Scratchpad directory under /tmp is erased on reboot (systemd-tmpfiles); system prompt gives no volatility warning — a full day of pipeline output lost

## Summary

The system prompt tells the model to use a session-specific scratchpad directory for **all** temporary files, and that directory lives under `/tmp`. On a standard Debian/Ubuntu-style system `systemd-tmpfiles` ships `D /tmp 1777 root root 30d`, which **erases `/tmp` on every boot**. Nothing in the system prompt or the docs warns that the scratchpad is volatile across reboots.

In a long-running session (data-generation pipeline for an LLM fine-tuning dataset, ~24 h of wall-clock work, tens of thousands of API calls across several paid providers), the host rebooted and the entire scratchpad was gone: all generated data, all review verdicts, all pipeline scripts, the Python venv, and every background job launched from it. Nothing was recoverable from inside the container.

## Environment

- Claude Code 2.1.260, Linux (LXC container, Proxmox host), bash
- Scratchpad path pattern: `/tmp/claude-0///scratchpad`
- `/usr/lib/tmpfiles.d/tmp.conf`: `D /tmp 1777 root root 30d`

## Steps to reproduce

1. Start a session; follow the system prompt's instruction to keep all working files in the scratchpad directory.
2. Run a multi-hour pipeline that writes its outputs there (and launches background workers with `setsid nohup`).
3. Reboot the host.
4. The scratchpad directory is recreated empty; all data and processes are gone.

## Expected

One or more of:

- The scratchpad should default to a location that survives reboots (e.g. under `~/.claude/` or `$XDG_STATE_HOME`), or Claude Code should create it with a `tmpfiles.d` exclusion (`x /tmp/claude-0`).
- At minimum, the system prompt should state explicitly that the scratchpad is **volatile and erased on reboot**, so that the model copies long-running outputs somewhere persistent. The current wording ("Use this directory for ALL temporary file needs … intermediate results … outputs") actively steers the model into keeping multi-hour work there.
- Optionally, a warning in the UI when a session's scratchpad exceeds some size or age.

## Impact

Loss of roughly one day of generation and review work and the associated provider credits. The model followed the system prompt's instruction; the instruction itself was the hazard.

No secrets, credentials, hostnames or proprietary content are included in this report. Session reference available on request.

Review the system prompt wording that directs all temporary files to the session scratchpad, along with /usr/lib/tmpfiles.d/tmp.conf and the documented /tmp/claude-0 path pattern. Determine whether the intended fix is a persistent default, a tmpfiles exclusion, or an explicit volatility warning; done means the chosen behavior is documented and a reboot no longer silently loses work or clearly warns users first.

由索引模型根据 Issue 内容生成。