[kixelated]

Problem

Every TLC run leaves an empty /tmp/tlc-<n> directory behind. TLC creates it under java.io.tmpdir, which the JVM sets to /tmp and never reads from TMPDIR. One host had 3,213 of them.

The other half of the reported bug (the -metadir "$(mktemp -d)" metadir never being removed, 26 GB after one interrupted ResumeReader run) was already fixed on main by moq-dev/moq#8628, which moved both tla recipes into sh/tlc.py with a locked, swept metadir under .tmp/tlc/.

Approach

sh/tlc.py runs java directly, not through nixpkgs' tlc wrapper, so it passes -Djava.io.tmpdir=<metadir>. TLC's temp directory then lives in the run's metadir and is removed with it, both after a normal exit and by the next run's sweep after a crash. The just rs tla <spec> [args] and just js tla ... interface is unchanged.

Impact

None on the public API or wire format.

Alternatives

• Setting TMPDIR or JAVA_TOOL_OPTIONS: the first has no effect on the JVM, and the second also makes the JVM print a "Picked up" line on every run. The command-line flag is simpler.
• Making the wrapper forward SIGINT/SIGTERM to TLC so that a second signal can't interrupt the metadir removal. I saw one gated interrupt leave a metadir behind, but could not reproduce it in 10 more tries (only the gate signalled, or its whole process group), and the next run's sweep removes such a leftover anyway. Dropped.

Follow-ups

None.

Validation

• Before, on main: quest gate just js tla watch/verify/Watch.tla passed and added /tmp/tlc-6891928372904236727.
• After: the same run exited 0 and left no new /tmp/tlc-*, and .tmp/tlc/ held only .lock.
• I started quest gate just rs tla moq-net/verify/resume/ResumeReader.tla, waited for the first Progress line, then sent SIGINT to the gate. During the run, the metadir held lock, the state dir, and tlc-5770901046169097615. That last directory is TLC's temp dir, now inside the metadir. The run exited 130, and afterward no TLC process remained, no new /tmp/tlc-* existed, and .tmp/tlc/ held only .lock.
• nix develop --command just ci passed.

Caused by

• moq-dev/moq#8447 - first ran TLC without pointing java.io.tmpdir anywhere, so every run left a /tmp/tlc-<n> directory (found by person). moq-dev/moq#8628 fixed the metadir leak but kept this behavior.

Models

Size: XS
Implementer: Claude Code, claude-opus-5-5, unknown effort

(Written by Claude Opus 5.5)

Review

Rewritten by quest review after each round.

• Head: c19bf8f

• Base: origin/main at 98ed0f8

• Risk: medium, the base has no RISK.md to name what is always high or customer-facing, so every change is medium

• Classified: medium by default

• Reviewer: Codex, gpt-6.1-sol, medium effort

• Session: 01a1de0b-0402-7fa0-8dbf-c954c50d09a4, round 1

• Score: 9/10, The JVM temporary-directory setting correctly uses the per-run cleanup directory, with no actionable regressions found by source review; tests were not run as instructed.

• Rounds: 1; first round 0; findings 0: fixed 0, refuted 0, open 0

• Findings: none

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a003359b-b5da-4875-ba73-4ab68e81eb51

Commits

Reviewing files that changed from the base of the PR and between ce616b5 and c19bf8f.

Files selected for processing: 1

• sh/tlc.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

✅ No new issues found.

Reviewed changes: the single commit in sh/tlc.py.

• Java temp dir: passes -Djava.io.tmpdir=<meta> so TLC's tlc-<n> directory is created inside the run's locked metadir. release removes it on exit, and the next run's sweep removes it after a crash.
• Docstring: notes why the JVM's temp dir points into the metadir.

meta is a plain mkdtemp path, and command is passed as a list, so quoting is not a concern. The -cp and tlc2.TLC arguments stay in order after the JVM options.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}