diff --git a/packages/daemon/test/current-model-reader.test.ts b/packages/daemon/test/current-model-reader.test.ts
index 593a7eee0..18b57868b 100644
--- a/packages/daemon/test/current-model-reader.test.ts
+++ b/packages/daemon/test/current-model-reader.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, expect, it, vi } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync, appendFileSync, renameSync } from "node:fs";
+import { mkdtempSync, realpathSync, rmSync, writeFileSync, appendFileSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createFullTestDb, createTestApp } from "./helpers/test-app.js";
@@ -17,7 +17,7 @@ const cleanup: Array<() => void> = [];
 afterEach(() => { vi.restoreAllMocks(); for (const fn of cleanup.splice(0).reverse()) fn(); });
 function fixture(runtime = "claude-code") {
   const db = createFullTestDb(); cleanup.push(() => db.close());
-  const dir = mkdtempSync(join(tmpdir(), "observed-model-")); cleanup.push(() => rmSync(dir, { recursive: true, force: true }));
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "observed-model-"))); cleanup.push(() => rmSync(dir, { recursive: true, force: true }));
   const rigs = new RigRepository(db), sessions = new SessionRegistry(db), identities = new SeatIdentityStore(db);
   const rig = rigs.createRig("studio");
   const node = rigs.addNode(rig.id, "editor", { runtime, model: "configured-model", cwd: dir });
diff --git a/packages/daemon/test/generated-file-hygiene.test.ts b/packages/daemon/test/generated-file-hygiene.test.ts
index c5fa9813d..3f3e116d0 100644
--- a/packages/daemon/test/generated-file-hygiene.test.ts
+++ b/packages/daemon/test/generated-file-hygiene.test.ts
@@ -27,7 +27,7 @@ describe("generated file Git hygiene", () => {
   let root: string;
   let repo: string;
   beforeEach(() => {
-    root = fs.mkdtempSync(path.join(os.tmpdir(), "generated-file-hygiene-"));
+    root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "generated-file-hygiene-")));
     repo = path.join(root, "repo"); fs.mkdirSync(repo);
     git(repo, "init", "-q");
     git(repo, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "--allow-empty", "-qm", "initial");
diff --git a/packages/daemon/test/proof-project-scope.test.ts b/packages/daemon/test/proof-project-scope.test.ts
index 64284c7b9..774851e37 100644
--- a/packages/daemon/test/proof-project-scope.test.ts
+++ b/packages/daemon/test/proof-project-scope.test.ts
@@ -26,7 +26,7 @@ function project(root: string, id: string, judge: string, missionsDir = "mission
 }
 
 function fixture(alphaMissions = "missions") {
-  const workspace = fs.mkdtempSync(join(tmpdir(), "proof-catalog-")); fixtures.push(workspace);
+  const workspace = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "proof-catalog-"))); fixtures.push(workspace);
   write(join(workspace, "workspace.yaml"), { projects: [{ id: "alpha", root: "alpha" }, { id: "beta", root: "beta" }] });
   const alpha = project(join(workspace, "alpha"), "alpha", "judge@rig", alphaMissions);
   const beta = project(join(workspace, "beta"), "beta", "judge@rig");
@@ -102,7 +102,7 @@ describe("project-qualified proof scope (#132)", () => {
     expect((await sibling.json()).error).toBe("path_escape");
     const judged = await f.judge("alpha:../../legacy/missions/m0/slices/01-t001", {}, f.legacy.slice);
     expect((await judged.json()).error).toBe("path_escape");
-    const outside = fs.mkdtempSync(join(tmpdir(), "proof-outside-")); fixtures.push(outside);
+    const outside = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "proof-outside-"))); fixtures.push(outside);
     fs.writeFileSync(join(outside, "evidence.md"), "outside");
     fs.symlinkSync(outside, join(f.alpha.slice, "proof/outside"));
     const evidence = await f.judge("alpha:m0/slices/01-t001", { evidence: ["proof/outside/evidence.md"] });
@@ -166,7 +166,7 @@ describe("project-qualified proof scope (#132)", () => {
   });
 
   it("a README-only catalog project under an ancestor project.yaml can't reach evidence outside its own root (CodeRabbit, CWE-22)", async () => {
-    const ws = fs.mkdtempSync(join(tmpdir(), "proof-ancestor-")); fixtures.push(ws);
+    const ws = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "proof-ancestor-"))); fixtures.push(ws);
     // the workspace itself has a project.yaml whose policy would authorise the judge; the catalog project has none
     write(join(ws, "project.yaml"), { kind: "project", metadata: { id: "outer" }, proofPolicy: { judges: ["judge@rig"] } });
     write(join(ws, "workspace.yaml"), { projects: [{ id: "readme-only", root: "readme-only" }] });
@@ -205,7 +205,7 @@ describe("project-qualified proof scope (#132)", () => {
   // Review (2026-10-01): scope readiness agrees with proof. A catalogued project that keeps its contract in README
   // (no SPEC, no project.yaml of its own) sits under a workspace whose own project.yaml has a different judge.
   function readmeProject() {
-    const ws = fs.mkdtempSync(join(tmpdir(), "proof-scopes-")); fixtures.push(ws);
+    const ws = fs.realpathSync(fs.mkdtempSync(join(tmpdir(), "proof-scopes-"))); fixtures.push(ws);
     write(join(ws, "project.yaml"), { kind: "project", metadata: { id: "outer" }, proofPolicy: { judges: ["outer@rig"] } });
     write(join(ws, "workspace.yaml"), { projects: [{ id: "readme-only", root: "readme-only" }, { id: "bare", root: "bare" }] });
     const mission = (root: string, policy: object) => {
diff --git a/packages/daemon/test/refocus-work-packet.test.ts b/packages/daemon/test/refocus-work-packet.test.ts
index 6f5e3fd47..50a2a9285 100644
--- a/packages/daemon/test/refocus-work-packet.test.ts
+++ b/packages/daemon/test/refocus-work-packet.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, it } from "vitest";
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, realpathSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -28,7 +28,7 @@ afterEach(() => {
 const nothingElse: WorkCandidateLookups = { getRow: () => null, continuationOf: () => null };
 
 function world() {
-  root = mkdtempSync(join(tmpdir(), "refocus-work-packet-"));
+  root = realpathSync(mkdtempSync(join(tmpdir(), "refocus-work-packet-")));
   const workspace = join(root, "workspace");
   const missions = join(workspace, "missions");
   const topology = join(root, "topology");
diff --git a/packages/daemon/test/transcript-seat-env-native.test.ts b/packages/daemon/test/transcript-seat-env-native.test.ts
index 00cb64200..7ca2f5ee3 100644
--- a/packages/daemon/test/transcript-seat-env-native.test.ts
+++ b/packages/daemon/test/transcript-seat-env-native.test.ts
@@ -53,8 +53,8 @@ describe.skipIf(process.platform === "win32")("native transcript seat environmen
         if (prior[index] === undefined) delete process.env[key]; else process.env[key] = prior[index];
       }
       await runFile("tmux", ["-S", socket, "kill-server"], { env }).catch(() => {});
-      fs.rmSync(temp, { recursive: true, force: true });
-      fs.rmSync(socketDir, { recursive: true, force: true });
+      await fs.promises.rm(temp, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
+      await fs.promises.rm(socketDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
     }
   });
 });