AI Agent tmpfs Artifacts Disk Full

Agent tools often write frame dumps, wrapper logs, launch tempfiles, capture files, hooks, and worktree scratch under /tmp. When that path is a RAM-backed tmpfs, a cleanup bug can make unrelated tests fail with ENOSPC even though the normal disk still looks healthy.

Runbook: Sweep Only Stale, Known, Owned Artifacts

1. Confirm the failing filesystem is tmpfs, not the host root disk. A RAM-backed tmpfs can be full while / has plenty of free space.
2. Measure by name, age, and owner. Agent cleanup should target known artifact shapes, not every file in /tmp.
3. Protect current session files: recent launchers, wrapper PIDs, active tmux/socket files, hooks, and any file still held open by a live process.
4. Move unbounded debug/frame output under a session log directory that already has retention. Do not tee high-frequency redraw output to tmpfs forever.
5. Add a stale-artifact sweep around shutdown, stop, and explicit developer cleanup commands, using a bounded age threshold.
6. Emit before/after disk snapshots so future failures can be attributed to tmpfs debris, log retention, or a separate test failure.

I would add one acceptance check around the cleanup boundary: prove that stale tmpfs artifacts are removed while current session files are preserved.

Read-only evidence:

TMP_ROOT=${TMPDIR:-/tmp}
df -h "$TMP_ROOT"
df -i "$TMP_ROOT"
find "$TMP_ROOT" -maxdepth 2 \( -name "aiur-*" -o -name "*agent*" -o -name "*frames.bin" \) -printf "%s %TY-%Tm-%Td %TH:%TM %p\n" 2>/dev/null | sort -n | tail -60
lsof +D "$TMP_ROOT" 2>/dev/null | sed -n "1,80p" || true

Safe policy:
- remove only known agent artifact names
- require same-user ownership
- require stale age threshold
- protect current session tempfiles and live handles
- move unbounded frame dumps under the retained session log root

Do Not Delete First

• Current session tempfiles, live wrapper PIDs, tmux sockets, hooks, and files still held open by a running process.
• Session log roots that retention already manages.
• Workspaces, active task output, credentials, or local state just because they share an agent prefix.
• Diagnostic evidence proving which artifact class filled tmpfs.