diff --git a/src/foundation/compat.c b/src/foundation/compat.c
index 45e0b3915..cd826f133 100644
--- a/src/foundation/compat.c
+++ b/src/foundation/compat.c
@@ -49,9 +49,9 @@ char *cbm_strcasestr(const char *haystack, const char *needle) {
 #ifdef _WIN32
 #include <direct.h>
 char *cbm_mkdtemp(char *tmpl) {
-    /* On Windows, /tmp doesn't exist. Rewrite to %TEMP%.
-     * All callers use buffers >= 256 bytes (checked by convention). */
-    char buf[512];
+    /* Build path in static buffer, then copy back to caller.
+     * Callers must provide buffers >= 256 bytes (all test code does). */
+    static char buf[512];
     if (strncmp(tmpl, "/tmp/", 5) == 0) {
         const char *tmp = getenv("TEMP");
         if (!tmp)
@@ -66,7 +66,7 @@ char *cbm_mkdtemp(char *tmpl) {
         return NULL;
     if (_mkdir(buf) != 0)
         return NULL;
-    /* Copy back — callers expect tmpl to be modified in place (POSIX contract) */
+    /* Copy result back — callers now use char[256]+ buffers */
     strcpy(tmpl, buf);
     return tmpl;
 }
diff --git a/src/foundation/compat.h b/src/foundation/compat.h
index 5f92cf28a..d15d48df1 100644
--- a/src/foundation/compat.h
+++ b/src/foundation/compat.h
@@ -90,6 +90,8 @@ static inline int cbm_nanosleep(const struct timespec *req, struct timespec *rem
 
 /* ── mkdtemp (Windows lacks it) ──────────────────────────────── */
 #ifdef _WIN32
+/* Translates /tmp/ to %TEMP%\ and copies result back to tmpl.
+ * Callers MUST use char buf[256] or larger. */
 char *cbm_mkdtemp(char *tmpl);
 #else
 #define cbm_mkdtemp mkdtemp
diff --git a/tests/test_cli.c b/tests/test_cli.c
index df9b7849a..483c09dfe 100644
--- a/tests/test_cli.c
+++ b/tests/test_cli.c
@@ -174,7 +174,7 @@ TEST(cli_version_get_set) {
  * ═══════════════════════════════════════════════════════════════════ */
 
 TEST(cli_detect_shell_rc_zsh) {
-    char tmpdir[] = "/tmp/cli-rc-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-rc-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -197,7 +197,7 @@ TEST(cli_detect_shell_rc_zsh) {
 }
 
 TEST(cli_detect_shell_rc_bash) {
-    char tmpdir[] = "/tmp/cli-rc-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-rc-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -221,7 +221,7 @@ TEST(cli_detect_shell_rc_bash) {
 
 TEST(cli_detect_shell_rc_bash_with_bashrc) {
     /* Port of TestDetectShellRC_BashWithBashrc */
-    char tmpdir[] = "/tmp/cli-rc-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-rc-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -248,7 +248,7 @@ TEST(cli_detect_shell_rc_bash_with_bashrc) {
 }
 
 TEST(cli_detect_shell_rc_fish) {
-    char tmpdir[] = "/tmp/cli-rc-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-rc-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -269,7 +269,7 @@ TEST(cli_detect_shell_rc_fish) {
 }
 
 TEST(cli_detect_shell_rc_default) {
-    char tmpdir[] = "/tmp/cli-rc-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-rc-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -295,7 +295,7 @@ TEST(cli_detect_shell_rc_default) {
 
 TEST(cli_find_cli_not_found) {
     /* Port of TestFindCLI_NotFound */
-    char tmpdir[] = "/tmp/cli-find-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-find-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -316,7 +316,7 @@ TEST(cli_find_cli_not_found) {
 
 TEST(cli_find_cli_on_path) {
     /* Port of TestFindCLI_FoundOnPATH */
-    char tmpdir[] = "/tmp/cli-find-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-find-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -344,7 +344,7 @@ TEST(cli_find_cli_on_path) {
 
 TEST(cli_find_cli_fallback_paths) {
     /* Port of TestFindCLI_FallbackPaths */
-    char tmpdir[] = "/tmp/cli-find-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-find-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -397,7 +397,7 @@ TEST(cli_dry_run_flags) {
 
 TEST(cli_skill_creation) {
     /* Port of TestInstallSkillCreation */
-    char tmpdir[] = "/tmp/cli-skill-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-skill-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -427,7 +427,7 @@ TEST(cli_skill_creation) {
 
 TEST(cli_skill_idempotent) {
     /* Port of TestInstallIdempotent */
-    char tmpdir[] = "/tmp/cli-skill-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-skill-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -456,7 +456,7 @@ TEST(cli_skill_idempotent) {
 
 TEST(cli_skill_force_overwrite) {
     /* Port of TestCLI_InstallForceOverwrites */
-    char tmpdir[] = "/tmp/cli-skill-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-skill-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -475,7 +475,7 @@ TEST(cli_skill_force_overwrite) {
 
 TEST(cli_uninstall_removes_skills) {
     /* Port of TestUninstallRemovesSkills */
-    char tmpdir[] = "/tmp/cli-skill-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-skill-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -501,7 +501,7 @@ TEST(cli_uninstall_removes_skills) {
 
 TEST(cli_remove_old_monolithic_skill) {
     /* Port of TestRemoveOldMonolithicSkill */
-    char tmpdir[] = "/tmp/cli-skill-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-skill-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -580,7 +580,7 @@ TEST(cli_codex_instructions) {
 
 TEST(cli_editor_mcp_install) {
     /* Port of TestEditorMCPInstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -602,7 +602,7 @@ TEST(cli_editor_mcp_install) {
 
 TEST(cli_editor_mcp_idempotent) {
     /* Port of TestEditorMCPInstallIdempotent */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -632,7 +632,7 @@ TEST(cli_editor_mcp_idempotent) {
 
 TEST(cli_editor_mcp_preserves_others) {
     /* Port of TestEditorMCPPreservesOtherServers */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -660,7 +660,7 @@ TEST(cli_editor_mcp_preserves_others) {
 
 TEST(cli_editor_mcp_uninstall) {
     /* Port of TestEditorMCPUninstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -682,7 +682,7 @@ TEST(cli_editor_mcp_uninstall) {
 
 TEST(cli_gemini_mcp_install) {
     /* Port of TestGeminiMCPInstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -708,7 +708,7 @@ TEST(cli_gemini_mcp_install) {
 
 TEST(cli_vscode_mcp_install) {
     /* Port of TestVSCodeMCPInstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -732,7 +732,7 @@ TEST(cli_vscode_mcp_install) {
 
 TEST(cli_vscode_mcp_uninstall) {
     /* Port of TestVSCodeMCPUninstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -757,7 +757,7 @@ TEST(cli_vscode_mcp_uninstall) {
 
 TEST(cli_zed_mcp_install) {
     /* Port of TestZedMCPInstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -781,7 +781,7 @@ TEST(cli_zed_mcp_install) {
 
 TEST(cli_zed_mcp_preserves_settings) {
     /* Port of TestZedMCPPreservesSettings */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -811,7 +811,7 @@ TEST(cli_zed_mcp_preserves_settings) {
 
 TEST(cli_zed_mcp_uninstall) {
     /* Port of TestZedMCPUninstall */
-    char tmpdir[] = "/tmp/cli-mcp-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-mcp-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -836,7 +836,7 @@ TEST(cli_zed_mcp_uninstall) {
 
 TEST(cli_ensure_path_append) {
     /* Port of TestCLI_InstallPATHAppend */
-    char tmpdir[] = "/tmp/cli-path-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-path-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -855,7 +855,7 @@ TEST(cli_ensure_path_append) {
 }
 
 TEST(cli_ensure_path_already_present) {
-    char tmpdir[] = "/tmp/cli-path-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-path-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -871,7 +871,7 @@ TEST(cli_ensure_path_already_present) {
 }
 
 TEST(cli_ensure_path_dry_run) {
-    char tmpdir[] = "/tmp/cli-path-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-path-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -896,7 +896,7 @@ TEST(cli_ensure_path_dry_run) {
 
 TEST(cli_copy_file) {
     /* Port of TestCopyFile */
-    char tmpdir[] = "/tmp/cli-copy-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-copy-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -918,7 +918,7 @@ TEST(cli_copy_file) {
 
 TEST(cli_copy_file_source_not_found) {
     /* Port of TestCopyFile_SourceNotFound */
-    char tmpdir[] = "/tmp/cli-copy-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-copy-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -988,7 +988,7 @@ TEST(cli_extract_binary_from_targz_invalid_data) {
 
 TEST(cli_install_dry_run) {
     /* Port of TestCLI_InstallDryRun */
-    char tmpdir[] = "/tmp/cli-dry-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-dry-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -1013,7 +1013,7 @@ TEST(cli_install_dry_run) {
 
 TEST(cli_uninstall_dry_run) {
     /* Port of TestCLI_UninstallDryRun */
-    char tmpdir[] = "/tmp/cli-dry-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-dry-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -1043,7 +1043,7 @@ TEST(cli_uninstall_dry_run) {
 
 TEST(cli_install_and_uninstall) {
     /* Port of TestCLI_InstallAndUninstall */
-    char tmpdir[] = "/tmp/cli-full-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-full-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
diff --git a/tests/test_httplink.c b/tests/test_httplink.c
index df5241988..14dc0f693 100644
--- a/tests/test_httplink.c
+++ b/tests/test_httplink.c
@@ -549,7 +549,7 @@ TEST(httplink_load_config_default) {
 
 TEST(httplink_load_config_from_file) {
     /* Create temp dir with .cgrconfig */
-    char tmpdir[] = "/tmp/httplink-cfg-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/httplink-cfg-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -589,7 +589,7 @@ TEST(httplink_load_config_from_file) {
 
 TEST(httplink_load_config_invalid_yaml) {
     /* Invalid YAML → fallback to defaults */
-    char tmpdir[] = "/tmp/httplink-bad-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/httplink-bad-XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -719,7 +719,7 @@ TEST(httplink_route_extraction_negative_cases) {
 
 TEST(httplink_read_source_lines) {
     /* Create temp dir with test file */
-    char tmpdir[] = "/tmp/httplink-test-XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/httplink-test-XXXXXX");
     if (!cbm_mkdtemp(tmpdir)) {
         printf("  SKIP: cbm_mkdtemp failed\n");
         return -1;
diff --git a/tests/test_pipeline.c b/tests/test_pipeline.c
index fc1d888f1..ca894254e 100644
--- a/tests/test_pipeline.c
+++ b/tests/test_pipeline.c
@@ -4182,7 +4182,7 @@ static int has_binding_value(const cbm_env_binding_t *bindings, int count, const
 }
 
 TEST(envscan_dockerfile_env_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_dock_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_dock_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4211,7 +4211,7 @@ TEST(envscan_dockerfile_env_urls) {
 }
 
 TEST(envscan_shell_env_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_sh_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_sh_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4238,7 +4238,7 @@ TEST(envscan_shell_env_urls) {
 }
 
 TEST(envscan_env_file_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_env_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_env_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4264,7 +4264,7 @@ TEST(envscan_env_file_urls) {
 }
 
 TEST(envscan_toml_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_toml_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_toml_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4291,7 +4291,7 @@ TEST(envscan_toml_urls) {
 }
 
 TEST(envscan_yaml_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_yaml_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_yaml_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4316,7 +4316,7 @@ TEST(envscan_yaml_urls) {
 }
 
 TEST(envscan_terraform_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_tf_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_tf_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4342,7 +4342,7 @@ TEST(envscan_terraform_urls) {
 }
 
 TEST(envscan_properties_urls) {
-    char tmpdir[] = "/tmp/cbm_envscan_prop_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_prop_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4364,7 +4364,7 @@ TEST(envscan_properties_urls) {
 }
 
 TEST(envscan_secret_key_exclusion) {
-    char tmpdir[] = "/tmp/cbm_envscan_skey_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_skey_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4392,7 +4392,7 @@ TEST(envscan_secret_key_exclusion) {
 }
 
 TEST(envscan_secret_value_exclusion) {
-    char tmpdir[] = "/tmp/cbm_envscan_sval_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_sval_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4417,7 +4417,7 @@ TEST(envscan_secret_value_exclusion) {
 }
 
 TEST(envscan_secret_file_exclusion) {
-    char tmpdir[] = "/tmp/cbm_envscan_sfile_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_sfile_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4450,7 +4450,7 @@ TEST(envscan_secret_file_exclusion) {
 }
 
 TEST(envscan_skips_ignored_dirs) {
-    char tmpdir[] = "/tmp/cbm_envscan_ign_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_ign_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
@@ -4498,7 +4498,7 @@ TEST(envscan_skips_ignored_dirs) {
 }
 
 TEST(envscan_non_url_values_skipped) {
-    char tmpdir[] = "/tmp/cbm_envscan_nurl_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_envscan_nurl_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("tmpdir");
 
diff --git a/tests/test_ui.c b/tests/test_ui.c
index 3cdb23ddc..43d97c52a 100644
--- a/tests/test_ui.c
+++ b/tests/test_ui.c
@@ -24,7 +24,7 @@ TEST(config_load_defaults) {
     cfg.ui_port = 1234;
 
     /* Use a temp HOME to avoid touching real config */
-    char tmpdir[] = "/tmp/cbm_test_config_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_test_config_XXXXXX");
     char *td = cbm_mkdtemp(tmpdir);
     ASSERT_NOT_NULL(td);
 
@@ -46,7 +46,7 @@ TEST(config_load_defaults) {
 }
 
 TEST(config_save_and_reload) {
-    char tmpdir[] = "/tmp/cbm_test_config_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_test_config_XXXXXX");
     char *td = cbm_mkdtemp(tmpdir);
     ASSERT_NOT_NULL(td);
 
@@ -73,7 +73,7 @@ TEST(config_save_and_reload) {
 }
 
 TEST(config_overwrite) {
-    char tmpdir[] = "/tmp/cbm_test_config_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_test_config_XXXXXX");
     char *td = cbm_mkdtemp(tmpdir);
     ASSERT_NOT_NULL(td);
 
@@ -102,7 +102,7 @@ TEST(config_overwrite) {
 }
 
 TEST(config_corrupt_file) {
-    char tmpdir[] = "/tmp/cbm_test_config_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_test_config_XXXXXX");
     char *td = cbm_mkdtemp(tmpdir);
     ASSERT_NOT_NULL(td);
 
@@ -140,7 +140,7 @@ TEST(config_corrupt_file) {
 }
 
 TEST(config_missing_fields) {
-    char tmpdir[] = "/tmp/cbm_test_config_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_test_config_XXXXXX");
     char *td = cbm_mkdtemp(tmpdir);
     ASSERT_NOT_NULL(td);
 
diff --git a/tests/test_watcher.c b/tests/test_watcher.c
index 9e2af11e6..7a3d8a364 100644
--- a/tests/test_watcher.c
+++ b/tests/test_watcher.c
@@ -229,7 +229,7 @@ TEST(watcher_stop_flag) {
 
 TEST(watcher_detects_git_commit) {
     /* Create a temporary git repo */
-    char tmpdir[] = "/tmp/cbm_watcher_test_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_test_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -282,7 +282,7 @@ TEST(watcher_detects_git_commit) {
 
 TEST(watcher_detects_dirty_worktree) {
     /* Create a temporary git repo */
-    char tmpdir[] = "/tmp/cbm_watcher_dirty_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_dirty_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -326,7 +326,7 @@ TEST(watcher_detects_dirty_worktree) {
 
 TEST(watcher_detects_new_file) {
     /* Create a temporary git repo */
-    char tmpdir[] = "/tmp/cbm_watcher_newf_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_newf_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -371,7 +371,7 @@ TEST(watcher_detects_new_file) {
 
 TEST(watcher_no_change_no_reindex) {
     /* Create a temporary git repo */
-    char tmpdir[] = "/tmp/cbm_watcher_nochg_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_nochg_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -414,8 +414,8 @@ TEST(watcher_no_change_no_reindex) {
 
 TEST(watcher_multiple_projects) {
     /* Create two temporary git repos */
-    char tmpdirA[] = "/tmp/cbm_watcher_mA_XXXXXX";
-    char tmpdirB[] = "/tmp/cbm_watcher_mB_XXXXXX";
+    char tmpdirA[256]; snprintf(tmpdirA, sizeof(tmpdirA), "/tmp/cbm_watcher_mA_XXXXXX");
+    char tmpdirB[256]; snprintf(tmpdirB, sizeof(tmpdirB), "/tmp/cbm_watcher_mB_XXXXXX");
     if (!cbm_mkdtemp(tmpdirA) || !cbm_mkdtemp(tmpdirB))
         SKIP("cbm_mkdtemp failed");
 
@@ -475,7 +475,7 @@ TEST(watcher_multiple_projects) {
 TEST(watcher_non_git_skips) {
     /* Non-git dir → baseline sets is_git=false → poll never reindexes.
      * Port of TestProbeStrategyNonGit behavior. */
-    char tmpdir[] = "/tmp/cbm_watcher_nongit_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_nongit_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -524,7 +524,7 @@ TEST(watcher_interval_blocks_repoll) {
     /* After baseline, the adaptive interval (5s minimum) should block
      * immediate re-polling. Without touch(), the next poll is a no-op.
      * Port of TestWatcherGitNoChanges' interval behavior. */
-    char tmpdir[] = "/tmp/cbm_watcher_intv_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_intv_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -598,7 +598,7 @@ TEST(watcher_git_removed_no_crash) {
     /* Init git repo, baseline, remove .git, poll → should not crash.
      * Port of TestStrategyDowngradeGitToDirMtime behavior (C version
      * doesn't downgrade — just git commands fail silently). */
-    char tmpdir[] = "/tmp/cbm_watcher_rmgit_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_rmgit_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -643,7 +643,7 @@ TEST(watcher_git_removed_no_crash) {
 TEST(watcher_continued_dirty) {
     /* If working tree stays dirty, each poll should re-trigger reindex.
      * Port of repeated git sentinel detection behavior. */
-    char tmpdir[] = "/tmp/cbm_watcher_cont_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_cont_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -711,7 +711,7 @@ TEST(watcher_continued_dirty) {
 TEST(watcher_baseline_dirty_repo) {
     /* Baseline on a repo that already has uncommitted changes.
      * Port of TestGitSentinelDetectsEdit (dirty from the start). */
-    char tmpdir[] = "/tmp/cbm_watcher_bld_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_bld_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -755,7 +755,7 @@ TEST(watcher_baseline_dirty_repo) {
 TEST(watcher_unwatch_prunes_state) {
     /* Watch, baseline, unwatch → project state removed.
      * Port of TestPollAllPrunesUnwatched + TestWatcherPrunesDeletedProjects. */
-    char tmpdir[] = "/tmp/cbm_watcher_prune_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_prune_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -801,7 +801,7 @@ TEST(watcher_unwatch_prunes_state) {
 TEST(watcher_watch_after_unwatch) {
     /* Re-watching after unwatch should start fresh (new baseline).
      * Tests lifecycle correctness. */
-    char tmpdir[] = "/tmp/cbm_watcher_rewatch_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_rewatch_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -862,7 +862,7 @@ TEST(watcher_watch_after_unwatch) {
 TEST(watcher_detects_file_delete) {
     /* Port of TestFSNotifyDetectsFileDelete:
      * Delete a tracked file → git status shows change → reindex triggered. */
-    char tmpdir[] = "/tmp/cbm_watcher_del_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_del_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -907,7 +907,7 @@ TEST(watcher_detects_file_delete) {
 TEST(watcher_detects_subdir_file) {
     /* Port of TestFSNotifyWatchesNewSubdir:
      * Create new subdir + file in it → git detects untracked → reindex. */
-    char tmpdir[] = "/tmp/cbm_watcher_sub_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_sub_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -978,7 +978,7 @@ TEST(watcher_full_flow_new_file) {
      * Full lifecycle: watch → baseline → add file → detect change.
      * This is a more thorough version of watcher_detects_new_file
      * that mirrors the Go test's structure exactly. */
-    char tmpdir[] = "/tmp/cbm_watcher_ffnf_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_ffnf_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -1028,7 +1028,7 @@ TEST(watcher_fallback_still_detects) {
      * Even when the "primary" strategy has issues, the watcher
      * still detects changes. In C, we test that after removing .git
      * and re-creating it, changes are still detected on re-watch. */
-    char tmpdir[] = "/tmp/cbm_watcher_fb_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_fb_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -1086,8 +1086,8 @@ TEST(watcher_poll_only_watched_projects) {
     /* Port of TestPollAllOnlyWatched:
      * Two repos exist, only one is watched → only the watched one
      * gets polled and can trigger reindex. */
-    char tmpdirA[] = "/tmp/cbm_watcher_owA_XXXXXX";
-    char tmpdirB[] = "/tmp/cbm_watcher_owB_XXXXXX";
+    char tmpdirA[256]; snprintf(tmpdirA, sizeof(tmpdirA), "/tmp/cbm_watcher_owA_XXXXXX");
+    char tmpdirB[256]; snprintf(tmpdirB, sizeof(tmpdirB), "/tmp/cbm_watcher_owB_XXXXXX");
     if (!cbm_mkdtemp(tmpdirA) || !cbm_mkdtemp(tmpdirB))
         SKIP("cbm_mkdtemp failed");
 
@@ -1145,7 +1145,7 @@ TEST(watcher_touch_resets_immediate) {
     /* Port of TestTouchProjectUpdatesTimestamp:
      * Verify that touch() resets the adaptive backoff so the next
      * poll actually checks for changes immediately. */
-    char tmpdir[] = "/tmp/cbm_watcher_tch_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_tch_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");
 
@@ -1195,7 +1195,7 @@ TEST(watcher_modify_tracked_file) {
      * Modify tracked file content (not just create/delete) → detected.
      * Similar to watcher_detects_dirty_worktree but modifies specific
      * tracked file content rather than appending. */
-    char tmpdir[] = "/tmp/cbm_watcher_mod_XXXXXX";
+    char tmpdir[256]; snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_mod_XXXXXX");
     if (!cbm_mkdtemp(tmpdir))
         SKIP("cbm_mkdtemp failed");