docs: drop the /tmp pid fallback; document .hypatia-ignore consumers

[hyperpolymath]

Part C of the launcher /tmp cure (origin: a Hypatia content_patterns/hardcoded_tmp alert on launch-scaffolder#46).

launcher-standard — deed + adoc in lock-step

• :pid-file-pattern → ${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}}/launch-scaffolder/{app-name}/server.pid
• :log-file-pattern → ${XDG_STATE_HOME:-$HOME/.local/state}/launch-scaffolder/{app-name}/server.log

The runtime hunk is copied verbatim from launch-scaffolder main's baked standards/launcher-standard_praxis.deed (#54/#58/#62). Its generator already emits this ladder. The old ${TMPDIR:-/tmp} last resort was the CWE-377 target named by the standard's own rationale: a predictable name in a world-writable dir lets another user choose which PID stop kills. The adoc template, the --disinteg list, the debugging checklist, logging and Security sections all move with it.

No :standard-version bump, deliberately. launch-scaffolder already bakes this ladder at 0.4.0. A bump would desync the two copies and make check-launcher-standard-currency.sh fail every 0.4.0 claim. Launchers on the old ladder are now non-conforming by design; the A8 re-mint sweep reaches them.

Out of scope, noted: the baked copy has also grown platforms, lifecycle-phases and metadata-block.encoding clauses that this canonical file lacks. That is a separate reconciliation.

QUICKSTART

It taught PID_FILE="/tmp/myapp-server.pid" and friends in seven places, contradicting the standard in the same directory. This is the likely seed of the ~17 shipped /tmp launchers. All are replaced; the hardcoded_tmp regex ["'/]tmp/ now matches nothing in the file.

EXEMPTION-MECHANISMS

The document said .hypatia-ignore is "never read by anything", and told reviewers to reject it. It also said Hypatia "ignores comments". Both are false. The new Layer 2a covers:

• the two consumers and how each matches (scanner: substring fragment; governance gate: whole-line exact path);
• why the gate is deliberately the stricter one;
• the emitted-module trap (content_patterns/…, not cicd_rules/…);
• the suppression ladder.

The anti-pattern list now rejects directory, wildcard and wrong-module lines, and invented pragmas, instead of the file itself.

Why the gate matcher is not loosened to substring matching: gate ⊂ scanner, so the mismatch can only false-block, never false-pass. Containment would let a …:src/ line absorb every future banned file. A census of 266 local .hypatia-ignore files found 0 directory, wildcard or /-terminated lines for the two gate rules, so no repo is currently hit by the divergence.

⚠ Inline hypatia: allow on content-pattern rules needs hyperpolymath/hypatia#881 (armed).

Added after review (e0c96f7, a530b71)

QUICKSTART Step 1 copies comprehensive-launcher-template.sh, which still wrote pid/log to /tmp and created no directory — so the doc and the file it hands the reader disagreed, and the XDG ladder would fail on the first nohup … > "$LOG_FILE". The comprehensive, dustfile and e-grade templates now use the ladder and mkdir -p -m 0700 the leaf directory before first write (SC2174 is intended: only the per-app leaf needs 0700). README checklist and a soft-attach.sh usage example no longer teach /tmp. After this, the only /tmp mentions under docs/UX-standards and launcher/ are launcher-standard.adoc’s explicit prohibitions.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Warning

Review limit reached

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b169945e-807a-490a-bd8c-92a39f576e2f

📥 Commits

Reviewing files that changed from the base of the PR and between bd9313a and a530b71.

📒 Files selected for processing (9)

• docs/EXEMPTION-MECHANISMS.adoc
• docs/UX-standards/QUICKSTART.adoc
• docs/UX-standards/README.adoc
• docs/UX-standards/comprehensive-launcher-template.sh
• docs/UX-standards/dustfile-template.sh
• docs/UX-standards/e-grade-launcher-template.sh
• docs/UX-standards/launcher-standard.adoc
• launcher/launcher-standard_praxis.deed
• launcher/soft-attach.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}