feat: add evidence-bound native temp reclaim

[seonghobae]

Purpose

Add a bounded native temporary-artifact reclaim adapter without broadening DiskSage's permanent-deletion authority. This lane owns temp-root discovery, generated-artifact evidence, fresh per-candidate approval, and the adapter into the existing identity-bound Trash/journal boundary. Release/Test foundation remains owned by #264; canonical product-gap projection remains owned by #315.

Current authority — 2026-09-05 KST

• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a;
• canonical release/Test parent fix: verify Windows release artifact namespace #264: 3e33229b4157a084a1985a1c7e952f98a64f25e3;
• exact feat: add evidence-bound native temp reclaim #314 head: cc9c4f7400813c913cee79c5f317c9581a41acde;
• non-force restacked onto exact current fix: verify Windows release artifact namespace #264 after inspecting its two contract-test-only changes;
• twelve runtime/ADR/test/Cargo/CHANGELOG semantic files remain this owner boundary. docs/product-technical-gap-baseline.md remains delegated to docs: establish canonical DiskSage product requirements #315;
• Draft. Exact-head gates must be reacquired; predecessor/local evidence does not transfer.

Safety boundary and real mutation evidence

The adapter discovers bounded native temporary roots, including the macOS /tmp→/private/tmp alias, and admits only independently marker-bound generated artifacts with complete identity/manifests and inactive-use evidence. Unknown entries, partial scans, symlinks, provider/Photos paths, and permanent deletion remain unavailable. Execution requires a fresh per-candidate backend approval phrase before entering the shared reversible Trash/journal boundary.

temp_reclaim_contract.rs retains a real Unix/non-macOS successful mutation fixture: it creates an actual marker-bound target, obtains the serialized exact approval phrase from the CLI plan, executes the shipped binary with that fingerprint/phrase, requires success, requires a previously absent journal path to become a file, and verifies the approved project/target no longer exists.

That fixture still does not prove end-to-end recovery/undo. It does not bind a recoverable Trash destination back to the original object identity, restore the object from Trash, verify restored bytes/descendants, or prove journal durability sufficient for recovery after interruption. Those capabilities belong at the shared safety/recovery boundary and must be consumed rather than reimplemented here.

Required before integration

Keep Draft until #264 is integrated or equivalently present on protected lineage and one unchanged #314 exact head satisfies every applicable native/central Test/Release/Security/SAST/CodeQL/OSV/Scorecard/review/ruleset gate. Preserve the successful real-filesystem move/journal fixture and add/consume canonical recovery acceptance proving the same reviewed object can be restored without pathname substitution or unrelated-child loss. No self-approval, force-push, destructive rebase, gate weakening, permanent deletion, or administrative bypass.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🟡 Discovery deadline can overrun

When one manifest consumes most of the budget, inspect_artifact can start another three-second scan. Native temp planning can nearly double its advertised deadline.

Prompt for agents

The global 3.5-second discovery deadline in src-tauri/src/temp_reclaim.rs is checked before calling inspect_artifact, but inspect_artifact and artifact_manifest in src-tauri/src/dev_artifacts.rs always use a fresh independent three-second budget. A second candidate can begin inspection just before the global deadline and keep planning alive for almost another three seconds. Thread the remaining global deadline or a caller-supplied budget through the exact-artifact inspection path, while preserving the existing default budget for ordinary development-artifact scans. Add a regression with multiple slow manifests, not only a slow active-use probe.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

재현을 먼저 추가한 뒤 owner 경계에서 수정했습니다. cc76763631a694e0e4a433918803ac9c923b236f은 여러 실제 target 트리에 대해 caller budget이 소진되면 각 manifest가 fail-closed해야 한다는 RED 계약을 추가했고, 8ea5e84ee0d2f44456213308840161da5618882f은 ordinary scan의 기존 3초 기본값을 유지하면서 caller-supplied manifest budget API를 추가했습니다. f8d92e732f6382087d93cb0f1181cca65c859f43에서는 native-temp planner가 manifest와 active-use probe 모두에 동일한 3.5초 global budget의 남은 시간만 전달하도록 연결했습니다. fce82704d3f503fa6d8046b14ee909977846c11b은 wall-clock 임의 임계값 없이 소진된 budget이 모든 후보 manifest를 incomplete로 만드는 결정적 회귀로 정리했습니다. 현재 exact-head hosted GREEN은 아직 재취득 중이므로 thread는 그 증거 전까지 resolve하지 않습니다.