diff --git a/browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts b/browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts
index 834bce078..56fea46c8 100644
--- a/browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts
+++ b/browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts
@@ -6,16 +6,17 @@
  * checked separately, so the fix added an explicit object-shape gate.
  *
  * Test surface: parsePdfFromFile, exported for tests at meta-commands.ts:139.
- * All fixtures land in process.cwd() (SAFE_DIRECTORIES allows TEMP_DIR or cwd;
- * cwd is universally safe on every platform our CI runs on).
+ * Fixtures use the system temp directory, which SAFE_DIRECTORIES allows on
+ * every supported platform and which keeps transient files out of the repo.
  */
 import { describe, expect, test, beforeAll, afterAll } from "bun:test";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 
 import { parsePdfFromFile } from "../src/meta-commands";
 
-const FIXTURE_DIR = fs.mkdtempSync(path.join(process.cwd(), "pr1169-pdf-"));
+const FIXTURE_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "pr1169-pdf-"));
 
 beforeAll(() => {
   // mkdtempSync already created the dir
diff --git a/cso/SKILL.md b/cso/SKILL.md
index e13d5bf82..e8fdfa52b 100644
--- a/cso/SKILL.md
+++ b/cso/SKILL.md
@@ -165,6 +165,6 @@ The private state namespace is `security/cso/<repo>/<run>` under the existing st
 
 Give the run ID and the useful next operation. `resume` uses the retained snapshot and original policy; it never substitutes current HEAD or silently replenishes an exhausted budget. `replay` requires matching recorded source/runtime/dependency inputs. After snapshot expiry, missing matching supplied source returns **MISSING_INPUT**. A fresh audit is an explicit new run.
 
-`recheck` creates a fresh current-source snapshot linked to the old finding. Establish closure only from new evidence covering the same root cause and security boundary. A resolved claim must identify fresh caller evidence and the original boundary by snapshot path/handle and line; the helper records the current source hash or proves that the original boundary path is absent. A partial or incompatible audit, changed title, absent warning, or proposed bundle cannot resolve an old finding. Stable v3 identity uses root cause/location and advisory identities rather than generated titles. Import v2 reports read-only, retain the returned import ID, and use `inspect-v2` to read the preserved redacted report later. Legacy `VERIFIED` means **legacy review evidence**, never reproduced, runtime-tested, or tested.
+`recheck` snapshots current source and links the old finding. Establish closure only from new evidence covering the same root cause and security boundary. Resolution must identify fresh caller evidence and the original boundary by snapshot path/handle and line; the helper records its current hash or proves that boundary path is absent. A partial or incompatible audit, changed title, absent warning, or proposed bundle cannot resolve an old finding. Stable v3 identity uses root cause/location and advisory identities rather than generated titles. Import v2 reports read-only, retain the import ID, and use `inspect-v2` to read the preserved redacted report. Legacy `VERIFIED` means **legacy review evidence**, never reproduced, runtime-tested, or tested.
 
 For cancellation, deadline, or agent loss, let the helper's independent watchdog clean exact run-owned resources and preserve recoverable partial state. Never issue global Docker prune or remove resources identified only by a broad name. End with the actual completion status, supported results, exact prerequisites, and saved artifact paths returned by the helper.
diff --git a/cso/SKILL.md.tmpl b/cso/SKILL.md.tmpl
index 66f9b2469..246b16f77 100644
--- a/cso/SKILL.md.tmpl
+++ b/cso/SKILL.md.tmpl
@@ -157,6 +157,6 @@ The private state namespace is `security/cso/<repo>/<run>` under the existing st
 
 Give the run ID and the useful next operation. `resume` uses the retained snapshot and original policy; it never substitutes current HEAD or silently replenishes an exhausted budget. `replay` requires matching recorded source/runtime/dependency inputs. After snapshot expiry, missing matching supplied source returns **MISSING_INPUT**. A fresh audit is an explicit new run.
 
-`recheck` creates a fresh current-source snapshot linked to the old finding. Establish closure only from new evidence covering the same root cause and security boundary. A resolved claim must identify fresh caller evidence and the original boundary by snapshot path/handle and line; the helper records the current source hash or proves that the original boundary path is absent. A partial or incompatible audit, changed title, absent warning, or proposed bundle cannot resolve an old finding. Stable v3 identity uses root cause/location and advisory identities rather than generated titles. Import v2 reports read-only, retain the returned import ID, and use `inspect-v2` to read the preserved redacted report later. Legacy `VERIFIED` means **legacy review evidence**, never reproduced, runtime-tested, or tested.
+`recheck` snapshots current source and links the old finding. Establish closure only from new evidence covering the same root cause and security boundary. Resolution must identify fresh caller evidence and the original boundary by snapshot path/handle and line; the helper records its current hash or proves that boundary path is absent. A partial or incompatible audit, changed title, absent warning, or proposed bundle cannot resolve an old finding. Stable v3 identity uses root cause/location and advisory identities rather than generated titles. Import v2 reports read-only, retain the import ID, and use `inspect-v2` to read the preserved redacted report. Legacy `VERIFIED` means **legacy review evidence**, never reproduced, runtime-tested, or tested.
 
 For cancellation, deadline, or agent loss, let the helper's independent watchdog clean exact run-owned resources and preserve recoverable partial state. Never issue global Docker prune or remove resources identified only by a broad name. End with the actual completion status, supported results, exact prerequisites, and saved artifact paths returned by the helper.