Resource-leak test failures on main: extension_rubric_scorer_test and worker_gateway_test

swamp doctor extensions --json reports orphanFiles that point at pulled-extension source files under .swamp/pulled-extensions/, but swamp doctor extensions --repair does not evict them — its documented scope is "Prune Tombstoned catalog rows and evict unreferenced bundle files." This leaves a category of reported orphans with no working remediation: --repair skips them and swamp extension pull --force (which overwrites the same files) does not clear them either.

Separately, the orphan attribution appears cross-wired for nested @swamp/aws/* extensions: files under .swamp/pulled-extensions/@swamp/aws/iam/ are attributed to @swamp/aws/s3, and files under .swamp/pulled-extensions/@swamp/aws/s3/ are attributed to @swamp/aws/iam. This sibling mis-attribution looks like it may be the root cause of the files being flagged as orphans at all.

Environment

swamp version: 20260611.152058.0-sha.ab13d0a5
Both @swamp/aws/iam (v2026.06.08.2) and @swamp/aws/s3 (v2026.06.08.2) are installed/pulled.
overallStatus: pass throughout — these orphans are reported but never block.

Steps to reproduce

In a repo with both @swamp/aws/iam and @swamp/aws/s3 pulled, run swamp doctor extensions --json.
Observe orphanFiles containing 31 entries under .swamp/pulled-extensions/@swamp/aws/iam/... and .swamp/pulled-extensions/@swamp/aws/s3/..., each attributed to the sibling extension (counts: 17 → @swamp/aws/s3, 14 → @swamp/aws/iam).
Run swamp doctor extensions --repair --force. It evicts the unreferenced .swamp/bundles/*.js and .swamp/vault-bundles/*.js files (those clear to 0), prints OVERALL: PASS, but the 31 pulled-extensions source orphans remain.
Run swamp extension pull @swamp/aws/iam --force and swamp extension pull @swamp/aws/s3 --force. Files are overwritten, but swamp doctor extensions --json still reports the same 31 orphans.

Expected vs actual

Expected: Either the reported orphanFiles are all evictable by --repair (single, consistent remediation), or the diagnostic clearly distinguishes "bundle orphans (evict with --repair)" from "pulled-source orphans (clean with X)" and documents the remediation for each — and re-pulling an extension should reconcile its own source files so they are no longer orphaned.
Actual: orphanFiles mixes two categories with no distinguishing field; --repair silently acts on only one category; there is no documented path to clear the pulled-source orphans; and extension pull --force does not clear them. Nested @swamp/aws/* extensions also get cross-attributed to siblings.

Diagnostic narrative (how an agent is led to the wrong fix)

This is the part worth fixing for agent UX. My reasoning went:

Hypothesis — "stale copies": I saw (a) the cross-wired attribution (@swamp/aws/s3 owning @swamp/aws/iam/... paths) and (b) recent pull timestamps, and inferred the orphans were leftover source copies from an earlier pull that the catalog no longer referenced — i.e. the on-disk files were stale relative to the catalog's current pull location.
What that suggested: "Refresh the pull" — run swamp extension pull for both extensions to rewrite the source trees and reconcile them with the catalog.
Why it doesn't work: After pull --force overwrote every listed file, swamp doctor extensions reported the identical 31 orphans. So orphan status is not about file content/staleness; the files are physically present and freshly written yet still "unreferenced." Re-pulling changes the bytes on disk but not whatever catalog↔file linkage makes them orphans — so the hypothesis predicted a fix the tool's own model can't deliver.

What I should have done instead:

Read the actual definition of "orphan" before acting. --repair's own help ("evict unreferenced bundle files") already says it targets bundle files, not pulled-extensions source — so re-pull was never going to be the sanctioned remediation, and that was knowable up front from the help text.
Tested the hypothesis cheaply before executing a --force mutation — e.g. inspect the catalog↔file mapping or fetch source (troubleshooting Tier 4) to learn what marks a pulled-source file unreferenced — rather than running pull --force and only then discovering it didn't change the orphan set.
Treated the cross-wired sibling attribution as a signal of a detector bug (root cause) rather than as evidence supporting a "stale files" story.

Suggested fixes

Fix the nested-namespace orphan detector so @swamp/aws/iam and @swamp/aws/s3 source files are attributed to (and referenced by) their own extension, not the sibling — likely the root cause of the false orphans.
Make orphanFiles self-describing: tag each entry with its category (bundle vs pulled-source) and whether --repair will act on it, so consumers don't infer remediation from path shape.
Either extend --repair to clean pulled-source orphans, or document the supported remediation and have extension pull reconcile its own source files.

02Bog Flow

Shipped

6/11/2026, 7:24:23 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/11/2026, 5:57:27 PM

stack72 commented 6/11/2026, 7:24:54 PM

Thanks @crudec for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Resource-leak test failures on main: extension_rubric_scorer_test and worker_gateway_test

Landing page clips the curl install command instead of rendering the full text

model delete --json output shape doesn't match the documented {deleted, modelId, modelName, artifactsDeleted}

model search --json returns a bare model object instead of {query, results} when exactly one model matches

Extension author gitignore guidance: add .swamp.yaml and CLAUDE.md to recommended excludes

reports.require in workflow YAML does not auto-execute pulled extension reports

Yanked extension version still shown as active on swamp-club.com and in 'extension search'

Add deprecate/yank/unyank actions for own extensions on the web interface

Expose per-run memory/CPU metrics for method & workflow executions

model method run OOMs at 4GB V8 heap on long high-fan-out methods; non-configurable heap + crash leaves run stuck in "running"

Tier-up announcements never fire for direct score contributions (badge awards, feed credits)

CI never runs the discord-bot service test suite

Discord role sync never assigns lower leaderboard tiers (Swamp Baby / Muck Runt / Sludge Whelp)

Docs: document globalArgument input reference validation in workflow validate

Remote execution: UAT coverage for tokens, enrollment, and dispatch

Remote execution: comprehensive reference documentation

doctor extensions: pulled-extension source files reported as orphans that --repair can't evict (nested @swamp/aws/* sibling mis-attribution)

Channel-based publishing for local extension backports

Feature: make extension yank channel-scoped (--channel) so it doesn't nuke every channel

swamp update --setup-auto does not work with bluefin44 (crontab not found, should

Feature: demote / withdraw an extension version from the stable channel

Docs: extension-publish skill guide doesn't cover release channels

workflow validate: resolve model globalArguments expressions against the calling workflow's declared inputs

Add a way to list registered report definitions (report search only lists results)

Inconsistent resource-field accessor: data get returns content, data query and CEL use attributes

Extension API: allow export const extension to add resource specs, or document that it cannot

@swamp/aws/cloudformation: expose StackSet instances, drift, and operations (Cloud Control cannot)

workflow validate: method args with a Zod .default() are treated as required

Profile months overlap in trajectory

model type describe --json: bloated output (40% duplicated specs, no compact mode) and lost method-to-output mapping drive agents to read extension source

UAT: Release channel CLI and adversarial tests

Docs: Add release channel documentation to the manual

Test skill evals with Fable in multi-skill eval tests

Guide users toward filing feature requests when @swamp extensions lack a needed capability

Guide users toward filing feature requests when @swamp extensions are missing features

correcting capitlization of Swamp, Swamp Club, and The Swamp on the swamp-club.com website

API: Add release channel support for extension versions (beta, rc, stable)

Add @swamp/hetzner-cloud/server-types model for availability and project limits

Resident/warm worker mode — `model method run` has ~6s fixed per-invocation overhead that rules out latency-sensitive use

Issue submission returns wrong URL path

Dynamic resource attribute refresh for model instances

`vault put` inside workflow steps still acquires global `.datastore.lock` after #382

extension quality scorer mis-detects quoted phrases in comments as bare imports

extension push: credentials-sensitive-field false positive when .meta({ sensitive: true }) is on a continuation line

Local source-loading should discover a report co-located with its model in a paths.base:manifest extension

extension push: optionally sync the published bundle to the manifest `repository:` (git mirror)

Add 'creek' extension kind for cross-querying external systems alongside swamp data

Docs: vault refresh hooks (--refresh-from, --refresh-ttl, --clear-refresh)

Support CI-friendly adversarial review artifacts for extension push

Deprecate "No slow types" (fast-check) rubric factor on server-side scorer

Registry scorer fails on bare specifiers — mirror CLI fix from #505

Official extension for GitHub repository configuration (environments, variables, secrets)

Feature request: @swamp/tailscale extension

Option to change email in your Swamp Club profile or delete account

Docs: vault reference in manual promotes inline KEY=VALUE as primary example

extension push error for disallowed file types doesn't mention binaries field

swamp help extension omits yank and unyank (machine-readable CLI schema misses real subcommands)

Extension model method execute lacks typed args/context — every author has to use ': any' to unblock tests

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation