33,-400.89 227.6,-395.74 225.2,-399.2"/>
 </g>
 <!-- Osint -->
 <g id="node5" class="node">
 <title>Osint</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M282.5,-384.25C282.5,-384.25 252.5,-384.25 252.5,-384.25 246.5,-384.25 240.5,-378.25 240.5,-372.25 240.5,-372.25 240.5,-360.25 240.5,-360.25 240.5,-354.25 246.5,-348.25 252.5,-348.25 252.5,-348.25 282.5,-348.25 282.5,-348.25 288.5,-348.25 294.5,-354.25 294.5,-360.25 294.5,-360.25 294.5,-372.25 294.5,-372.25 294.5,-378.25 288.5,-384.25 282.5,-384.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-362.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">OSINT</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M275.75,-384.25C275.75,-384.25 245.75,-384.25 245.75,-384.25 239.75,-384.25 233.75,-378.25 233.75,-372.25 233.75,-372.25 233.75,-360.25 233.75,-360.25 233.75,-354.25 239.75,-348.25 245.75,-348.25 245.75,-348.25 275.75,-348.25 275.75,-348.25 281.75,-348.25 287.75,-354.25 287.75,-360.25 287.75,-360.25 287.75,-372.25 287.75,-372.25 287.75,-378.25 281.75,-384.25 275.75,-384.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-362.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">OSINT</text>
 </g>
 <!-- Root&#45;&gt;Osint -->
 <g id="edge4" class="edge">
 <title>Root&#45;&gt;Osint</title>
-<path fill="none" stroke="#94a3b8" d="M122.29,-304.24C156.26,-318.85 202.46,-338.71 233.32,-351.98"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="232.31,-353.84 238.66,-354.28 233.97,-349.98 232.31,-353.84"/>
+<path fill="none" stroke="#94a3b8" d="M115.54,-304.24C149.51,-318.85 195.71,-338.71 226.57,-351.98"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="225.56,-353.84 231.91,-354.28 227.22,-349.98 225.56,-353.84"/>
 </g>
 <!-- Data -->
 <g id="node6" class="node">
 <title>Data</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M286.38,-330.25C286.38,-330.25 248.62,-330.25 248.62,-330.25 242.62,-330.25 236.62,-324.25 236.62,-318.25 236.62,-318.25 236.62,-306.25 236.62,-306.25 236.62,-300.25 242.62,-294.25 248.62,-294.25 248.62,-294.25 286.38,-294.25 286.38,-294.25 292.38,-294.25 298.38,-300.25 298.38,-306.25 298.38,-306.25 298.38,-318.25 298.38,-318.25 298.38,-324.25 292.38,-330.25 286.38,-330.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-308.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Data / DAO</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M279.62,-330.25C279.62,-330.25 241.88,-330.25 241.88,-330.25 235.88,-330.25 229.88,-324.25 229.88,-318.25 229.88,-318.25 229.88,-306.25 229.88,-306.25 229.88,-300.25 235.88,-294.25 241.88,-294.25 241.88,-294.25 279.62,-294.25 279.62,-294.25 285.62,-294.25 291.62,-300.25 291.62,-306.25 291.62,-306.25 291.62,-318.25 291.62,-318.25 291.62,-324.25 285.62,-330.25 279.62,-330.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-308.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Data / DAO</text>
 </g>
 <!-- Root&#45;&gt;Data -->
 <g id="edge5" class="edge">
 <title>Root&#45;&gt;Data</title>
-<path fill="none" stroke="#94a3b8" d="M128.11,-292.41C159.76,-296.95 200.03,-302.72 228.95,-306.87"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="228.32,-308.9 234.55,-307.67 228.91,-304.74 228.32,-308.9"/>
+<path fill="none" stroke="#94a3b8" d="M121.36,-292.41C153.01,-296.95 193.28,-302.72 222.2,-306.87"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="221.57,-308.9 227.8,-307.67 222.16,-304.74 221.57,-308.9"/>
 </g>
 <!-- Auth -->
 <g id="node7" class="node">
 <title>Auth</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M282.5,-276.25C282.5,-276.25 252.5,-276.25 252.5,-276.25 246.5,-276.25 240.5,-270.25 240.5,-264.25 240.5,-264.25 240.5,-252.25 240.5,-252.25 240.5,-246.25 246.5,-240.25 252.5,-240.25 252.5,-240.25 282.5,-240.25 282.5,-240.25 288.5,-240.25 294.5,-246.25 294.5,-252.25 294.5,-252.25 294.5,-264.25 294.5,-264.25 294.5,-270.25 288.5,-276.25 282.5,-276.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-254.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Auth</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M275.75,-276.25C275.75,-276.25 245.75,-276.25 245.75,-276.25 239.75,-276.25 233.75,-270.25 233.75,-264.25 233.75,-264.25 233.75,-252.25 233.75,-252.25 233.75,-246.25 239.75,-240.25 245.75,-240.25 245.75,-240.25 275.75,-240.25 275.75,-240.25 281.75,-240.25 287.75,-246.25 287.75,-252.25 287.75,-252.25 287.75,-264.25 287.75,-264.25 287.75,-270.25 281.75,-276.25 275.75,-276.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-254.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Auth</text>
 </g>
 <!-- Root&#45;&gt;Auth -->
 <g id="edge6" class="edge">
 <title>Root&#45;&gt;Auth</title>
-<path fill="none" stroke="#94a3b8" d="M128.11,-278.09C161.27,-273.33 203.88,-267.23 233.01,-263.05"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="232.97,-265.18 238.61,-262.25 232.37,-261.02 232.97,-265.18"/>
+<path fill="none" stroke="#94a3b8" d="M121.36,-278.09C154.52,-273.33 197.13,-267.23 226.26,-263.05"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="226.22,-265.18 231.86,-262.25 225.62,-261.02 226.22,-265.18"/>
 </g>
 <!-- HW -->
 <g id="node8" class="node">
 <title>HW</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M283.75,-222.25C283.75,-222.25 251.25,-222.25 251.25,-222.25 245.25,-222.25 239.25,-216.25 239.25,-210.25 239.25,-210.25 239.25,-198.25 239.25,-198.25 239.25,-192.25 245.25,-186.25 251.25,-186.25 251.25,-186.25 283.75,-186.25 283.75,-186.25 289.75,-186.25 295.75,-192.25 295.75,-198.25 295.75,-198.25 295.75,-210.25 295.75,-210.25 295.75,-216.25 289.75,-222.25 283.75,-222.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-200.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Hardware</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M277,-222.25C277,-222.25 244.5,-222.25 244.5,-222.25 238.5,-222.25 232.5,-216.25 232.5,-210.25 232.5,-210.25 232.5,-198.25 232.5,-198.25 232.5,-192.25 238.5,-186.25 244.5,-186.25 244.5,-186.25 277,-186.25 277,-186.25 283,-186.25 289,-192.25 289,-198.25 289,-198.25 289,-210.25 289,-210.25 289,-216.25 283,-222.25 277,-222.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-200.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Hardware</text>
 </g>
 <!-- Root&#45;&gt;HW -->
 <g id="edge7" class="edge">
 <title>Root&#45;&gt;HW</title>
-<path fill="none" stroke="#94a3b8" d="M122.29,-266.26C155.75,-251.87 201.09,-232.38 231.93,-219.11"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="232.6,-221.11 237.28,-216.81 230.94,-217.26 232.6,-221.11"/>
+<path fill="none" stroke="#94a3b8" d="M115.54,-266.26C149,-251.87 194.34,-232.38 225.18,-219.11"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="225.85,-221.11 230.53,-216.81 224.19,-217.26 225.85,-221.11"/>
 </g>
 <!-- CI -->
 <g id="node9" class="node">
 <title>CI</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M287.88,-168.25C287.88,-168.25 247.12,-168.25 247.12,-168.25 241.12,-168.25 235.12,-162.25 235.12,-156.25 235.12,-156.25 235.12,-144.25 235.12,-144.25 235.12,-138.25 241.12,-132.25 247.12,-132.25 247.12,-132.25 287.88,-132.25 287.88,-132.25 293.88,-132.25 299.88,-138.25 299.88,-144.25 299.88,-144.25 299.88,-156.25 299.88,-156.25 299.88,-162.25 293.88,-168.25 287.88,-168.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-146.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">CI / DevOps</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M281.12,-168.25C281.12,-168.25 240.38,-168.25 240.38,-168.25 234.38,-168.25 228.38,-162.25 228.38,-156.25 228.38,-156.25 228.38,-144.25 228.38,-144.25 228.38,-138.25 234.38,-132.25 240.38,-132.25 240.38,-132.25 281.12,-132.25 281.12,-132.25 287.12,-132.25 293.12,-138.25 293.12,-144.25 293.12,-144.25 293.12,-156.25 293.12,-156.25 293.12,-162.25 287.12,-168.25 281.12,-168.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-146.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">CI / DevOps</text>
 </g>
 <!-- Root&#45;&gt;CI -->
 <g id="edge8" class="edge">
 <title>Root&#45;&gt;CI</title>
-<path fill="none" stroke="#94a3b8" d="M103.82,-266.31C133.4,-244.59 183.52,-208 227.12,-177.25 229.09,-175.86 231.11,-174.45 233.16,-173.02"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="234.35,-174.76 238.08,-169.61 231.95,-171.3 234.35,-174.76"/>
+<path fill="none" stroke="#94a3b8" d="M97.07,-266.31C126.65,-244.59 176.77,-208 220.38,-177.25 222.34,-175.86 224.36,-174.45 226.41,-173.02"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="227.6,-174.76 231.33,-169.61 225.2,-171.3 227.6,-174.76"/>
 </g>
 <!-- Comm -->
 <g id="node10" class="node">
 <title>Comm</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M282.5,-114.25C282.5,-114.25 252.5,-114.25 252.5,-114.25 246.5,-114.25 240.5,-108.25 240.5,-102.25 240.5,-102.25 240.5,-90.25 240.5,-90.25 240.5,-84.25 246.5,-78.25 252.5,-78.25 252.5,-78.25 282.5,-78.25 282.5,-78.25 288.5,-78.25 294.5,-84.25 294.5,-90.25 294.5,-90.25 294.5,-102.25 294.5,-102.25 294.5,-108.25 288.5,-114.25 282.5,-114.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-92.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Comms</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M275.75,-114.25C275.75,-114.25 245.75,-114.25 245.75,-114.25 239.75,-114.25 233.75,-108.25 233.75,-102.25 233.75,-102.25 233.75,-90.25 233.75,-90.25 233.75,-84.25 239.75,-78.25 245.75,-78.25 245.75,-78.25 275.75,-78.25 275.75,-78.25 281.75,-78.25 287.75,-84.25 287.75,-90.25 287.75,-90.25 287.75,-102.25 287.75,-102.25 287.75,-108.25 281.75,-114.25 275.75,-114.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-92.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Comms</text>
 </g>
 <!-- Root&#45;&gt;Comm -->
 <g id="edge9" class="edge">
 <title>Root&#45;&gt;Comm</title>
-<path fill="none" stroke="#94a3b8" d="M92.99,-266.49C118.51,-234.92 173.13,-170.05 227.12,-123.25 229.38,-121.3 231.78,-119.36 234.24,-117.47"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="235.25,-119.33 238.83,-114.07 232.75,-115.95 235.25,-119.33"/>
+<path fill="none" stroke="#94a3b8" d="M86.24,-266.49C111.76,-234.92 166.38,-170.05 220.38,-123.25 222.63,-121.3 225.03,-119.36 227.49,-117.47"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="228.5,-119.33 232.08,-114.07 226,-115.95 228.5,-119.33"/>
 </g>
 <!-- Util -->
 <g id="node11" class="node">
 <title>Util</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M282.5,-60.25C282.5,-60.25 252.5,-60.25 252.5,-60.25 246.5,-60.25 240.5,-54.25 240.5,-48.25 240.5,-48.25 240.5,-36.25 240.5,-36.25 240.5,-30.25 246.5,-24.25 252.5,-24.25 252.5,-24.25 282.5,-24.25 282.5,-24.25 288.5,-24.25 294.5,-30.25 294.5,-36.25 294.5,-36.25 294.5,-48.25 294.5,-48.25 294.5,-54.25 288.5,-60.25 282.5,-60.25"/>
-<text xml:space="preserve" text-anchor="middle" x="267.5" y="-38.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Utility</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.2" d="M275.75,-60.25C275.75,-60.25 245.75,-60.25 245.75,-60.25 239.75,-60.25 233.75,-54.25 233.75,-48.25 233.75,-48.25 233.75,-36.25 233.75,-36.25 233.75,-30.25 239.75,-24.25 245.75,-24.25 245.75,-24.25 275.75,-24.25 275.75,-24.25 281.75,-24.25 287.75,-30.25 287.75,-36.25 287.75,-36.25 287.75,-48.25 287.75,-48.25 287.75,-54.25 281.75,-60.25 275.75,-60.25"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-38.95" font-family="sans-Serif" font-size="9.00" fill="#0f172a">Utility</text>
 </g>
 <!-- Root&#45;&gt;Util -->
 <g id="edge10" class="edge">
 <title>Root&#45;&gt;Util</title>
-<path fill="none" stroke="#94a3b8" d="M87.93,-266.52C109.32,-226.85 163.42,-132.78 227.12,-69.25 229.3,-67.08 231.68,-64.97 234.15,-62.95"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="235.36,-64.66 238.83,-59.33 232.8,-61.34 235.36,-64.66"/>
+<path fill="none" stroke="#94a3b8" d="M81.18,-266.52C102.57,-226.85 156.67,-132.78 220.38,-69.25 222.55,-67.08 224.93,-64.97 227.4,-62.95"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="228.61,-64.66 232.08,-59.33 226.05,-61.34 228.61,-64.66"/>
 </g>
 <!-- w -->
 <g id="node12" class="node">
@@ -150,8 +150,8 @@
 <!-- Web&#45;&gt;w -->
 <g id="edge11" class="edge">
 <title>Web&#45;&gt;w</title>
-<path fill="none" stroke="#94a3b8" d="M300.45,-528.55C329.56,-528.81 373.65,-529.22 411.44,-529.57"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="411.37,-531.67 417.39,-529.63 411.41,-527.47 411.37,-531.67"/>
+<path fill="none" stroke="#94a3b8" d="M293.26,-528.53C323.93,-528.81 371.64,-529.23 411.79,-529.59"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="411.67,-531.69 417.68,-529.65 411.7,-527.49 411.67,-531.69"/>
 </g>
 <!-- n -->
 <g id="node13" class="node">
@@ -163,8 +163,8 @@
 <!-- Net&#45;&gt;n -->
 <g id="edge12" class="edge">
 <title>Net&#45;&gt;n</title>
-<path fill="none" stroke="#94a3b8" d="M295.05,-474.25C327.18,-474.25 382.26,-474.25 424.86,-474.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="424.61,-476.35 430.61,-474.25 424.61,-472.15 424.61,-476.35"/>
+<path fill="none" stroke="#94a3b8" d="M288.24,-474.25C321.72,-474.25 380.35,-474.25 424.93,-474.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="424.73,-476.35 430.73,-474.25 424.73,-472.15 424.73,-476.35"/>
 </g>
 <!-- x -->
 <g id="node14" class="node">
@@ -176,8 +176,8 @@
 <!-- Xpl&#45;&gt;x -->
 <g id="edge13" class="edge">
 <title>Xpl&#45;&gt;x</title>
-<path fill="none" stroke="#94a3b8" d="M299.98,-420.25C335.61,-420.25 394.08,-420.25 435.76,-420.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="435.56,-422.35 441.56,-420.25 435.56,-418.15 435.56,-422.35"/>
+<path fill="none" stroke="#94a3b8" d="M293.26,-420.25C330.3,-420.25 392.22,-420.25 435.64,-420.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="435.47,-422.35 441.47,-420.25 435.47,-418.15 435.47,-422.35"/>
 </g>
 <!-- o -->
 <g id="node15" class="node">
@@ -189,8 +189,8 @@
 <!-- Osint&#45;&gt;o -->
 <g id="edge14" class="edge">
 <title>Osint&#45;&gt;o</title>
-<path fill="none" stroke="#94a3b8" d="M295.05,-366.25C328.56,-366.25 387.06,-366.25 430.31,-366.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="430.14,-368.35 436.14,-366.25 430.14,-364.15 430.14,-368.35"/>
+<path fill="none" stroke="#94a3b8" d="M288.24,-366.25C323.03,-366.25 384.99,-366.25 430.11,-366.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="429.97,-368.35 435.97,-366.25 429.97,-364.15 429.97,-368.35"/>
 </g>
 <!-- d -->
 <g id="node16" class="node">
@@ -202,21 +202,21 @@
 <!-- Data&#45;&gt;d -->
 <g id="edge15" class="edge">
 <title>Data&#45;&gt;d</title>
-<path fill="none" stroke="#94a3b8" d="M298.6,-312.25C326.38,-312.25 368.85,-312.25 406.25,-312.25"/>
+<path fill="none" stroke="#94a3b8" d="M291.86,-312.25C321.1,-312.25 366.76,-312.25 406.34,-312.25"/>
 <polygon fill="#94a3b8" stroke="#94a3b8" points="406.14,-314.35 412.14,-312.25 406.14,-310.15 406.14,-314.35"/>
 </g>
 <!-- a -->
 <g id="node17" class="node">
 <title>a</title>
-<path fill="#fcd34d" stroke="#334155" stroke-width="1.2" d="M538.62,-276.25C538.62,-276.25 433.38,-276.25 433.38,-276.25 427.38,-276.25 421.38,-270.25 421.38,-264.25 421.38,-264.25 421.38,-252.25 421.38,-252.25 421.38,-246.25 427.38,-240.25 433.38,-240.25 433.38,-240.25 538.62,-240.25 538.62,-240.25 544.62,-240.25 550.62,-246.25 550.62,-252.25 550.62,-252.25 550.62,-264.25 550.62,-264.25 550.62,-270.25 544.62,-276.25 538.62,-276.25"/>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.2" d="M558.88,-276.25C558.88,-276.25 413.12,-276.25 413.12,-276.25 407.12,-276.25 401.12,-270.25 401.12,-264.25 401.12,-264.25 401.12,-252.25 401.12,-252.25 401.12,-246.25 407.12,-240.25 413.12,-240.25 413.12,-240.25 558.88,-240.25 558.88,-240.25 564.88,-240.25 570.88,-246.25 570.88,-252.25 570.88,-252.25 570.88,-264.25 570.88,-264.25 570.88,-270.25 564.88,-276.25 558.88,-276.25"/>
 <text xml:space="preserve" text-anchor="middle" x="486" y="-260.2" font-family="sans-Serif" font-size="9.00" fill="#0f172a">OAuth2 · BasicAuth</text>
-<text xml:space="preserve" text-anchor="middle" x="486" y="-249.7" font-family="sans-Serif" font-size="9.00" fill="#0f172a">AuthenticationHelper · Vault</text>
+<text xml:space="preserve" text-anchor="middle" x="486" y="-249.7" font-family="sans-Serif" font-size="9.00" fill="#0f172a">AuthenticationHelper · Vault · YubiKey</text>
 </g>
 <!-- Auth&#45;&gt;a -->
 <g id="edge16" class="edge">
 <title>Auth&#45;&gt;a</title>
-<path fill="none" stroke="#94a3b8" d="M295.05,-258.25C324.39,-258.25 372.87,-258.25 413.5,-258.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="413.48,-260.35 419.48,-258.25 413.48,-256.15 413.48,-260.35"/>
+<path fill="none" stroke="#94a3b8" d="M288.24,-258.25C314.28,-258.25 355.54,-258.25 393.57,-258.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="393.11,-260.35 399.11,-258.25 393.11,-256.15 393.11,-260.35"/>
 </g>
 <!-- h -->
 <g id="node18" class="node">
@@ -228,8 +228,8 @@
 <!-- HW&#45;&gt;h -->
 <g id="edge17" class="edge">
 <title>HW&#45;&gt;h</title>
-<path fill="none" stroke="#94a3b8" d="M295.92,-204.25C325.06,-204.25 372.34,-204.25 412.34,-204.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="412.2,-206.35 418.2,-204.25 412.2,-202.15 412.2,-206.35"/>
+<path fill="none" stroke="#94a3b8" d="M289.57,-204.25C320.12,-204.25 370.39,-204.25 412.29,-204.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="412.23,-206.35 418.23,-204.25 412.23,-202.15 412.23,-206.35"/>
 </g>
 <!-- c -->
 <g id="node19" class="node">
@@ -241,8 +241,8 @@
 <!-- CI&#45;&gt;c -->
 <g id="edge18" class="edge">
 <title>CI&#45;&gt;c</title>
-<path fill="none" stroke="#94a3b8" d="M300.45,-150.25C332.45,-150.25 382.55,-150.25 422.48,-150.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="422.3,-152.35 428.3,-150.25 422.3,-148.15 422.3,-152.35"/>
+<path fill="none" stroke="#94a3b8" d="M293.26,-150.25C326.6,-150.25 380.08,-150.25 422.1,-150.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="422.03,-152.35 428.03,-150.25 422.03,-148.15 422.03,-152.35"/>
 </g>
 <!-- m -->
 <g id="node20" class="node">
@@ -254,8 +254,8 @@
 <!-- Comm&#45;&gt;m -->
 <g id="edge19" class="edge">
 <title>Comm&#45;&gt;m</title>
-<path fill="none" stroke="#94a3b8" d="M295.05,-96.25C321.19,-96.25 362.54,-96.25 400,-96.25"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="399.92,-98.35 405.92,-96.25 399.92,-94.15 399.92,-98.35"/>
+<path fill="none" stroke="#94a3b8" d="M288.24,-96.25C315.75,-96.25 360.24,-96.25 399.97,-96.25"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="399.81,-98.35 405.81,-96.25 399.81,-94.15 399.81,-98.35"/>
 </g>
 <!-- u -->
 <g id="node21" class="node">
@@ -270,8 +270,8 @@
 <!-- Util&#45;&gt;u -->
 <g id="edge20" class="edge">
 <title>Util&#45;&gt;u</title>
-<path fill="none" stroke="#94a3b8" d="M295.05,-40.78C323.22,-39.22 369.03,-36.68 408.61,-34.48"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" points="408.54,-36.59 414.41,-34.16 408.3,-32.4 408.54,-36.59"/>
+<path fill="none" stroke="#94a3b8" d="M288.24,-40.83C317.76,-39.24 366.86,-36.6 408.62,-34.36"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" points="408.67,-36.46 414.55,-34.04 408.44,-32.26 408.67,-36.46"/>
 </g>
 </g>
 </svg>

data/documentation/pwn-ai-Agent.md

@@ -5,6 +5,9 @@ the goal; the agent plans a sequence of tool calls (`pwn_eval`, `shell`,
 `memory_*`, `skill_*`, `mistakes_*`, `reward_*`, `curriculum_*`, `extro_*`,
 `agent_*`, ...), executes them against the live process, observes the results,
 and checks completion against the original request and available host evidence.
+Unspecified tool writes go to `~/.pwn/workspaces/runtime`. A path outside that
+directory is allowed only when the original request names it. See
+[Operability](Operability.md).
 Learning records failures and corrections; it cannot guarantee nonrecurrence.
 
 ## Two ways to run it
@@ -336,7 +339,9 @@ anthropic` opens that nested mapping, and `/vault edit ai anthropic model`
 opens a scalar. Tokens identify one nested key path, never filenames or multiple
 disjoint scopes. The target and decryptor are the same `driver_opts.pwn_env_path`
 and `driver_opts.pwn_dec_path` used by `pwn-vault`, defaulting to
-`~/.pwn/pwn.yaml` and its existing `.decryptor` sidecar. Unknown paths are rejected; edit the parent mapping
+`~/.pwn/pwn.yaml` and its existing legacy `.decryptor` sidecar. Hardware-backed
+[YubiKey vaults](YubiKey-Vaults.md) are detected without requiring a sidecar.
+Unknown paths are rejected; edit the parent mapping
 to add a new key. Arrays are edited as a whole, not by numeric path indices.
 Existing non-null types must be retained; an existing null may remain null or
 be replaced by a YAML value. The root must retain an `ai` mapping, a supported
@@ -355,8 +360,9 @@ only shipped schema key names, never reads/decrypts the vault, and never offers
 configuration values; existing custom keys can be typed explicitly.
 
 Plaintext is decrypted/edited in memory. Only encrypted bytes enter the private
-temporary file, which is atomically renamed over the vault using the same
-AES-256-CBC format/key/IV as `pwn-vault`; the decryptor is not regenerated.
+temporary file, which is atomically renamed over the vault using its existing
+backend: legacy AES-256-CBC key/IV or a fresh authenticated YubiKey envelope.
+The device is never provisioned and the legacy decryptor is not regenerated.
 Save re-reads the current document, preserves changes outside the selected scope,
 and refuses a changed selected scope (the whole document for unscoped edits).
 Editor instances serialize saves with a directory lock; a final ciphertext check
@@ -642,7 +648,7 @@ After the reply, `Learning.auto_introspect` calls `rsi_tick`. That tick reads ES
 
 ## What the agent can call
 
-16 toolsets · **150 tools** - full table at
+16 toolsets · **152 tools** - full table at
 [Agent Tool Registry](Agent-Tool-Registry.md).
 
 The two that matter most:

data/etc/default_cron/session_cleanup.rb

@@ -20,7 +20,7 @@ module PWN
       'learning' => %w[learning.jsonl learning lessons.json memory.json memory.archive.json memory.idx mistakes.json policy policy.json policy_traj.jsonl curriculum curriculum_kpi.jsonl extrospection.json finetune preferences.jsonl reward_sentinel.json skill_review.jsonl operator-learning-review.jsonl],
       'artifacts' => %w[artifacts exports findings.jsonl engagements corpora binws redb ghidra sandbox_snapshots],
       'state' => %w[swarm cron agents.yml open_goal.json jobs missions runs metrics metrics.json capabilities.json],
-      'logs' => %w[logs], 'cache' => %w[cache], 'tmp' => %w[tmp],
+      'logs' => %w[logs], 'cache' => %w[cache], 'tmp' => %w[workspaces/runtime],
       'maintenance' => %w[maintenance session_cleanup_archive],
       'backups' => %w[backup]
     }.freeze
@@ -38,16 +38,17 @@ module PWN
         raise IOError, 'Symlinked maintenance policy' if File.symlink?(path)
 
         publish(path, JSON.pretty_generate(POLICY)) unless File.exist?(path)
-        %w[cache tmp].each { |name| private_directory(File.join(root, name)) unless File.exist?(File.join(root, name)) }
+        private_directory(File.join(root, 'cache')) unless File.exist?(File.join(root, 'cache'))
+        private_directory(File.join(root, 'workspaces', 'runtime')) unless File.exist?(File.join(root, 'workspaces', 'runtime'))
         layout = File.join(directory, 'layout.json')
         raise IOError, 'Unsafe maintenance inventory' if File.symlink?(layout)
 
         previous = File.file?(layout) ? JSON.parse(File.binread(layout)) : nil
-        raise IOError, 'Unknown maintenance inventory version' if previous && ![1, 2].include?(previous['version'])
+        raise IOError, 'Unknown maintenance inventory version' if previous && ![1, 2, 3].include?(previous['version'])
 
-        publish(layout, JSON.generate(version: 2, categories: STORAGE)) unless previous && previous['version'] == 2
+        publish(layout, JSON.generate(version: 3, categories: STORAGE)) unless previous && previous['version'] == 3
       end
-      { version: 2, root: directory }
+      { version: 3, root: directory }
     end
 
     # Startup performs only fixed-path checks and one coalesced request write.
@@ -368,7 +369,7 @@ module PWN
     def self.register_disposable(path:, category:, expires_at: nil)
       raise ArgumentError, 'Not a disposable category' unless %w[cache tmp logs].include?(category)
 
-      root = File.join(Dir.home, '.pwn', category)
+      root = disposable_directory(category)
       path = File.expand_path(path)
       raise IOError, 'Disposable path escapes its category' unless path.start_with?("#{root}/") && File.realpath(path) == path
       raise IOError, 'Disposable must be an owned regular file' unless File.file?(path) && File.stat(path).uid == Process.uid
@@ -421,7 +422,7 @@ module PWN
     # Known disposable input producer. The permanent lease covers publication,
     # consumption and unlink; a killed consumer leaves a registered exact file.
     def self.temporary(bytes:)
-      directory = private_directory(File.join(Dir.home, '.pwn', 'tmp'))
+      directory = private_directory(disposable_directory('tmp'))
       path = File.join(directory, "input-#{SecureRandom.hex(12)}.txt")
       File.open("#{path}.lease", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lease|
         lease.flock(File::LOCK_EX)
@@ -465,6 +466,14 @@ module PWN
       path
     end
 
+    # Disposable category tmp lives in the runtime workspace, not ~/.pwn/tmp.
+    def self.disposable_directory(category)
+      raise ArgumentError, 'Not a disposable category' unless %w[cache tmp logs].include?(category)
+
+      base = File.join(Dir.home, '.pwn')
+      category == 'tmp' ? File.join(base, 'workspaces', 'runtime') : File.join(base, category)
+    end
+
     def self.private_directory(path)
       ancestor = File.expand_path(path)
       loop do
@@ -499,7 +508,7 @@ module PWN
       return 'unknown_schema' unless row.is_a?(Hash) && row['version'] == 1 && %w[cache tmp logs].include?(row['category']) && row['expires_at'].is_a?(Integer)
 
       path = row['path']
-      root = File.join(Dir.home, '.pwn', row['category'])
+      root = disposable_directory(row['category'])
       return 'unsafe_path' unless path.is_a?(String) && path.start_with?("#{root}/") && File.expand_path(path) == path
       return 'missing' unless File.exist?(path)
       return 'unsafe_path' unless File.realpath(path) == path && File.file?(path) && File.stat(path).uid == Process.uid
@@ -574,7 +583,7 @@ module PWN
             next if dry_run
 
             unless result[:ledger]
-              directory = private_directory(File.join(root, 'quarantine', SecureRandom.hex(12)))
+              directory = PWN::Backups.directory(label: 'disposable')
               result[:ledger] = File.join(directory, 'ledger.json')
             end
             backup_path = File.join(File.dirname(result[:ledger]), "#{Digest::SHA256.hexdigest(path)}.bin")
@@ -788,11 +797,14 @@ module PWN
     # children. Restoring a ledger alone never undoes deletion or migration.
     def self.recovery_status(ledger:)
       root = File.join(Dir.home, '.pwn')
-      prefixes = %w[maintenance session_cleanup_archive learning/migrations].map { |name| "#{File.join(root, name)}/" }
+      prefixes = %w[backup maintenance session_cleanup_archive learning/migrations].map { |name| "#{File.join(root, name)}/" }
       raise IOError, 'Unsafe recovery ledger' unless prefixes.any? { |prefix| ledger.start_with?(prefix) } && File.realpath(ledger) == ledger
 
       data = JSON.parse(File.binread(ledger))
       operation = data['operation']
+      operation = 'session_cleanup' if ledger.include?('/backup/') && data['records'].is_a?(Array) && data['deleted_ids'].is_a?(Array)
+      operation = 'continuation_retirement' if ledger.include?('/backup/') && data['backup'] == File.join(File.dirname(ledger), 'personas.json')
+      operation = 'session_layout' if ledger.include?('/backup/') && File.basename(ledger) == 'layout.json'
       operation = 'session_layout' if File.basename(ledger) == 'layout.json' && ledger.start_with?("#{File.join(root, 'session_cleanup_archive')}/") && data['records'].is_a?(Array)
       operation = 'learning_migration' if ledger.start_with?("#{File.join(root, 'learning', 'migrations')}/") && data['version'] == 1 && data['before_sha256'] == File.basename(ledger, '.json')
       operation = 'session_cleanup' if ledger.start_with?("#{File.join(root, 'session_cleanup_archive')}/") && data['dry_run'] == false && data['records'].is_a?(Array) && data['deleted_ids'].is_a?(Array)
@@ -841,7 +853,7 @@ module PWN
         end
       end
       root = File.join(Dir.home, '.pwn', 'maintenance', 'quarantine')
-      raise IOError, 'Unsafe recovery ledger' unless ledger.start_with?("#{root}/") && File.realpath(ledger) == ledger
+      raise IOError, 'Unsafe recovery ledger' unless [root, File.join(Dir.home, '.pwn', 'backup')].any? { |base| ledger.start_with?("#{base}/") } && File.realpath(ledger) == ledger
 
       data = JSON.parse(File.binread(ledger))
       raise IOError, 'Unknown recovery ledger' unless data['operation'] == 'routine' && data['records'].is_a?(Array)
@@ -851,7 +863,7 @@ module PWN
         data['records'].each do |row|
           path = row.fetch('path')
           category = row.fetch('category')
-          target_root = File.join(Dir.home, '.pwn', category)
+          target_root = disposable_directory(category)
           backup_path = row.fetch('backup')
           raise IOError, 'Unsafe recovery path' unless %w[cache tmp logs].include?(category) && path.start_with?("#{target_root}/") && File.expand_path(path) == path && File.realpath(File.dirname(path)) == File.dirname(path)
           raise IOError, 'Unsafe recovery backup' unless File.dirname(backup_path) == File.dirname(ledger) && File.realpath(backup_path) == backup_path && Digest::SHA256.file(backup_path).hexdigest == row['sha256']
@@ -1021,7 +1033,7 @@ module PWN
           File.open(PWN::Sessions.support_path(kind: :lease, session_id: id), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lease|
             raise IOError, 'Swarm continuation active' unless lease.flock(File::LOCK_EX | File::LOCK_NB)
 
-            directory = private_directory(File.join(Dir.home, '.pwn', 'maintenance', 'retirements', SecureRandom.hex(12)))
+            directory = PWN::Backups.directory(label: 'continuation')
             backup_path = File.join(directory, 'personas.json')
             publish(backup_path, bytes)
             raise IOError, 'Continuation backup mismatch' unless File.binread(backup_path) == bytes
@@ -1141,7 +1153,7 @@ module PWN
     def self.publish(path, bytes)
       temporary = "#{path}.#{SecureRandom.hex(8)}.tmp"
       root = File.join(Dir.home, '.pwn')
-      category = %w[cache tmp].find { |name| path.start_with?("#{File.join(root, name)}/") }
+      category = %w[cache tmp].find { |name| path.start_with?("#{disposable_directory(name)}/") }
       if category
         directory = private_directory(File.join(root, 'maintenance', 'atomic'))
         journal = File.join(directory, "#{SecureRandom.hex(12)}.json")
@@ -1183,7 +1195,7 @@ module PWN
           next if days.nil? || (expired_only && row.fetch('created_at') > Time.now.to_i - (days * 86_400))
 
           path, target = row.values_at('path', 'target')
-          base = "#{File.join(root, row['category'])}/"
+          base = "#{disposable_directory(row['category'])}/"
           raise IOError, 'Unsafe atomic path' unless [path, target].all? { |name| name.is_a?(String) && name.start_with?(base) && File.expand_path(name) == name } && File.dirname(path) == File.dirname(target) && path.match?(/\A#{Regexp.escape(target)}\.[a-f0-9]{16}\.tmp\z/)
           next unless File.exist?(path) || File.symlink?(path)
           raise IOError, 'Changed atomic bytes' unless verified_backup?(path, row['sha256']) && File.stat(path).ino == row['inode'] && File.stat(path).dev == row['device']
@@ -1210,16 +1222,7 @@ module PWN
     end
 
     def self.backup(path, expected, result)
-      unless result[:archive_dir]
-        base = File.join(Dir.home, '.pwn', 'session_cleanup_archive')
-        raise 'Unsafe archive directory' if File.symlink?(base)
-
-        FileUtils.mkdir_p(base, mode: 0o700)
-        raise 'Unsafe archive permissions' unless File.stat(base).uid == Process.uid && (File.stat(base).mode & 0o777) == 0o700
-
-        result[:archive_dir] = File.join(base, "#{Time.now.utc.strftime('%Y%m%dT%H%M%S')}-#{SecureRandom.hex(8)}")
-        Dir.mkdir(result[:archive_dir], 0o700)
-      end
+      result[:archive_dir] ||= PWN::Backups.directory(label: 'session-cleanup')
       expected.each do |name, record|
         next unless record
 
@@ -1273,6 +1276,9 @@ module PWN
       locks = []
       begin
         paths.each do |path|
+          owner = Thread.current[:pwn_learning_write_lock]
+          next if File.basename(path) == '.learning-write.lock' && owner && owner[:pid] == Process.pid && owner[:thread] == Thread.current
+
           lock = File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen -- closed together in ensure
           locks << lock
           raise 'Dependency writer active' unless lock.flock(File::LOCK_EX | File::LOCK_NB)
@@ -1327,7 +1333,7 @@ module PWN
     # Legacy writers block all mutations, including evidence migration.
     # One permanent inode serializes CLI, curses and cron maintenance writers.
     # Read-only previews never acquire a writer lock or create lock files.
-    def self.with_maintenance_lock(dry_run:)
+    def self.with_maintenance_lock(dry_run:, &block)
       return yield if dry_run
 
       root = PWN::Sessions.sessions_dir
@@ -1342,8 +1348,16 @@ module PWN
 
         begin
           Thread.current[:pwn_session_maintenance_lock] = { pid: Process.pid, thread: Thread.current, path: path, file: file }
-          yield
+          learning = PWN::AI::Agent::Learning.send(:learning_lock, nonblocking: true)
+          if learning == :busy
+            Thread.current[:pwn_backup_learning_busy] = true
+            yield
+          else
+            PWN::Backups.transaction(&block)
+          end
         ensure
+          PWN::AI::Agent::Learning.send(:learning_unlock, lock: learning) unless learning == :busy
+          Thread.current[:pwn_backup_learning_busy] = nil
           Thread.current[:pwn_session_maintenance_lock] = owner
         end
       end
@@ -1452,6 +1466,8 @@ module PWN
 
     def self.maintenance_transaction(dry_run:, current_session_id:, proc_root:)
       preflight = sweep(dry_run: true, current_session_id: current_session_id, proc_root: proc_root)
+      return preflight.merge(apply_blocked: true, evidence_migration: { deferred: 'learning_writer_active', migrated_rows: 0 }) if Thread.current[:pwn_backup_learning_busy] && !dry_run
+
       blocked = stopping? || !preflight[:legacy_owners].empty? || Array(preflight[:unresolved_store_remediation]).any?
       unless dry_run || blocked
         # Private metadata-only preflight survives an interrupted migration.