@norskvideo/ctl-dev-kit 0.1.85 → 0.1.87

package/conventions/smoke.yml

@@ -52,17 +52,61 @@ jobs:
           - runner: '["ar-arm-vm"]'
     runs-on: ${{ fromJSON(matrix.runner) }}
     steps:
-      # BEFORE checkout: launched instances leave root-owned bind-mount target
-      # dirs under test-temp/ that the non-root runner user cannot remove, so
-      # actions/checkout's own cleanup would fail the job before anything runs.
-      # Nuke them from a throwaway root container first. Best-effort.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -246,16 +290,61 @@ jobs:
     if: ${{ !cancelled() && github.event_name != 'repository_dispatch' }}
     runs-on: x64
     steps:
-      # Same reason as the first checkout in this file: clear root-owned leftovers
-      # from a root container so the checkout below can clean properly. Best-effort
-      # by construction -- no docker, no test-temp, or a failed run all fall through.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/sync-ctl-packages.yml

@@ -41,23 +41,61 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/sync-dev-kit.yml

@@ -43,23 +43,61 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -201,23 +239,61 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/upgrade-latest.yml

@@ -45,23 +45,61 @@ jobs:
       changed: ${{ steps.bump.outputs.changed }}
       summary: ${{ steps.bump.outputs.summary }}
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:
@@ -323,23 +361,61 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
-      # around: the integration suite bind-mounts host dirs into containers, and a
-      # non-root git clean then EACCESes on what they wrote -- taking down whatever
-      # innocent job checked out next. Skipping the clean cured that symptom and
-      # caused another: every gitignored artifact survived between runs, so a test
-      # could pass on build output an earlier job left behind and go red the first
-      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
-      # from a root container FIRST, and the checkout can clean properly again.
-      # Best-effort by construction: no docker, no test-temp, or a failed run all
-      # fall through without failing the job.
-      - name: Clear stale root-owned test-temp (pre-checkout)
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
         run: |
           set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
           tt="$GITHUB_WORKSPACE/test-temp"
           [ -d "$tt" ] || exit 0
-          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
-            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
 
       - uses: actions/checkout@v5
         with:

package/conventions/workflow-shell.ts

@@ -55,3 +55,109 @@ export function teeWithoutPipefail(yaml: string): { line: number; text: string }
   }
   return out;
 }
+
+/** The step every convention workflow runs before `actions/checkout`, named so
+ *  the guard below can find it. */
+export const TEST_TEMP_STEP = "Route test-temp out of the workspace";
+
+// What that step must do, and what breaks when it doesn't. All four were learned
+// the hard way over three months on the shared DooD runners:
+//
+//   route  -- THE fix. These runners are docker-outside-of-docker, so the daemon
+//             a launch talks to is the HOST's, and a bind-mount source it has not
+//             seen is created by dockerd as ROOT on the host. --container-user
+//             does not help: it governs what the container WRITES, not what the
+//             daemon CREATES. Leave the harness on its repo-local default and
+//             every run seeds the checkout with root-owned dirs. The override
+//             must therefore point outside $GITHUB_WORKSPACE.
+//   reap   -- rm cannot unlink a live mountpoint even as ROOT (EBUSY), and a
+//             RESTARTING leaked container re-creates the path as root seconds
+//             after any clean. The holders are untracked by construction (a
+//             killed run labels nothing), so they are found by mount SOURCE.
+//   base   -- clearing only the CONTENTS leaves the base dir itself, and an
+//             empty-but-root-owned base still EACCESes a later mkdtemp.
+//   verify -- the old form swallowed every failure into `2>/dev/null || true`,
+//             so a clean that removed nothing looked identical to one that
+//             worked. The checkout then died with a bare "EACCES rmdir" and no
+//             clue what held the path. It stayed that way for a week.
+// The exported base must TRACE to $RUNNER_TEMP. Checking only that the export
+// exists would pass a step that dutifully exports the workspace path it was
+// already defaulting to, which is the whole bug.
+function routesOutOfWorkspace(body: string): boolean {
+  const exported = body.match(/NORSK_CTL_TEST_TMP=(\$\{?\w+\}?|[^\s"]+)[^\n]*>> "\$GITHUB_ENV"/);
+  if (!exported) return false;
+  const value = exported[1] ?? "";
+  if (value.startsWith("$RUNNER_TEMP")) return true;
+  const name = value.replace(/^\$\{?/, "").replace(/\}$/, "");
+  return name.length > 0 && new RegExp(`\\b${name}="\\$RUNNER_TEMP/`).test(body);
+}
+
+const TEST_TEMP_REQUIREMENTS: { name: string; ok: (body: string) => boolean }[] = [
+  { name: "route", ok: (b) => routesOutOfWorkspace(b) },
+  { name: "reap", ok: (b) => /\.Mounts\b/.test(b) && /docker rm -f/.test(b) },
+  { name: "base", ok: (b) => /rm -rf [^\n]*\/test-temp(?![\w/*])/.test(b) },
+  { name: "verify", ok: (b) => /\[ -e "\$tt" \]/.test(b) && /\bexit 1\b/.test(b) },
+];
+
+/** The `run: |` body of the step starting at `nameLine`, de-indented. */
+function stepBody(lines: string[], nameLine: number): string {
+  const runAt = lines.findIndex((l, i) => i > nameLine && /^\s*run: \|\s*$/.test(l));
+  if (runAt < 0) return "";
+  const indent = (lines[runAt + 1] ?? "").match(/^\s*/)?.[0].length ?? 0;
+  const body: string[] = [];
+  for (let j = runAt + 1; j < lines.length; j++) {
+    const line = lines[j] as string;
+    if (line.trim() === "") continue;
+    if ((line.match(/^\s*/)?.[0].length ?? 0) < indent) break;
+    body.push(line.trim());
+  }
+  return body.join("\n");
+}
+
+/** Pre-checkout test-temp steps that would leave the checkout exposed, each
+ *  reported at its `- name:` line with the requirements it does not meet. */
+export function testTempStepProblems(yaml: string): { line: number; missing: string[] }[] {
+  const lines = yaml.split("\n");
+  const out: { line: number; missing: string[] }[] = [];
+  lines.forEach((text, i) => {
+    if (!text.includes(`- name: ${TEST_TEMP_STEP}`)) return;
+    const body = stepBody(lines, i);
+    const missing = TEST_TEMP_REQUIREMENTS.filter((r) => !r.ok(body)).map((r) => r.name);
+    if (missing.length > 0) out.push({ line: i + 1, missing });
+  });
+  return out;
+}
+
+/** Jobs that check out without a {@link TEST_TEMP_STEP} of their own.
+ *
+ *  The per-step guard above can only inspect steps it finds BY NAME, so
+ *  deleting the step -- or renaming it back -- reads as "no problems". This is
+ *  the presence half. It is per JOB because both halves of the step are
+ *  per-job: `$GITHUB_ENV` does not cross jobs, and neither does the runner's
+ *  workspace state. Job ids are read off the two-space indent under `jobs:`
+ *  rather than a YAML parse, to stay consistent with the line-oriented guards
+ *  here and to keep reporting real line numbers. */
+export function jobsMissingTestTempStep(yaml: string): string[] {
+  const lines = yaml.split("\n");
+  const bad: string[] = [];
+  let job: string | undefined;
+  let checkouts = 0;
+  let steps = 0;
+  const settle = () => {
+    if (job !== undefined && checkouts > steps) bad.push(job);
+  };
+  for (const line of lines) {
+    const head = line.match(/^ {2}([A-Za-z_][\w-]*):\s*$/);
+    if (head) {
+      settle();
+      job = head[1];
+      checkouts = 0;
+      steps = 0;
+      continue;
+    }
+    if (/^\s*-?\s*uses: actions\/checkout@/.test(line)) checkouts++;
+    if (line.includes(`- name: ${TEST_TEMP_STEP}`)) steps++;
+  }
+  settle();
+  return bad;
+}