[JacobStephens2]

Summary

/tmp accumulation
├── Factory extraction → source-inspected static ownership gap; not reproduced
├── Agent scratch/tools → documented retention; current owners unknown
└── Test leftovers → separate #736 / #737 lifetime investigations

Adds dated, bounded metadata inventories, historical comparison, evidence/confidence labels, independent remedies and proposed validation. Preserves existing files/processes/configuration and Failed run retention. Cleanup and retention changes require separate work/decisions.

docs/research/
├── temporary-file-accumulation.md            # integrating session's report
├── thirdshift-tmp-accumulation.md            # concurrent investigation, preserved by merge
└── thirdshift-tmp-inventory-2026-10-17.json   # concurrent session's saved metadata

The two sessions recorded different /tmp views at overlapping times. Host/mount-namespace identity was not recorded, so the reports explicitly keep these observations uncorrelated; their difference establishes no creation/deletion rate. The concurrent report's handoff transcription is not independently verified by this session.

Closes #569

Evidence

• Before: investigate why so many thirdshift files have accumulated in /tmp #569 had no durable diagnosis or current measurements; the issue's handoff summary and Prevent setup PTY test children from surviving a dead test harness #736/Bound release-test child lifetime when CI polling never completes #737 record historical observations.
  After: the embedded read-only inventory ran at 2026-10-17 09:41:09 UTC: 5,603 direct /tmp entries; 756 extraction-shaped directories; 24 bounded directory samples completed without errors/limits. Sizes are scoped samples, not a host-wide total or stale-file attribution.

• Validation seams: bounded /tmp metadata enumeration and saved evidence accounting. This session's inventory command executed successfully; both embedded commands compile; all 31 local links across both reports resolve; snapshot arithmetic and the concurrent JSON's 6,608-root / 150,815-node accounting reconcile; git diff --check main...HEAD passes.

• The independent Spec reviewer reran the complete inventory at 09:43:16 UTC and reproduced every reported count and sampled size, with zero errors and no limits hit.

• Runtime reproductions, typechecking and full suites were not run: this report changes no runtime code, and investigate why so many thirdshift files have accumulated in /tmp #569 explicitly excludes full suites for evidence generation. No cleanup fix is claimed.

• Security: Single-session guidance review of a225cea0168d4cd8f6c6d53770ae4481cfa3bd5e...HEAD at 109b5b2635156fd890620767fc011242c25677f0, including all three changed files in full, both embedded inventory commands, and supporting extraction, fixture/process-lifetime and Failed run preservation code. No introduced Security findings identified. Both embedded commands parse without execution; saved inventory accounting and git diff --check pass. No runtime tests or fixes were needed for this documentation-only change.

Review coverage

Standards and Spec independently reviewed git diff main...HEAD. Final reports and files-read lists are retained in .thirdshift-review-UFgpZ1/standards.md and .thirdshift-review-UFgpZ1/spec.md alongside this session's artifacts.

Standards: 0 findings. Spec: 0 findings. Changed files left unread by either axis: none.

Unaddressed findings

Standards

None; no findings were skipped or declined.

Spec

None; no findings were skipped or declined. The report's future maintainer decisions are explicitly requested recommendations in #569, not declined review findings.

Security

None; no introduced findings were left unaddressed. Guidance review covered the pinned diff and supporting code, including inventory traversal, metadata disclosure, resource bounds and retention. No proof-of-concept candidate or security fix was needed; target code was not executed during this review.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Documentation only; revert the report to roll back. The appendix is an opt-in read-only inventory, not automatic cleanup.

Blast Radius: documentation

Built with codex · gpt-6.1-sol · high