/plan critic + draft scratch escapes the workspace contract into the shared ~/data root — 67 stray entries; bare-root escape is now 3-for-3 across every bootstrap in agent-worktree-contract.sh

[tomerweller]

/plan critic + draft scratch escapes the workspace contract into the shared ~/data root — 67 stray entries, and this is now 3-for-3 across every bootstrap in agent-worktree-contract.sh

Surfaced by /monitor-tick at 00:04Z while attributing a new bare-root directory on the shared volume.

This is the third family of the same escape, and the three together are the real finding:
scripts/lib/agent-worktree-contract.sh defines exactly three workspace bootstraps, and all three
have bare-root escapes on disk right now:

bootstrap	line	mandated prefix	bare-root entries observed	issue
plan_critic_bootstrap	:130	~/data/$SESSION_ID/plan-$ISSUE/	67 (0.709 MiB)	this issue
review_pr_bootstrap	:191	~/data/$SESSION_ID/review-pr-$ISSUE/	18 (190,339 B)	#3921
do_bootstrap	:258	~/data/$SESSION_ID/do-$ISSUE/	63 dirs (84.307 GiB)	#3925

Three independent skills, three independent bootstraps, all correctly written, all bypassed. That
pattern is much stronger evidence for a shared root cause than any one family was on its own —
see Suggested fix below.

Symptom

$HOME/data holds 67 stray bare-root plan-* entries (10 dirs + 57 files), 743,368 B =
0.709 MiB, accumulating since 2026-06-04. The newest, plan-3792/, was created at
2026-08-24T00:04:29Z — between two consecutive monitor ticks, so this is live, not residue.

Ten directories:

157,337 B  plan-3279            2026-06-15 19:33:53
 64,708 B  plan-3811            2026-08-09 06:40:36
 55,245 B  plan-3801            2026-08-09 05:18:43
 40,225 B  plan-3768-scratch    2026-08-11 13:12:57
 40,002 B  plan-3219            2026-06-16 19:11:07
 25,485 B  plan-3752-scratch    2026-08-10 21:22:46
 24,685 B  plan-3835            2026-08-10 18:22:56
 24,276 B  plan-3444            2026-06-19 05:05:05
 12,903 B  plan-3792            2026-08-24 00:04:29   <- created during this tick
  4,096 B  plan-3434            2026-08-08 22:56:15

plan-3792/draft.md (8,807 B) is a round-1 plan draft for #3792 — it opens
## 📝 Plan Draft (Round 1) and its body is a concrete implementation plan for the overlay
broadcast-drop metric bridge, i.e. genuine /plan output, not a stray temp file.

There is also one adjacent bare-root dir with a re-prefixed name, replan-3365/ (2026-06-17),
which I mention for completeness but have not counted in the 67.

Why this is off-contract

.claude/skills/plan/SKILL.md:110-122 states the invariant and even spells out the enforcement:

plan_critic_bootstrap validates and exports WORKTREE_BASE, CARGO_TARGET_DIR, and
CRITIC_WORKTREE. Pre-seeded values are accepted only if they resolve under the real ~/data
AND match the expected session/issue prefix ($HOME/data/$SESSION_ID/plan-$ISSUE/...).

and the helper cannot produce a bare root path.
scripts/lib/agent-worktree-contract.sh:130-152:

plan_critic_bootstrap() {
  local issue="$1"
  local critic_id="$2"
  local session_id="${CLAUDE_SESSION_ID:-${SESSION_ID:-$(date +%Y%m%d-%H%M%S)}}"
  ...
  local expected_prefix="$real_home/data/$session_id/plan-$issue"
  ...
  local candidate_base="${incoming_base:-$real_home/data/$session_id/plan-$issue}"
  if ! WORKTREE_BASE="$(require_home_data_path "$candidate_base" "WORKTREE_BASE")"; then
  ...
  if [[ -n "$incoming_base" ]]; then
    if ! require_session_prefix "$WORKTREE_BASE" "$expected_prefix" "WORKTREE_BASE"; then

session_id has a three-level fallback terminating in $(date +%Y%m%d-%H%M%S), so it is never
empty, and require_session_prefix (:109) re-validates any pre-seeded WORKTREE_BASE against
expected_prefix. A path of the form ~/data/plan-3792 — one level, no session segment — is
unreachable through this function. Something is writing plan artifacts without going through the
bootstrap.

Note the SKILL.md section immediately following the bootstrap is titled "Forbidden scratch patterns
(issue #2843 — hard requirement)" and enumerates the repo-tree / <repo>-pr<N> / /tmp leaks. The
bare ~/data root is not in that enumeration — which is plausibly why all three families slip
through the same gap.

The contract-correct shape is achievable and is being achieved

23 session-scoped plan-* entries exist, so this is per-pass, not structural:

/home/tomer/data/20260728-034145/plan-3756
/home/tomer/data/20260809-094024/plan-3795
/home/tomer/data/20260619-001954/plan-3588
/home/tomer/data/20260619-001954/plan-3591
/home/tomer/data/20260619-001954/plan-3518-{draft,criticA,criticB,criticC,converged}.md
…

Same skill, same helper, correct prefix. The 20260619-001954/plan-3518-* set is especially useful:
it is the same artifact naming as the bare-root plan-3093-critic-{a,b,c}.md family, just placed
correctly — so the artifact writer clearly can take a session-scoped base when it is given one.

Five name shapes, i.e. more than one bypass site

 36  plan-<issue>-<artifact>.md      (-draft, -draft1, -final, -converged, -disagreement, -comment)
 18  plan-<issue>-critic-{a,b,c}.md
  8  plan-<issue>                    (plain template, session segment dropped)
  3  plan-<issue>-crit{A,B,C}.md     (a second critic-naming convention)
  2  plan-<issue>-scratch

plus plan-3801-issue.json (11,278 B) and the replan-3365/ dir. Two different critic-file
naming conventions (-critic-a.md vs -critA.md) in the same bare-root pool is itself evidence of
more than one writer.

Impact — hygiene and contract integrity, not runway

I sized the pool before framing it, because the sibling families differ by five orders of magnitude:

• This pool: 743,368 B = 0.709 MiB across 2.7 months ≈ 0.0000003 GiB/day. Invisible next to the
  0.070 GiB watchdog scratch and the 0.054 GiB do-* workspaces that dominate the volume's churn.
• Explicitly not attached to Shared data volume /home/tomer/data at 95% — ~11-day exhaustion runway #3749's arithmetic, and explicitly not the /do implementation worktrees escape the workspace contract into the shared ~/data root — 63 orphaned dirs / 84.3 GiB, unreachable by the reap contract #3925 case (that one
  is 84.307 GiB of full worktrees and genuinely runway-relevant). The free arm is nowhere near
  firing: 841.66 GiB free, 8.4× margin over the 100 G threshold.

What it does cost is the same three things as #3921:

1. The /review-pr sub-agents create huge worktrees in /tmp (11GB seen, near-OOM root FS) #2843 isolation guarantee is not held. Root-level scratch sits outside any session
   prefix, so require_session_prefix's poisoning protection never applies to it, and nothing
   expires it — there is no session dir to go away.
2. Cross-run collision. ~/data/plan-3792 is a fixed path, so two concurrent plan rounds on the
   same issue share one directory. The -scratch suffixed variants (plan-3752-scratch,
   plan-3768-scratch) read like someone already worked around this.
3. Data-root attribution noise. This issue exists because a routine bare-root directory delta
   had to be chased down before it could be explained.

Suggested fix — fix it once, at the shared layer

Because the escape now reproduces across all three bootstraps, per-skill patching is the wrong
shape. Two changes that would cover every family at once:

1. Extend assert_no_repo_tree_scratch (agent-worktree-contract.sh:329) with a bare-root
   pattern. It is already the detection-only, no-deletion guard over an enumerated leak-pattern
   list, and its docstring calls itself "a fixed enumeration of the OBSERVED leak patterns". The
   bare ~/data root is now an observed leak pattern, three times over. A single check rejecting
   ^$HOME/data/(plan|review-pr|do)-[^/]*$ would have caught all 148 entries across the three
   issues.
2. Find the artifact writers that compose paths inline rather than deriving them from the
   bootstrap's exported CRITIC_WORTREE/WORKTREE_BASE. For /plan specifically, the draft /
   critic / converged writes are the suspects: the bootstrap exports CRITIC_WORKTREE, but the
   round artifacts land as siblings named plan-<issue>-<artifact>.md, which suggests they are
   written by a path template that never sees $SESSION_ID.

Adding the bare-root pattern to #2843's forbidden-scratch enumeration in each SKILL.md would also
close the documentation gap that let three independent skills converge on the same mistake.

Existing entries are co-tenant data; the monitor has not deleted any of them and is not
proposing that they be swept without an owner's sign-off.

Non-urgent — no validator impact, no label. For context: the mainnet validator is down on the
unrelated #3910 outage (39h28m, build_sha 0ac84d42, deploys held by the blocked_active
quarantine); nothing in this issue bears on that.

Related: #3921 (review-pr bare-root class, same shape), #3925 (do-* bare-root worktree class,
same shape, 84.3 GiB), #2843 (the isolation contract these all violate).

Filed by /monitor-tick.

[tomerweller]

Live 68th entry — plan-3816-scratch/, captured between two monitor ticks, and this time the contract-correct path was never created at all

Caught by /monitor-tick at 03:56Z, 14 minutes after the write. This is the same escape the body describes, but the capture is tighter than the plan-3792 one and it removes an alternative reading of the mechanism.

The entry

2026-08-24 03:42:46Z   d   22,894 B   ~/data/plan-3816-scratch/
                            7,541 B     draft.md
                            2,411 B     critic-a.md
                            1,025 B     critic-b.md
                            1,267 B     critic-c.md
                            6,554 B     converged.md

Pool moves exactly with it, no unattributed remainder:

entries   67 → 68        (dirs 10 → 11, files 57 → 57)
bytes     755,990 → 778,884   (+22,894 = the new dir, to the byte)

That is the complete round-1 artifact set — draft, three critics, converged — so what escapes is the whole /plan output path, not an incidental temp file. Same finding as plan-3792/draft.md in the body, now with the critic files too.

Producer, named from its own log

~/data/project-loop-watchdog.log for the 03:30:01Z fire:

2026-08-24T03:30:01Z watchdog: loop stale (217634s since last tick) — launching headless tick
  Pick: #3816 (monitor-tick: check-12b post-restart absolute fire has no cold-catchup exemption) — ready-for-planning
  Dispatched: /plan on opus → converged Round 1
  State transition: ready-for-planning → planning → ready-for-doing (self-unassigned)
2026-08-24T03:43:08Z watchdog: headless tick exit=0

The directory's mtime (03:42:46Z) sits 22 s before that tick's exit, so the attribution is unambiguous: a /plan dispatch on #3816, in a headless pass, writing to the bare ~/data root.

What is new relative to the body: there was no contract-correct sibling

The do-* case in #3925 showed the session-scoped path being created and then abandoned 39 s before the bare-root worktree appeared. I looked for the same pattern here and it is absent:

$ find ~/data -maxdepth 3 -name '*plan-3816*'
2026-08-24 03:42:46  d  4096  ./plan-3816-scratch          ← the only hit, at depth 1

$ find ~/data -maxdepth 1 -type d -newermt 2026-08-24T03:25:00
2026-08-24 03:43:08  .
2026-08-24 03:42:46  ./plan-3816-scratch                    ← no new session dir at all

No ~/data/<session>/plan-3816 was created, empty or otherwise, and this /plan pass created no session directory whatsoever. So for /plan the reading is not "the correct path is computed and then discarded" — plan_critic_bootstrap looks not to have been entered on this path at all. That is a narrower and more actionable target than the do-* case: the fix is to route the round-artifact writes through the bootstrap, not to work out why a computed path was dropped.

The -scratch suffix is the current default, not a historical workaround

The body noted plan-3752-scratch and plan-3768-scratch and read them as someone having already worked around the fixed-path collision. This is the third, 13 days after the second:

plan-3752-scratch   2026-08-10 21:22
plan-3768-scratch   2026-08-11 13:12
plan-3816-scratch   2026-08-24 03:42   ← live

So plan-<issue>-scratch is what this writer produces now — worth knowing when grepping for the bypass site, since the plain plan-<issue> shape (8 entries in the body's census) may be the older form.

Unchanged

Still hygiene and contract integrity, still not runway: 778,884 B ≈ 0.74 MiB total against 841.67 GiB free (9.0× margin over the 100 G threshold). Explicitly still not attached to #3749's arithmetic, and still nowhere near #3925's 84.307 GiB. The three sibling counts this tick: plan-* 68, do-* dirs 63 / 84.307 GiB (byte-identical 15 ticks), review-pr-* 18 (flat 16 ticks) — so of the three families in the body's table, only this one moved.

The monitor has deleted nothing and is not proposing a sweep; replan-3365/ is still excluded from the 68, as in the body.

No label change, no validator impact. Separately and unrelated, the mainnet validator is down on the #3910 outage (43h20m, build_sha 0ac84d42, deploys held by the blocked_active quarantine).

Related: #3925 (do-* bare-root, where the two-shapes pattern does appear), #3921 (review-pr-* bare-root), #2843 (the isolation contract).

Surfaced by /monitor-tick.