@norskvideo/ctl-dev-kit 0.1.84 → 0.1.86

package/conventions/build-docs.yml

@@ -43,36 +43,117 @@ jobs:
   build:
     runs-on: x64
     steps:
-      # A guide's engine tier launches the same docker instances the integration
-      # suite does, leaving root-owned bind-mount target dirs under test-temp/
-      # that the non-root runner can't remove — which fails actions/checkout's
-      # own cleanup before anything runs. Nuke them from a throwaway root
-      # container first. Best-effort. (Mirrors integration.yml.)
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/build-image.yml

@@ -66,23 +66,61 @@ jobs:
       # publish job gates on this output instead of on PUBLISH_IMAGE directly.
       publish: ${{ steps.gen.outputs.publish }}
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -109,23 +147,61 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -165,23 +241,61 @@ jobs:
     if: ${{ needs.label.outputs.publish == 'true' && !inputs.dry_run }}
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -216,23 +330,61 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/check-drift.ts

@@ -62,6 +62,20 @@ export const PRODUCT_SENTINEL = "__PRODUCT__";
 // unfilled-sentinel check.
 export const PUBLISH_IMAGE_LINE = /^(\s*PUBLISH_IMAGE:\s*).*$/gm;
 
+// integration.yml (04c s9 #1) is universally present and was hand-owned in six
+// shapes, so on the day it joined the conventions set the gate could not demand
+// the canonical of every copy: sync-dev-kit commits straight to main when
+// checks are green, and would have rewritten six tiers before the hooks their
+// suites need existed. A copy therefore declares itself converged by carrying
+// the canonical's own first line; one without it is hand-owned and ungated
+// until its repo converges deliberately. When every repo carries the marker,
+// this becomes unconditional like smoke.yml.
+export const INTEGRATION_MARKER = "# ctl-dev-kit convention: integration";
+
+export function carriesIntegrationMarker(text: string): boolean {
+  return text.split("\n")[0]?.trim() === INTEGRATION_MARKER;
+}
+
 // smoke.yml carries a second per-repo line: the matrix `runner:` label array
 // the journey runs on ('["x64"]' for the pool, '["ARM64","nvidia"]' for the GPU
 // box). Masked like product:; any filled value is valid, so no sentinel check.
@@ -252,6 +266,9 @@ export interface CanonicalBytes {
   gitignoreCore: string;
   buildImage: string;
   smoke: string;
+  /** conventions/integration.yml — the integration tier. Gated only for a copy
+   *  carrying INTEGRATION_MARKER on line 1; same two masked lines as smoke. */
+  integration: string;
   /** conventions/demo.sh — the scripts/demo shim a product with tests/demo.spec.ts carries. */
   demoShim: string;
   /** doc-guide/with-display.sh — the X-display wrapper BOTH docs workflows invoke
@@ -546,6 +563,25 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
     );
   }
 
+  // integration.yml: gated once a copy carries the convention marker (see
+  // INTEGRATION_MARKER for why not before); then it is smoke.yml's twin, with
+  // the `product:` key and the matrix `runner:` array as the per-repo lines.
+  const integrationPath = join(repoRoot, ".github", "workflows", "integration.yml");
+  if (existsSync(integrationPath)) {
+    const actual = readFileSync(integrationPath, "utf8");
+    if (carriesIntegrationMarker(actual)) {
+      push(
+        workflowProblem(
+          ".github/workflows/integration.yml",
+          "conventions/integration.yml",
+          actual,
+          canonical.integration,
+          [PRODUCT_LINE, RUNNER_LINE],
+        ),
+      );
+    }
+  }
+
   // publish-docs.yml is OPTIONAL — a product carries it once it has an
   // illustrated manual to publish nightly. Unlike the workflows above it has NO
   // per-repo line: it is deliberately product-agnostic (per-repo bits live in
@@ -623,6 +659,7 @@ if (import.meta.main) {
     gitignoreCore: readFileSync(join(import.meta.dir, "gitignore.core"), "utf8"),
     buildImage: readFileSync(join(import.meta.dir, "build-image.yml"), "utf8"),
     smoke: readFileSync(join(import.meta.dir, "smoke.yml"), "utf8"),
+    integration: readFileSync(join(import.meta.dir, "integration.yml"), "utf8"),
     demoShim: readFileSync(join(import.meta.dir, "demo.sh"), "utf8"),
   };
   const report = checkDrift(repoRoot, canonical, { repoName: resolveRepoName(repoRoot) });