unimem temporary-directory guard — CODE supplement

Verdict: APPROVE. No blocking findings in this harness-only correction.

Independent Codex reviewer: /root/xtask_code_review, 2026-10-16. Parent remains 9cbd48070a136e24711896c930670fcff8a147fc. This supplements /tmp/unimem-core-code-review-20261016.md; its source approval and gate limits remain unchanged. No source edits or test reruns were performed by this reviewer.

The gate now captures mktemp completion explicitly and rejects nonzero exit, empty stdout, a nonexistent path, or a non-directory before any file writes or cleanup. This closes the unsafe assumption that an external nonzero exit throws in Nushell. The original gate is retained byte-for-byte in harness-bridge. The consumer and manifest/lock fixtures retain their previously reviewed hashes.

Inspected actual evidence: candidate-no-std-v2 succeeds for the corrected gate. candidate-temp-failure-v2 succeeds as a control: a failed mktemp returning an existing sentinel directory and a successful mktemp returning empty stdout both make the gate fail with its explicit diagnostic; the existing directory contents and empty working directory remain unchanged. The control script's assertions substantiate those outcomes. Both receipts bind the unchanged candidate-v2 source epoch. No broad gate result is inferred from this supplement.

SHA-256 identities: