Gap
No check in the machine-health (or claude-ops) plugins notices a new stray file or directory at a volume root. plugins/machine-health/skills/audit/catalog/checks.jsonc has zero coverage for volume-root contents — its Storage category holds only disk-space — and the nearest tooling, scripts/check-drive-root-litter.sh, is repo CI tooling (single-letter directory names only), not a machine-health check.
Evidence
A manual disk audit of C:\ found droppings nothing on the machine would ever have reported:
C:\tmp\tmp.rSFIkHm5DO — an empty directory left by a Windows path-translation leak (a POSIX /tmp/... string from mktemp -d resolved by a native process against the drive root)C:\log.txt — a 0-byte file owned by BUILTIN\Administrators, dropped by an elevated vendor process whose CWD was C:\
Both sat invisible to every routine health run; only the one-off manual audit surfaced them. The C:\tmp leak was a one-shot event (observed once, 2026-08-30 14:15:56, from the mktemp -d path in plugins/source-control/skills/worktree/context/create.md, addressed separately in PR #3497), but the CLASS has multiple independent producers — a second instance, C:\worktrees (empty, user-owned, created 14:24:32 the same day by a different producer), appeared within minutes. One-shot droppings from ever-changing producers are exactly what a routine check catches and a one-time cleanup cannot.
Wanted
A machine-health catalog check that reports unexpected entries (files AND directories) at fixed-volume roots against an expected-entry baseline that is data, not script logic — proportionate severity (tidiness, never CRIT), trend-aware/deterministic output, read-only, unelevated, Windows-only.
Gap
No check in the machine-health (or claude-ops) plugins notices a new stray file or directory at a volume root.
plugins/machine-health/skills/audit/catalog/checks.jsonchas zero coverage for volume-root contents — its Storage category holds onlydisk-space— and the nearest tooling,scripts/check-drive-root-litter.sh, is repo CI tooling (single-letter directory names only), not a machine-health check.Evidence
A manual disk audit of
C:\found droppings nothing on the machine would ever have reported:C:\tmp\tmp.rSFIkHm5DO— an empty directory left by a Windows path-translation leak (a POSIX/tmp/...string frommktemp -dresolved by a native process against the drive root)C:\log.txt— a 0-byte file owned byBUILTIN\Administrators, dropped by an elevated vendor process whose CWD wasC:\Both sat invisible to every routine health run; only the one-off manual audit surfaced them. The
C:\tmpleak was a one-shot event (observed once, 2026-08-30 14:15:56, from themktemp -dpath inplugins/source-control/skills/worktree/context/create.md, addressed separately in PR #3497), but the CLASS has multiple independent producers — a second instance,C:\worktrees(empty, user-owned, created 14:24:32 the same day by a different producer), appeared within minutes. One-shot droppings from ever-changing producers are exactly what a routine check catches and a one-time cleanup cannot.Wanted
A machine-health catalog check that reports unexpected entries (files AND directories) at fixed-volume roots against an expected-entry baseline that is data, not script logic — proportionate severity (tidiness, never CRIT), trend-aware/deterministic output, read-only, unelevated, Windows-only.