From a833229d87684142b8cdb5a9a7531655add57172 Mon Sep 17 00:00:00 2001
From: Stephen Waits <steve@waits.net>
Date: Sat, 17 Oct 2026 19:54:30 -0600
Subject: [PATCH] tests: every test dir is removed when its test ends, pass or
 panic

Many test helpers removed their temp dir only before the test, or only
on pass, so runs left them behind: 117,000 filled /tmp (RAM here) and
stopped a mutation run. Each now holds a guard that removes the dir on
drop, unwind included; servers started on a test dir hold its guard
until they stop. A full cargo test --workspace leaves 0 dirs (859
before). just sweep-test-tmp stays for runs killed mid-test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj
---
 .../ledger-config/tests/effective_policy.rs   | 21 +++++-
 crates/ledger-gui/src/attention.rs            |  8 +-
 crates/ledger-gui/src/pages/reports.rs        | 13 +++-
 crates/ledger-gui/tests/breadcrumbs.rs        | 22 ++++--
 crates/ledger-gui/tests/copy.rs               | 11 ++-
 crates/ledger-gui/tests/live.rs               | 11 ++-
 crates/ledger-gui/tests/newer_journal.rs      | 24 +++++-
 crates/ledger-gui/tests/read_only.rs          |  9 ++-
 crates/ledger-gui/tests/screens.rs            | 12 +++
 crates/ledger-gui/tests/show.rs               | 11 ++-
 crates/ledger-gui/tests/vault_key_flag.rs     | 11 ++-
 crates/ledger-gui/tests/view_model.rs         | 48 +++++++-----
 crates/ledger-mcp/src/local_files.rs          | 75 +++++++++++++------
 crates/ledger-mcp/src/server.rs               | 54 +++++++++----
 crates/ledger-mcp/src/settings.rs             | 21 +++++-
 crates/ledger-mcp/src/tin_files.rs            | 22 +++++-
 crates/ledger-mcp/tests/hostile_args.rs       |  7 ++
 crates/ledger-mcp/tests/http_concurrency.rs   | 11 +++
 crates/ledger-mcp/tests/mcp_stdio.rs          | 32 +++++++-
 crates/ledger-mcp/tests/oracle_mcp.rs         | 43 +++++++----
 crates/ledger-mcp/tests/spec_assets.rs        | 31 +++++++-
 crates/ledger-mcp/tests/spec_attachments.rs   | 33 +++++++-
 crates/ledger-mcp/tests/spec_kept.rs          | 26 ++++++-
 crates/ledger-mcp/tests/spec_mcp.rs           | 39 +++++++++-
 crates/ledger-mcp/tests/spec_parties.rs       | 33 +++++++-
 crates/ledger-mcp/tests/spec_vault.rs         | 37 ++++++++-
 crates/ledger-mcp/tests/startup.rs            | 41 ++++++++--
 crates/ledger-mcp/tests/tin_files.rs          | 10 +++
 crates/ledger-store/src/viewer.rs             | 10 +++
 crates/ledger-store/tests/asset_tags.rs       | 28 ++++++-
 crates/ledger-store/tests/attachments.rs      | 26 ++++++-
 crates/ledger-store/tests/bounds.rs           | 39 ++++++++--
 crates/ledger-store/tests/concurrency.rs      | 26 ++++++-
 crates/ledger-store/tests/faults.rs           | 28 ++++++-
 crates/ledger-store/tests/format.rs           | 26 ++++++-
 crates/ledger-store/tests/parties.rs          | 26 ++++++-
 crates/ledger-store/tests/party_tin.rs        | 26 ++++++-
 crates/ledger-store/tests/roles.rs            | 26 ++++++-
 crates/ledger-store/tests/settings.rs         | 28 ++++++-
 crates/ledger-store/tests/snapshot.rs         | 26 ++++++-
 crates/ledger-store/tests/spec_store.rs       | 26 ++++++-
 crates/ledger-store/tests/store.rs            | 28 ++++++-
 crates/ledger-vault/tests/vault.rs            | 20 ++++-
 justfile                                      | 10 ++-
 44 files changed, 952 insertions(+), 163 deletions(-)

diff --git a/crates/ledger-config/tests/effective_policy.rs b/crates/ledger-config/tests/effective_policy.rs
index d087a58..97e2d53 100644
--- a/crates/ledger-config/tests/effective_policy.rs
+++ b/crates/ledger-config/tests/effective_policy.rs
@@ -3,11 +3,27 @@
 
 use ledger_config::{BooksSettings, effective_receipt_policy};
 
-fn dir(tag: &str) -> std::path::PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn dir(tag: &str) -> TestDir {
     let d = std::env::temp_dir().join(format!("ledger-config-policy-{}-{tag}", std::process::id()));
     let _ = std::fs::remove_dir_all(&d);
     std::fs::create_dir_all(&d).unwrap();
-    d
+    TestDir(d)
 }
 
 #[test]
@@ -37,5 +53,4 @@ fn config_json_wins_else_the_settings_file() {
         err.starts_with(&format!("bad config {}", json.display())),
         "{err}"
     );
-    std::fs::remove_dir_all(&d).unwrap();
 }
diff --git a/crates/ledger-gui/src/attention.rs b/crates/ledger-gui/src/attention.rs
index c9e84c8..25bd97d 100644
--- a/crates/ledger-gui/src/attention.rs
+++ b/crates/ledger-gui/src/attention.rs
@@ -670,16 +670,16 @@ mod tests {
         let dir =
             std::env::temp_dir().join(format!("ledger-gui-attention-{}-{tag}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
+        // Loaded books need no files: removed once loaded, pass or panic.
+        let _cleanup = crate::test_support::TempDir(dir.clone());
         let data_dir = dir.join("books-data");
         ledger_store::Store::create(&data_dir, ledger_core::Currency::USD).unwrap();
-        let b = crate::data::load_once(&crate::data::Source {
+        crate::data::load_once(&crate::data::Source {
             data_dir,
             books_toml: None,
             today: Some(today),
         })
-        .unwrap();
-        let _ = std::fs::remove_dir_all(&dir);
-        b
+        .unwrap()
     }
 
     /// INVARIANTS 2 and 4: a dated rule past its review is one Todo item
diff --git a/crates/ledger-gui/src/pages/reports.rs b/crates/ledger-gui/src/pages/reports.rs
index 6af5e82..f07d03c 100644
--- a/crates/ledger-gui/src/pages/reports.rs
+++ b/crates/ledger-gui/src/pages/reports.rs
@@ -2169,6 +2169,15 @@ mod tests {
     }
     use super::*;
 
+    /// A test's dir, removed when the test ends, pass or panic.
+    struct TestDir(std::path::PathBuf);
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
     /// The fixed asset register report's tax columns are the register's:
     /// each held asset's contributor's basis, tax basis, and built-in gain
     /// (ledger-core's Asset::tax_basis and built_in_gain), the total its
@@ -2178,6 +2187,7 @@ mod tests {
         let today = NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
         let dir = std::env::temp_dir().join(format!("ledger-gui-tax-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
+        let _cleanup = TestDir(dir.clone());
         crate::demo::build(&dir, today).unwrap();
         let b = crate::data::load_once(&crate::data::Source {
             data_dir: dir.join("books-data"),
@@ -2234,7 +2244,6 @@ mod tests {
                 .iter()
                 .any(|row| row.kind == Kind::Note && row.label.contains("fair market value"))
         );
-        let _ = std::fs::remove_dir_all(&dir);
     }
 
     /// Every table-backed report typesets as a PDF, in its plain, by-month,
@@ -2244,6 +2253,7 @@ mod tests {
         let today = NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
         let dir = std::env::temp_dir().join(format!("ledger-gui-pdf-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
+        let _cleanup = TestDir(dir.clone());
         crate::demo::build(&dir, today).unwrap();
         let b = crate::data::load_once(&crate::data::Source {
             data_dir: dir.join("books-data"),
@@ -2296,6 +2306,5 @@ mod tests {
                 std::fs::write(d.join(format!("{name}.pdf")), bytes).unwrap();
             }
         }
-        let _ = std::fs::remove_dir_all(&dir);
     }
 }
diff --git a/crates/ledger-gui/tests/breadcrumbs.rs b/crates/ledger-gui/tests/breadcrumbs.rs
index 81b2382..5508593 100644
--- a/crates/ledger-gui/tests/breadcrumbs.rs
+++ b/crates/ledger-gui/tests/breadcrumbs.rs
@@ -17,22 +17,34 @@ use ledger_gui::nav::{ReportKind, Route, Section};
 use ledger_gui::palette::{crumbs, describe};
 use ledger_gui::{App, Source, data};
 
-fn demo(tag: &str) -> Source {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// The demo books, kept while the guard lives.
+fn demo(tag: &str) -> (TestDir, Source) {
     let dir = std::env::temp_dir().join(format!("ledger-gui-crumbs-{tag}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     let today = chrono::NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
     ledger_gui::demo::build(&dir, today).unwrap();
-    Source {
+    let source = Source {
         data_dir: dir.join("books-data"),
         books_toml: Some(dir.join("wanderbooks.toml")),
         today: Some(today),
-    }
+    };
+    (TestDir(dir), source)
 }
 
 /// INVARIANTS 1-3 on every kind of page in the demo books.
 #[test]
 fn crumbs_link_every_level_but_the_last() {
-    let b = data::load_once(&demo("unit")).unwrap();
+    let (_dir, source) = demo("unit");
+    let b = data::load_once(&source).unwrap();
     let party = b.ledger.parties().next().unwrap().id;
     let rec = b.reconciliations.first().expect("the demo reconciles");
     let entry = b.entries.first().unwrap().id;
@@ -90,7 +102,7 @@ fn crumbs_link_every_level_but_the_last() {
 /// INVARIANT 4, through the top bar.
 #[test]
 fn clicking_a_crumb_goes_there() {
-    let source = demo("click");
+    let (_dir, source) = demo("click");
     let b = data::load_once(&source).unwrap();
     let rec = b.reconciliations.first().unwrap().clone();
     let account = describe(&b, &Route::Account(rec.account_id));
diff --git a/crates/ledger-gui/tests/copy.rs b/crates/ledger-gui/tests/copy.rs
index 24f3652..8dc38af 100644
--- a/crates/ledger-gui/tests/copy.rs
+++ b/crates/ledger-gui/tests/copy.rs
@@ -21,6 +21,15 @@ use ledger_gui::{App, Source, data, fmt};
 use proptest::prelude::*;
 use rust_decimal::Decimal;
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 proptest! {
     /// INVARIANT 1: every display style copies back to the same value.
     #[test]
@@ -54,6 +63,7 @@ fn copied(h: &Harness<'_, App>) -> Vec<String> {
 fn clicking_a_value_copies_it() {
     let dir = std::env::temp_dir().join(format!("ledger-gui-copy-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
+    let _cleanup = TestDir(dir.clone());
     let today = chrono::NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
     ledger_gui::demo::build(&dir, today).unwrap();
     let source = Source {
@@ -106,5 +116,4 @@ fn clicking_a_value_copies_it() {
     h.get_by_label(&format!("Entry #{id}")).click();
     h.step();
     assert_eq!(copied(&h), [format!("#{id}")]);
-    let _ = std::fs::remove_dir_all(&dir);
 }
diff --git a/crates/ledger-gui/tests/live.rs b/crates/ledger-gui/tests/live.rs
index d1b7f37..04f57d4 100644
--- a/crates/ledger-gui/tests/live.rs
+++ b/crates/ledger-gui/tests/live.rs
@@ -9,10 +9,20 @@ use ledger_store::Store;
 use rust_decimal::Decimal;
 use std::time::{Duration, Instant};
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 #[test]
 fn a_change_in_another_process_shows_up_live() {
     let dir = std::env::temp_dir().join(format!("ledger-gui-live-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
+    let _cleanup = TestDir(dir.clone());
     let data = dir.join("books-data");
     let mut store = Store::create(&data, Currency::USD).unwrap();
     let cash = store
@@ -86,5 +96,4 @@ fn a_change_in_another_process_shows_up_live() {
     assert!(shown, "the show request never reached the viewer");
     eprintln!("show request arrived in {:?}", asked.elapsed());
     let _ = std::fs::remove_file(ledger_store::viewer::command_path(&data));
-    let _ = std::fs::remove_dir_all(&dir);
 }
diff --git a/crates/ledger-gui/tests/newer_journal.rs b/crates/ledger-gui/tests/newer_journal.rs
index b74980b..14e32d7 100644
--- a/crates/ledger-gui/tests/newer_journal.rs
+++ b/crates/ledger-gui/tests/newer_journal.rs
@@ -16,7 +16,27 @@ use serde_json::json;
 use std::path::{Path, PathBuf};
 use std::time::{Duration, Instant};
 
-fn books(tag: &str) -> PathBuf {
+/// A test's data dir; its books dir is removed when the test ends, pass or
+/// panic.
+struct DataDir {
+    dir: PathBuf,
+    data: PathBuf,
+}
+
+impl std::ops::Deref for DataDir {
+    type Target = Path;
+    fn deref(&self) -> &Path {
+        &self.data
+    }
+}
+
+impl Drop for DataDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+fn books(tag: &str) -> DataDir {
     let dir = std::env::temp_dir().join(format!("ledger-gui-gate-{tag}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     let data = dir.join("books-data");
@@ -24,7 +44,7 @@ fn books(tag: &str) -> PathBuf {
     store
         .add_account("1000", "Checking", AccountType::Asset, None, false)
         .unwrap();
-    data
+    DataDir { dir, data }
 }
 
 fn source(data: &Path) -> Source {
diff --git a/crates/ledger-gui/tests/read_only.rs b/crates/ledger-gui/tests/read_only.rs
index 79d5d13..6a25e99 100644
--- a/crates/ledger-gui/tests/read_only.rs
+++ b/crates/ledger-gui/tests/read_only.rs
@@ -67,13 +67,15 @@ fn set_read_only(root: &Path, read_only: bool) {
     walk(root, read_only);
 }
 
-/// Makes the books writable again when dropped, so a failing or
-/// interrupted run never leaves a folder no one can delete.
+/// Makes the books writable again and removes them when dropped, so a
+/// run that passes or fails never leaves a folder behind, let alone one no
+/// one can delete.
 struct Writable(PathBuf);
 impl Drop for Writable {
     fn drop(&mut self) {
         if self.0.exists() {
             set_read_only(&self.0, false);
+            let _ = std::fs::remove_dir_all(&self.0);
         }
     }
 }
@@ -105,6 +107,7 @@ fn the_viewer_never_writes_into_the_books() {
         set_read_only(&dir, false);
         std::fs::remove_dir_all(&dir).unwrap();
     }
+    let _restore = Writable(dir.clone());
     let today = chrono::NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
     ledger_gui::demo::build(&dir, today).unwrap();
     let source = Source {
@@ -112,7 +115,6 @@ fn the_viewer_never_writes_into_the_books() {
         books_toml: Some(dir.join("wanderbooks.toml")),
         today: Some(today),
     };
-    let _restore = Writable(dir.clone());
     set_read_only(&dir, true);
     let before = tree(&dir);
 
@@ -219,5 +221,4 @@ fn the_viewer_never_writes_into_the_books() {
         "the viewer created or removed files in writable books"
     );
     assert!(before == after, "the viewer changed writable books");
-    let _ = std::fs::remove_dir_all(&dir);
 }
diff --git a/crates/ledger-gui/tests/screens.rs b/crates/ledger-gui/tests/screens.rs
index 26fdea8..2227ced 100644
--- a/crates/ledger-gui/tests/screens.rs
+++ b/crates/ledger-gui/tests/screens.rs
@@ -7,6 +7,15 @@ use ledger_gui::nav::{ReportKind, Route};
 use ledger_gui::{App, Source, data};
 use std::path::PathBuf;
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 #[test]
 fn screenshots() {
     let Ok(out) = std::env::var("SHOT_DIR") else {
@@ -15,6 +24,8 @@ fn screenshots() {
     let fixed_today: Option<chrono::NaiveDate> = std::env::var("SHOT_TODAY")
         .ok()
         .and_then(|d| d.parse().ok());
+    // Demo books (no SHOT_BOOKS) go when the run ends, pass or panic.
+    let mut _demo = None;
     let books = match std::env::var("SHOT_BOOKS") {
         Ok(b) => PathBuf::from(b),
         Err(_) => {
@@ -23,6 +34,7 @@ fn screenshots() {
             let dir =
                 std::env::temp_dir().join(format!("ledger-gui-shots-demo-{}", std::process::id()));
             let _ = std::fs::remove_dir_all(&dir);
+            _demo = Some(TestDir(dir.clone()));
             ledger_gui::demo::build(&dir, d).unwrap();
             dir
         }
diff --git a/crates/ledger-gui/tests/show.rs b/crates/ledger-gui/tests/show.rs
index e674682..e530d6f 100644
--- a/crates/ledger-gui/tests/show.rs
+++ b/crates/ledger-gui/tests/show.rs
@@ -5,11 +5,21 @@ use ledger_gui::nav::{ReportKind, Route};
 use ledger_gui::{App, Source, data};
 use ledger_store::viewer::ViewerTarget;
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 #[test]
 fn show_requests_navigate_the_viewer() {
     let today = chrono::NaiveDate::from_ymd_opt(2026, 10, 12).unwrap();
     let dir = std::env::temp_dir().join(format!("ledger-gui-show-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
+    let _cleanup = TestDir(dir.clone());
     ledger_gui::demo::build(&dir, today).unwrap();
     let source = Source {
         data_dir: dir.join("books-data"),
@@ -108,5 +118,4 @@ fn show_requests_navigate_the_viewer() {
         end: None,
     });
     assert_eq!(h.state_mut().route(), &Route::Transactions);
-    let _ = std::fs::remove_dir_all(&dir);
 }
diff --git a/crates/ledger-gui/tests/vault_key_flag.rs b/crates/ledger-gui/tests/vault_key_flag.rs
index 49b1d44..93a5c48 100644
--- a/crates/ledger-gui/tests/vault_key_flag.rs
+++ b/crates/ledger-gui/tests/vault_key_flag.rs
@@ -10,10 +10,20 @@ use ledger_vault::{Tin, Vault};
 
 const SSN: &str = "123-45-6789";
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 #[test]
 fn the_key_named_on_the_command_line_wins() {
     let root = std::env::temp_dir().join(format!("ledger-gui-key-flag-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&root);
+    let _cleanup = TestDir(root.clone());
     let books = root.join("books");
     let key = root.join("keys/vault.key");
     std::fs::create_dir_all(&books).unwrap();
@@ -52,7 +62,6 @@ fn the_key_named_on_the_command_line_wins() {
     // The settings name a key that isn't there; the command line wins.
     b.settings.vault_key_file = Some(root.join("missing/vault.key"));
     assert_eq!(b.tin_from_vault(party).unwrap(), SSN);
-    let _ = std::fs::remove_dir_all(&root);
 }
 
 #[test]
diff --git a/crates/ledger-gui/tests/view_model.rs b/crates/ledger-gui/tests/view_model.rs
index cf45e3a..91f6d6e 100644
--- a/crates/ledger-gui/tests/view_model.rs
+++ b/crates/ledger-gui/tests/view_model.rs
@@ -51,14 +51,31 @@ fn plan() -> impl Strategy<Value = Plan> {
         })
 }
 
-fn dir(tag: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn dir(tag: &str) -> TestDir {
     let d = std::env::temp_dir().join(format!("ledger-gui-vm-{}-{tag}", std::process::id()));
     let _ = std::fs::remove_dir_all(&d);
     std::fs::create_dir_all(&d).unwrap();
-    d
+    TestDir(d)
 }
 
-fn build(plan: &Plan, tag: &str) -> (Source, ledger_core::Ledger) {
+/// The books, where they are (kept while the guard lives), and their ledger.
+fn build(plan: &Plan, tag: &str) -> (TestDir, Source, ledger_core::Ledger) {
     let d = dir(tag);
     let mut s = Store::create(&d.join("books-data"), Currency::USD).unwrap();
     let ids: Vec<_> = CHART
@@ -81,14 +98,12 @@ fn build(plan: &Plan, tag: &str) -> (Source, ledger_core::Ledger) {
     )
     .unwrap();
     let ledger = s.ledger().clone();
-    (
-        Source {
-            data_dir: d.join("books-data"),
-            books_toml: Some(d.join("wanderbooks.toml")),
-            today: Some(plan.today),
-        },
-        ledger,
-    )
+    let source = Source {
+        data_dir: d.join("books-data"),
+        books_toml: Some(d.join("wanderbooks.toml")),
+        today: Some(plan.today),
+    };
+    (d, source, ledger)
 }
 
 /// An account's normal-side balance at the end of `date`, from the trial
@@ -122,7 +137,7 @@ proptest! {
     /// Kpis INVARIANTS 1-7 and the period helpers, against ledger-core.
     #[test]
     fn the_overview_numbers_are_the_books_numbers(p in plan()) {
-        let (source, l) = build(&p, "kpi");
+        let (_dir, source, l) = build(&p, "kpi");
         let b = data::load_once(&source).unwrap();
         let k = &b.kpis;
         let t = p.today;
@@ -283,7 +298,6 @@ fn origins_and_parties() {
     assert_eq!(std::fs::read(path).unwrap(), b"%PDF receipt");
     assert_eq!(b.integrity.files_ok, 1);
     assert!(b.integrity.file_failures.is_empty());
-    let _ = std::fs::remove_dir_all(&d);
 }
 
 /// fmt helpers the viewer shows: percent change and tax forms.
@@ -306,7 +320,7 @@ fn percent_change_and_tax_forms() {
     assert_eq!(fmt::compact(d("-1234")), "\u{2212}$1.2k");
 }
 
-fn store_at(tag: &str) -> (PathBuf, Store) {
+fn store_at(tag: &str) -> (TestDir, Store) {
     let d = dir(tag);
     let s = Store::create(&d.join("books-data"), Currency::USD).unwrap();
     (d, s)
@@ -476,9 +490,6 @@ fn comparisons_and_burn_on_fixed_dates() {
     drop(s5);
     let b5 = data::load_once(&source(&d5, "", today)).unwrap();
     assert_eq!(b5.kpis.monthly_burn, None);
-    for x in [d, d2, d3, d4, d5] {
-        let _ = std::fs::remove_dir_all(x);
-    }
 }
 
 /// The view model's indexes: cash accounts by name when the settings name
@@ -548,7 +559,6 @@ fn indexes_cash_cards_accounts_and_fresh() {
     let integrity = ledger_gui::books::Integrity::check(&snap, &mut verified);
     let b2 = ledger_gui::books::Books::build(&snap, settings, today, Some(seq), integrity).unwrap();
     assert_eq!(b2.fresh, [e2].into_iter().collect());
-    let _ = std::fs::remove_dir_all(&d);
 }
 
 /// Integrity counts every stored file, read once: a second check with the
@@ -580,7 +590,6 @@ fn integrity_counts_files_once_verified() {
     assert_eq!((first.files_ok, first.file_failures.len()), (2, 0));
     let again = ledger_gui::books::Integrity::check(&snap, &mut verified);
     assert_eq!((again.files_ok, again.file_failures.len()), (2, 0));
-    let _ = std::fs::remove_dir_all(&d);
 }
 
 /// Origins and parties for the rest of the journal's kinds: the invoice
@@ -647,5 +656,4 @@ fn more_origins_and_parties() {
     let r = b.entry(remit).unwrap();
     assert_eq!(r.origin, "Payroll taxes");
     assert!(!r.missing_receipt, "a remittance isn't a hand-made entry");
-    let _ = std::fs::remove_dir_all(&d);
 }
diff --git a/crates/ledger-mcp/src/local_files.rs b/crates/ledger-mcp/src/local_files.rs
index 59b539b..e937da6 100644
--- a/crates/ledger-mcp/src/local_files.rs
+++ b/crates/ledger-mcp/src/local_files.rs
@@ -660,6 +660,21 @@ mod tests {
         allowed: HashMap<PathBuf, bool>,
     }
 
+    impl Drop for Tree {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.base);
+        }
+    }
+
+    /// A test's dir, removed when the test ends, pass or panic.
+    struct TestDir(PathBuf);
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
     fn tree(tag: &str) -> Tree {
         let base = std::env::temp_dir().join(format!(
             "ledger-mcp-local-files-{}-{tag}",
@@ -813,25 +828,43 @@ mod tests {
         let _ = std::fs::remove_dir_all(b);
     }
 
-    proptest! {
-        #![proptest_config(ProptestConfig::with_cases(512))]
-        /// Any absolute path built from the tree's names, `.` and `..`, and
-        /// its symlinks is allowed exactly when it has no `.` or `..` name
-        /// and resolves to a file the oracle allows: a regular file inside
-        /// a root and outside every protected dir.
-        #[test]
-        fn import_allowed_iff_regular_file_inside_a_root_outside_the_books(
+    /// Any absolute path built from the tree's names, `.` and `..`, and
+    /// its symlinks is allowed exactly when it has no `.` or `..` name and
+    /// resolves to a file the oracle allows: a regular file inside a root
+    /// and outside every protected dir. (One tree for every case, removed
+    /// when the test ends.)
+    #[test]
+    fn import_allowed_iff_regular_file_inside_a_root_outside_the_books() {
+        let t = tree("prop");
+        let starts = [
+            "Downloads",
+            "tmp",
+            "tmp/books",
+            "tmp/books/books-data",
+            "tmp/keys",
+            "elsewhere",
+            "secret",
+        ];
+        let names = [
+            "..",
+            ".",
+            "sub",
+            "dir",
+            "receipt.pdf",
+            "scan.png",
+            "shot.png",
+            "journal.jsonl",
+            "vault.key",
+            "key-link",
+            "good-link",
+            "data-link",
+            "hard.key",
+            "fifo",
+        ];
+        proptest!(ProptestConfig::with_cases(512), |(
             start in 0usize..7,
             parts in proptest::collection::vec(0usize..14, 0..5),
-        ) {
-            use std::sync::OnceLock;
-            static TREE: OnceLock<Tree> = OnceLock::new();
-            let t = TREE.get_or_init(|| tree("prop"));
-            let starts = ["Downloads", "tmp", "tmp/books", "tmp/books/books-data", "tmp/keys", "elsewhere", "secret"];
-            let names = [
-                "..", ".", "sub", "dir", "receipt.pdf", "scan.png", "shot.png", "journal.jsonl",
-                "vault.key", "key-link", "good-link", "data-link", "hard.key", "fifo",
-            ];
+        )| {
             let mut p = t.base.join(starts[start]);
             for i in parts {
                 p.push(names[i]);
@@ -843,7 +876,7 @@ mod tests {
                 _ => false,
             };
             prop_assert_eq!(t.check(&p).is_ok(), want, "{}", p.display());
-        }
+        });
     }
 
     /// INVARIANT 2: a path that is missing, a dangling link, or outside
@@ -1030,9 +1063,8 @@ mod tests {
             .is_ok_and(|s| s.success());
         if made {
             let (tx, rx) = std::sync::mpsc::channel();
-            std::thread::spawn(move || {
-                tx.send(read_checked(&canonical, &meta, &t.protected.inodes(), 100))
-            });
+            let inodes = t.protected.inodes();
+            std::thread::spawn(move || tx.send(read_checked(&canonical, &meta, &inodes, 100)));
             let got = rx
                 .recv_timeout(std::time::Duration::from_secs(10))
                 .expect("opening a pipe blocked");
@@ -1219,6 +1251,7 @@ mod tests {
             std::process::id()
         ));
         let _ = std::fs::remove_dir_all(&base);
+        let _cleanup = TestDir(base.clone());
         let home = base.join("home");
         std::fs::create_dir_all(home.join(".ssh")).unwrap();
         std::fs::write(home.join(".ssh/id_ed25519"), b"PRIVATE KEY").unwrap();
diff --git a/crates/ledger-mcp/src/server.rs b/crates/ledger-mcp/src/server.rs
index 151bd7f..5afad1a 100644
--- a/crates/ledger-mcp/src/server.rs
+++ b/crates/ledger-mcp/src/server.rs
@@ -9472,11 +9472,25 @@ mod tests {
         Money::new(Decimal::from_str(s).unwrap(), Currency::USD)
     }
 
-    fn store(tag: &str) -> Store {
+    /// A test's books dir, removed when the test ends, pass or panic.
+    struct TestDir(std::path::PathBuf);
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn unit_dir(tag: &str) -> TestDir {
         let dir =
             std::env::temp_dir().join(format!("ledger-mcp-unit-{}-{tag}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
-        Store::create(&dir, Currency::USD).unwrap()
+        TestDir(dir)
+    }
+
+    /// New books in `dir`, which outlives them.
+    fn store(dir: &TestDir) -> Store {
+        Store::create(&dir.0, Currency::USD).unwrap()
     }
 
     /// lines_settled: posted, or a draft with lines whose debits equal its
@@ -9635,7 +9649,8 @@ mod tests {
     /// close_into, and each member's capital and distributions accounts.
     #[test]
     fn config_mentions_finds_every_setting_naming_a_code() {
-        let server = BooksServer::new(store("mentions"), ReceiptPolicy::default())
+        let books = unit_dir("mentions");
+        let server = BooksServer::new(store(&books), ReceiptPolicy::default())
             .with_company(members())
             .with_cash_roles(CashRoles {
                 cash: vec!["1000".into()],
@@ -9664,20 +9679,21 @@ mod tests {
             ["[[company.members]] Ada distribution_account"]
         );
         assert!(server.config_mentions("6000").is_empty());
-        let solo = BooksServer::new(store("mentions-solo"), ReceiptPolicy::default()).with_company(
-            Company {
+        let books = unit_dir("mentions-solo");
+        let solo =
+            BooksServer::new(store(&books), ReceiptPolicy::default()).with_company(Company {
                 close_into: Some("3000".into()),
                 ..Company::default()
-            },
-        );
+            });
         assert_eq!(solo.config_mentions("3000"), ["[books] close_into"]);
     }
 
     /// Reports name each member with their accounts, in order.
     #[test]
     fn report_members_carry_names_and_accounts() {
+        let books = unit_dir("members");
         let server =
-            BooksServer::new(store("members"), ReceiptPolicy::default()).with_company(members());
+            BooksServer::new(store(&books), ReceiptPolicy::default()).with_company(members());
         let m = server.report_members();
         assert_eq!(m.len(), 2);
         assert_eq!(
@@ -9697,7 +9713,8 @@ mod tests {
     /// included, so a closed month drops out).
     #[test]
     fn year_earnings_split_closed_from_unclosed() {
-        let mut s = store("earnings");
+        let books = unit_dir("earnings");
+        let mut s = store(&books);
         let cash = s
             .add_account("1000", "Cash", AccountType::Asset, None, false)
             .unwrap();
@@ -9747,7 +9764,8 @@ mod tests {
     /// December's income is never this year's).
     #[test]
     fn year_earnings_count_only_closes_and_never_before_the_year() {
-        let mut s = store("earnings-open");
+        let books = unit_dir("earnings-open");
+        let mut s = store(&books);
         let cash = s
             .add_account("1000", "Cash", AccountType::Asset, None, false)
             .unwrap();
@@ -9783,7 +9801,8 @@ mod tests {
     /// entry the policy covers (crate::policy).
     #[test]
     fn receipts_are_kept_only_where_the_policy_needs_them() {
-        let mut s = store("unlink");
+        let books = unit_dir("unlink");
+        let mut s = store(&books);
         let cash = s
             .add_account("1000", "Cash", AccountType::Asset, None, false)
             .unwrap();
@@ -10437,7 +10456,8 @@ mod tests {
             }),
         ];
         for (how, body) in bodies {
-            let server = BooksServer::new(store("stops"), ReceiptPolicy::default());
+            let books = unit_dir("stops");
+            let server = BooksServer::new(store(&books), ReceiptPolicy::default());
             rt.block_on(async {
                 let seq: Body = |s| s.lock().map(|st| st.journal_seq());
                 assert_eq!(run(&server, seq).await.unwrap(), Ok(1), "{how}");
@@ -10459,7 +10479,8 @@ mod tests {
         }
 
         // A guard dropped by a panic on a thread of its own stops it too.
-        let server = BooksServer::new(store("stops-thread"), ReceiptPolicy::default());
+        let books = unit_dir("stops-thread");
+        let server = BooksServer::new(store(&books), ReceiptPolicy::default());
         let s = server.clone();
         let died = std::thread::spawn(move || {
             let _store = s.lock().unwrap();
@@ -10500,7 +10521,8 @@ mod tests {
             .enable_all()
             .build()
             .unwrap();
-        let shared = SharedStore::new(store("wakes"));
+        let books = unit_dir("wakes");
+        let shared = SharedStore::new(store(&books));
         let got = rt.block_on(async {
             tokio::time::timeout(
                 std::time::Duration::from_secs(10),
@@ -10525,6 +10547,7 @@ mod tests {
         ));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
+        let _cleanup = TestDir(dir.clone());
         let toml = dir.join("wanderbooks.toml");
         let threshold = |t: &str| {
             std::fs::write(
@@ -10540,7 +10563,8 @@ mod tests {
             config_json: dir.join("config.json"),
         })
         .unwrap();
-        let server = BooksServer::new(store("info"), ReceiptPolicy::default())
+        let books = unit_dir("info");
+        let server = BooksServer::new(store(&books), ReceiptPolicy::default())
             .with_live_settings(Arc::new(Mutex::new(live)));
         let told = |s: &BooksServer| rmcp::ServerHandler::get_info(s).instructions.unwrap();
         let before = told(&server);
diff --git a/crates/ledger-mcp/src/settings.rs b/crates/ledger-mcp/src/settings.rs
index c3f95d1..1782ae5 100644
--- a/crates/ledger-mcp/src/settings.rs
+++ b/crates/ledger-mcp/src/settings.rs
@@ -368,12 +368,28 @@ impl Live {
 mod tests {
     use super::*;
 
-    fn dir(tag: &str) -> PathBuf {
+    /// A test's dir, removed when the test ends, pass or panic.
+    struct TestDir(std::path::PathBuf);
+
+    impl std::ops::Deref for TestDir {
+        type Target = std::path::Path;
+        fn deref(&self) -> &std::path::Path {
+            &self.0
+        }
+    }
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn dir(tag: &str) -> TestDir {
         let d =
             std::env::temp_dir().join(format!("ledger-mcp-settings-{}-{tag}", std::process::id()));
         let _ = std::fs::remove_dir_all(&d);
         std::fs::create_dir_all(&d).unwrap();
-        d
+        TestDir(d)
     }
 
     fn source(d: &std::path::Path, required: bool) -> Source {
@@ -497,7 +513,6 @@ mod tests {
         assert_eq!(live.current().company.name, "Kept Co 2");
         assert_eq!(live.status().loads, 2);
         assert!(live.current().journaled && live.is_journaled());
-        std::fs::remove_dir_all(&d).unwrap();
     }
 
     /// Settings built in code are the books' own once synced.
diff --git a/crates/ledger-mcp/src/tin_files.rs b/crates/ledger-mcp/src/tin_files.rs
index c59ee2c..0b06bb2 100644
--- a/crates/ledger-mcp/src/tin_files.rs
+++ b/crates/ledger-mcp/src/tin_files.rs
@@ -357,11 +357,27 @@ fn nul_interleaved(bytes: &[u8]) -> bool {
 mod tests {
     use super::*;
 
-    fn dir(tag: &str) -> std::path::PathBuf {
+    /// A test's dir, removed when the test ends, pass or panic.
+    struct TestDir(std::path::PathBuf);
+
+    impl std::ops::Deref for TestDir {
+        type Target = std::path::Path;
+        fn deref(&self) -> &std::path::Path {
+            &self.0
+        }
+    }
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn dir(tag: &str) -> TestDir {
         let d =
             std::env::temp_dir().join(format!("ledger-mcp-tin-files-{}-{tag}", std::process::id()));
         let _ = std::fs::remove_dir_all(&d);
-        d
+        TestDir(d)
     }
 
     /// INVARIANTS 1-2: a recorded file is refused from then on, by this
@@ -382,7 +398,6 @@ mod tests {
         assert_eq!(text.lines().count(), 1);
         // Only the hash is kept.
         assert!(!text.contains("PNG"));
-        let _ = std::fs::remove_dir_all(&vault);
     }
 
     /// The registry's folder for a check (it never exists) and no vault.
@@ -614,7 +629,6 @@ Date,Description,Amount,Running Bal.,Reference
         .expect_err("a registry that can't be read let a file in");
         assert!(why.contains("couldn't check the file"), "{why}");
         assert!(record(&vault, b"bytes").is_err());
-        let _ = std::fs::remove_dir_all(&vault);
     }
 
     /// INVARIANT 4: text holding more than two TIN-shaped numbers ending
diff --git a/crates/ledger-mcp/tests/hostile_args.rs b/crates/ledger-mcp/tests/hostile_args.rs
index 3c168aa..9a44272 100644
--- a/crates/ledger-mcp/tests/hostile_args.rs
+++ b/crates/ledger-mcp/tests/hostile_args.rs
@@ -76,6 +76,13 @@ struct Places {
     sandbox: PathBuf,
 }
 
+/// The places go when the test ends, pass or panic.
+impl Drop for Places {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.base);
+    }
+}
+
 fn places(tag: &str) -> Places {
     let base =
         std::env::temp_dir().join(format!("ledger-mcp-hostile-{}-{tag}", std::process::id()));
diff --git a/crates/ledger-mcp/tests/http_concurrency.rs b/crates/ledger-mcp/tests/http_concurrency.rs
index 0e9d29c..a6499a3 100644
--- a/crates/ledger-mcp/tests/http_concurrency.rs
+++ b/crates/ledger-mcp/tests/http_concurrency.rs
@@ -28,6 +28,15 @@ impl Drop for Server {
     }
 }
 
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
 fn free_port() -> u16 {
     std::net::TcpListener::bind("127.0.0.1:0")
         .unwrap()
@@ -123,6 +132,8 @@ async fn agents_posting_at_once_leave_whole_books() {
     let dir = std::env::temp_dir().join(format!("ledger-mcp-http-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
+    // Declared before the server, so dropped after it: pass or panic.
+    let _cleanup = TestDir(dir.clone());
     let toml = dir.join("wanderbooks.toml");
     std::fs::write(&toml, "[books]\nreceipt_threshold = \"0.00\"\n").unwrap();
     let data = dir.join("books-data");
diff --git a/crates/ledger-mcp/tests/mcp_stdio.rs b/crates/ledger-mcp/tests/mcp_stdio.rs
index 1453d25..79e8932 100644
--- a/crates/ledger-mcp/tests/mcp_stdio.rs
+++ b/crates/ledger-mcp/tests/mcp_stdio.rs
@@ -126,11 +126,39 @@ impl Mcp {
     }
 }
 
-fn test_dir(name: &str) -> std::path::PathBuf {
+/// A test's dir and what sits beside it (`.inbox`, `.elsewhere.txt`),
+/// removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+        for beside in [".inbox", ".elsewhere.txt"] {
+            let p = std::path::PathBuf::from(format!("{}{beside}", self.0.display()));
+            let _ = std::fs::remove_dir_all(&p);
+            let _ = std::fs::remove_file(&p);
+        }
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("ledger-mcp-test-{}-{name}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 #[test]
diff --git a/crates/ledger-mcp/tests/oracle_mcp.rs b/crates/ledger-mcp/tests/oracle_mcp.rs
index 43085d2..7b0040e 100644
--- a/crates/ledger-mcp/tests/oracle_mcp.rs
+++ b/crates/ledger-mcp/tests/oracle_mcp.rs
@@ -56,7 +56,31 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir and the folder beside it (`.inbox`),
+/// removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+        let _ = std::fs::remove_dir_all(format!("{}.inbox", self.0.display()));
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!(
         "ledger-mcp-oracle-{}-{name}-{n}",
@@ -64,7 +88,7 @@ fn test_dir(name: &str) -> PathBuf {
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// `wanderbooks.toml` for two 50/50 members on 3000/3001, cash 1000,
@@ -2249,19 +2273,10 @@ fn receipts_and_documents_round_trip() {
 #[test]
 fn uploads_up_to_25_mib_are_accepted_and_no_more() {
     const LIMIT: usize = 25 * 1024 * 1024;
+    // Over 50 MB of books: removed however the test ends, with its inbox
+    // (the system temp dir is often RAM, and a mutation run starts this
+    // test hundreds of times).
     let dir = test_dir("limits");
-    // Over 50 MB of books: removed however the test ends (the system temp
-    // dir is often RAM, and a mutation run starts this test hundreds of
-    // times).
-    struct Cleanup(Vec<PathBuf>);
-    impl Drop for Cleanup {
-        fn drop(&mut self) {
-            for d in &self.0 {
-                let _ = std::fs::remove_dir_all(d);
-            }
-        }
-    }
-    let _cleanup = Cleanup(vec![dir.clone(), inbox(&dir)]);
     let s = new_store(&dir);
     drop(s);
     let mut m = Mcp::start(&dir, "1000000.00");
diff --git a/crates/ledger-mcp/tests/spec_assets.rs b/crates/ledger-mcp/tests/spec_assets.rs
index 9e50e37..cf37efd 100644
--- a/crates/ledger-mcp/tests/spec_assets.rs
+++ b/crates/ledger-mcp/tests/spec_assets.rs
@@ -49,6 +49,9 @@ struct Mcp {
     next_id: u64,
     data: PathBuf,
     validators: HashMap<String, jsonschema::Validator>,
+    /// The books dir when the server owns it: removed after the server
+    /// stops (fields drop after `Drop::drop`).
+    books_dir: Option<TestDir>,
 }
 
 impl Drop for Mcp {
@@ -60,7 +63,29 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!(
         "ledger-mcp-spec-assets-{}-{name}-{n}",
@@ -68,7 +93,7 @@ fn test_dir(name: &str) -> PathBuf {
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// `wanderbooks.toml` with a company name and extra `[books]` TOML. The
@@ -113,6 +138,7 @@ impl Mcp {
             }
         });
         let mut mcp = Self {
+            books_dir: None,
             stdin,
             rx,
             child,
@@ -356,6 +382,7 @@ fn books(name: &str) -> Mcp {
     let toml = books_toml(&dir, "Spec Co", "asset_tag_prefix = \"WL\"\n");
     let mut m = Mcp::start(&dir, &toml);
     m.accounts(CHART);
+    m.books_dir = Some(dir);
     m
 }
 
diff --git a/crates/ledger-mcp/tests/spec_attachments.rs b/crates/ledger-mcp/tests/spec_attachments.rs
index 53a738f..b3c7ce0 100644
--- a/crates/ledger-mcp/tests/spec_attachments.rs
+++ b/crates/ledger-mcp/tests/spec_attachments.rs
@@ -52,6 +52,9 @@ struct Mcp {
     validators: HashMap<String, jsonschema::Validator>,
     /// Every response line the server wrote, with the tool it answered.
     transcript: Vec<(String, String)>,
+    /// The books dir when the server owns it: removed after the server
+    /// stops (fields drop after `Drop::drop`).
+    books_dir: Option<TestDir>,
 }
 
 impl Drop for Mcp {
@@ -63,7 +66,31 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir and the folder beside it (`-outside`),
+/// removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+        let _ = std::fs::remove_dir_all(format!("{}-outside", self.0.display()));
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!(
         "ledger-mcp-spec-attachments-{}-{name}-{n}",
@@ -71,7 +98,7 @@ fn test_dir(name: &str) -> PathBuf {
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// A directory beside the books dir `dir`, outside it: the vault key,
@@ -131,6 +158,7 @@ impl Mcp {
             }
         });
         let mut mcp = Self {
+            books_dir: None,
             stdin,
             rx,
             child,
@@ -363,6 +391,7 @@ fn books_at(name: &str, threshold: &str, extra: &str) -> Mcp {
     let toml = books_toml(&dir, threshold, extra);
     let mut m = Mcp::start(&dir, &toml);
     m.accounts(CHART);
+    m.books_dir = Some(dir);
     m
 }
 
diff --git a/crates/ledger-mcp/tests/spec_kept.rs b/crates/ledger-mcp/tests/spec_kept.rs
index 11da2c7..44857c0 100644
--- a/crates/ledger-mcp/tests/spec_kept.rs
+++ b/crates/ledger-mcp/tests/spec_kept.rs
@@ -112,11 +112,33 @@ impl Mcp {
     }
 }
 
-fn test_dir(name: &str) -> std::path::PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("ledger-mcp-test-{}-{name}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn init(m: &mut Mcp) -> String {
diff --git a/crates/ledger-mcp/tests/spec_mcp.rs b/crates/ledger-mcp/tests/spec_mcp.rs
index 67a506e..5418a1a 100644
--- a/crates/ledger-mcp/tests/spec_mcp.rs
+++ b/crates/ledger-mcp/tests/spec_mcp.rs
@@ -159,6 +159,9 @@ struct Mcp {
     read_only_checked: BTreeSet<String>,
     /// Invariant 3 (amounts out) violations: `tool: path = value`.
     money_violations: Vec<String>,
+    /// The books dir when the server owns it: removed after the server
+    /// stops (fields drop after `Drop::drop`).
+    books_dir: Option<TestDir>,
 }
 
 impl Drop for Mcp {
@@ -170,14 +173,42 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
+/// A test's dir and the folders beside it (`.inbox`, `-outside`),
+/// removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+        for beside in [".inbox", "-outside"] {
+            let p = PathBuf::from(format!("{}{beside}", self.0.display()));
+            let _ = std::fs::remove_dir_all(&p);
+            let _ = std::fs::remove_file(&p);
+        }
+    }
+}
+
 /// A fresh, empty per-test directory under the system temp dir.
-fn test_dir(name: &str) -> PathBuf {
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir =
         std::env::temp_dir().join(format!("ledger-mcp-spec-{}-{name}-{n}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// A directory beside the books dir `dir`, outside it (vault keys, files
@@ -262,6 +293,7 @@ impl Mcp {
             }
         });
         let mut mcp = Self {
+            books_dir: None,
             stdin,
             rx,
             child,
@@ -1247,6 +1279,7 @@ fn happy_path(name: &str) -> Mcp {
                "save_to": outside(&dir).join("cpa.zip").to_str().unwrap()}),
     );
 
+    m.books_dir = Some(dir);
     m
 }
 
@@ -1692,7 +1725,7 @@ const REFUSED_AMOUNTS: &[&str] = &[
 /// the core is expected to accept on a line.
 const ACCEPTED_AMOUNTS: &[&str] = &["5", "5.00", "123.45", "5.5", "007.50", "1000000.00"];
 
-fn amounts_server(name: &str) -> (PathBuf, Mcp, u64) {
+fn amounts_server(name: &str) -> (TestDir, Mcp, u64) {
     let dir = test_dir(name);
     let toml = books_toml(&dir, "25.00", "");
     let mut m = Mcp::start(&dir, &toml);
diff --git a/crates/ledger-mcp/tests/spec_parties.rs b/crates/ledger-mcp/tests/spec_parties.rs
index 19ba8b8..2e5629b 100644
--- a/crates/ledger-mcp/tests/spec_parties.rs
+++ b/crates/ledger-mcp/tests/spec_parties.rs
@@ -50,6 +50,9 @@ struct Mcp {
     next_id: u64,
     data: PathBuf,
     validators: HashMap<String, jsonschema::Validator>,
+    /// The books dir when the server owns it: removed after the server
+    /// stops (fields drop after `Drop::drop`).
+    books_dir: Option<TestDir>,
 }
 
 impl Drop for Mcp {
@@ -61,7 +64,29 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!(
         "ledger-mcp-spec-parties-{}-{name}-{n}",
@@ -69,7 +94,7 @@ fn test_dir(name: &str) -> PathBuf {
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// `wanderbooks.toml` with a company name and extra `[books]` TOML. The
@@ -114,6 +139,7 @@ impl Mcp {
             }
         });
         let mut mcp = Self {
+            books_dir: None,
             stdin,
             rx,
             child,
@@ -339,6 +365,7 @@ fn books(name: &str) -> Mcp {
     let toml = books_toml(&dir, "Spec Co", "");
     let mut m = Mcp::start(&dir, &toml);
     m.accounts(CHART);
+    m.books_dir = Some(dir);
     m
 }
 
@@ -1161,6 +1188,7 @@ fn books_with(name: &str, extra: &str) -> Mcp {
     let toml = books_toml(&dir, "Spec Co", extra);
     let mut m = Mcp::start(&dir, &toml);
     m.accounts(CHART);
+    m.books_dir = Some(dir);
     m
 }
 
@@ -1343,6 +1371,7 @@ fn member_books(name: &str, extra: &str) -> Mcp {
     m.accounts(&[("3001", "Capital K", "equity")]);
     m.add_party("Stephen Waits", &["member"]);
     m.add_party("Katherine Pendergast", &["member"]);
+    m.books_dir = Some(dir);
     m
 }
 
diff --git a/crates/ledger-mcp/tests/spec_vault.rs b/crates/ledger-mcp/tests/spec_vault.rs
index f60d7e2..d86d086 100644
--- a/crates/ledger-mcp/tests/spec_vault.rs
+++ b/crates/ledger-mcp/tests/spec_vault.rs
@@ -58,6 +58,9 @@ struct Mcp {
     validators: HashMap<String, jsonschema::Validator>,
     /// Every response line the server wrote, with the tool it answered.
     transcript: Vec<(String, String)>,
+    /// The books dir when the server owns it: removed after the server
+    /// stops (fields drop after `Drop::drop`).
+    books_dir: Option<TestDir>,
 }
 
 impl Drop for Mcp {
@@ -69,7 +72,35 @@ impl Drop for Mcp {
 
 static DIR_SEQ: AtomicU64 = AtomicU64::new(0);
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir and the folders beside it (`-inbox`, `-outside`),
+/// removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+        for beside in ["-inbox", "-outside"] {
+            let p = PathBuf::from(format!("{}{beside}", self.0.display()));
+            let _ = std::fs::remove_dir_all(&p);
+            let _ = std::fs::remove_file(&p);
+        }
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let n = DIR_SEQ.fetch_add(1, Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!(
         "ledger-mcp-spec-vault-{}-{name}-{n}",
@@ -77,7 +108,7 @@ fn test_dir(name: &str) -> PathBuf {
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// A directory beside the books dir `dir`, outside it: the vault key,
@@ -164,6 +195,7 @@ impl Mcp {
             }
         });
         let mut mcp = Self {
+            books_dir: None,
             stdin,
             rx,
             child,
@@ -402,6 +434,7 @@ fn books_with(name: &str, extra: &str) -> Mcp {
         json!({"vendor": "Acme Design", "form_1099": "nec"}),
     );
     m.add_party("Rent Co", &["landlord"]);
+    m.books_dir = Some(dir);
     m
 }
 
diff --git a/crates/ledger-mcp/tests/startup.rs b/crates/ledger-mcp/tests/startup.rs
index 24ca8bb..ca66b10 100644
--- a/crates/ledger-mcp/tests/startup.rs
+++ b/crates/ledger-mcp/tests/startup.rs
@@ -7,11 +7,39 @@ use std::time::{Duration, Instant};
 
 const BIN: &str = env!("CARGO_BIN_EXE_ledger-mcp");
 
-fn temp(tag: &str) -> std::path::PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::ffi::OsStr> for TestDir {
+    fn as_ref(&self) -> &std::ffi::OsStr {
+        self.0.as_os_str()
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn temp(tag: &str) -> TestDir {
     let d = std::env::temp_dir().join(format!("ledger-mcp-start-{}-{tag}", std::process::id()));
     let _ = std::fs::remove_dir_all(&d);
     std::fs::create_dir_all(&d).unwrap();
-    d
+    TestDir(d)
 }
 
 /// Start the server, initialize, call one tool, and return its text
@@ -236,7 +264,8 @@ fn refuses_to_start(cmd: &mut Command) -> Option<String> {
 /// used.
 #[test]
 fn an_import_root_holding_the_books_or_the_home_folder_is_refused() {
-    let dir = temp("bad-roots").canonicalize().unwrap();
+    let tmp = temp("bad-roots");
+    let dir = tmp.canonicalize().unwrap();
     let home = dir.join("home");
     let books = home.join("work/books");
     let data = books.join("books-data");
@@ -316,7 +345,8 @@ fn an_import_root_holding_the_books_or_the_home_folder_is_refused() {
 /// is the root, and the rest of the home folder stays out of reach.
 #[test]
 fn a_download_dir_of_home_never_opens_the_home_folder() {
-    let dir = temp("xdg-home").canonicalize().unwrap();
+    let tmp = temp("xdg-home");
+    let dir = tmp.canonicalize().unwrap();
     let home = dir.join("home");
     std::fs::create_dir_all(home.join(".ssh")).unwrap();
     std::fs::write(home.join(".ssh/id_ed25519"), "PRIVATE KEY").unwrap();
@@ -358,7 +388,8 @@ fn a_download_dir_of_home_never_opens_the_home_folder() {
 /// folder, and an import says so.
 #[test]
 fn a_default_download_dir_holding_the_books_is_dropped_not_fatal() {
-    let dir = temp("xdg-books").canonicalize().unwrap();
+    let tmp = temp("xdg-books");
+    let dir = tmp.canonicalize().unwrap();
     let home = dir.join("home");
     let downloads = dir.join("downloads");
     std::fs::create_dir_all(&home).unwrap();
diff --git a/crates/ledger-mcp/tests/tin_files.rs b/crates/ledger-mcp/tests/tin_files.rs
index 62ca7e1..b45a527 100644
--- a/crates/ledger-mcp/tests/tin_files.rs
+++ b/crates/ledger-mcp/tests/tin_files.rs
@@ -68,6 +68,16 @@ struct Books {
     toml: PathBuf,
 }
 
+/// The books dir and the folders beside it go when the test ends, pass or
+/// panic.
+impl Drop for Books {
+    fn drop(&mut self) {
+        if let Some(base) = self.dir.parent() {
+            let _ = std::fs::remove_dir_all(base);
+        }
+    }
+}
+
 fn books(tag: &str) -> Books {
     let base =
         std::env::temp_dir().join(format!("ledger-mcp-tin-files-{}-{tag}", std::process::id()));
diff --git a/crates/ledger-store/src/viewer.rs b/crates/ledger-store/src/viewer.rs
index 83dd70c..7a961fb 100644
--- a/crates/ledger-store/src/viewer.rs
+++ b/crates/ledger-store/src/viewer.rs
@@ -139,10 +139,20 @@ pub fn read(data_dir: &Path) -> Option<ViewerCommand> {
 mod tests {
     use super::*;
 
+    /// A test's dir, removed when the test ends, pass or panic.
+    struct TestDir(std::path::PathBuf);
+
+    impl Drop for TestDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
     #[test]
     fn requests_round_trip_and_count_up() {
         let dir = std::env::temp_dir().join(format!("wb-viewer-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
+        let _cleanup = TestDir(dir.clone());
         let a = request(&dir, ViewerTarget::Entry { entry_id: 7 }).unwrap();
         let b = request(
             &dir,
diff --git a/crates/ledger-store/tests/asset_tags.rs b/crates/ledger-store/tests/asset_tags.rs
index b4e8bef..6f003f7 100644
--- a/crates/ledger-store/tests/asset_tags.rs
+++ b/crates/ledger-store/tests/asset_tags.rs
@@ -18,11 +18,33 @@ use ledger_store::{DB_FILE, JOURNAL_FILE, JournalWriter, Store, StoreError};
 use serde_json::{Value, json};
 use std::path::{Path, PathBuf};
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-asset-tags-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn usd(amount: &str) -> Money {
@@ -78,7 +100,7 @@ fn laptop(store: &mut Store, a: &Accts, name: &str) -> AssetId {
 }
 
 /// A store with two untagged laptops.
-fn fixture(name: &str) -> (PathBuf, Store, Accts, AssetId, AssetId) {
+fn fixture(name: &str) -> (TestDir, Store, Accts, AssetId, AssetId) {
     let dir = test_dir(name);
     let mut s = Store::create(&dir, Currency::USD).unwrap();
     let a = accounts(&mut s);
diff --git a/crates/ledger-store/tests/attachments.rs b/crates/ledger-store/tests/attachments.rs
index 5dc7ec3..a0d30eb 100644
--- a/crates/ledger-store/tests/attachments.rs
+++ b/crates/ledger-store/tests/attachments.rs
@@ -25,11 +25,33 @@ use std::str::FromStr;
 
 // ---------------------------------------------------------------- helpers
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-attach-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn dec(s: &str) -> Decimal {
diff --git a/crates/ledger-store/tests/bounds.rs b/crates/ledger-store/tests/bounds.rs
index 1b9698e..0da33e5 100644
--- a/crates/ledger-store/tests/bounds.rs
+++ b/crates/ledger-store/tests/bounds.rs
@@ -21,14 +21,36 @@ use rust_decimal::Decimal;
 use serde_json::json;
 use std::path::PathBuf;
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!(
         "wanderbooks-store-bounds-{name}-{}",
         std::process::id()
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn d(y: i32, m: u32, day: u32) -> NaiveDate {
@@ -36,8 +58,8 @@ fn d(y: i32, m: u32, day: u32) -> NaiveDate {
 }
 
 /// The old-books fixture `name` (tests/fixtures/old-books: written by main
-/// 188c90ea), opened from a copy.
-fn open_old_books(name: &str) -> Store {
+/// 188c90ea), opened from a copy (kept while the guard lives).
+fn open_old_books(name: &str) -> (TestDir, Store) {
     let from = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
         .join("tests/fixtures/old-books")
         .join(name);
@@ -55,7 +77,8 @@ fn open_old_books(name: &str) -> Store {
             std::fs::copy(&e, to).unwrap();
         }
     }
-    Store::open(&dir).unwrap_or_else(|e| panic!("{name}: {e}"))
+    let store = Store::open(&dir).unwrap_or_else(|e| panic!("{name}: {e}"));
+    (dir, store)
 }
 
 /// Every file under `dir`.
@@ -114,7 +137,7 @@ fn a_statement_the_books_cant_hold_is_refused() {
         .unwrap();
     // A statement an earlier version recorded past both bounds opens, its
     // balances as recorded.
-    let old = open_old_books("x_statement_max");
+    let (_dir, old) = open_old_books("x_statement_max");
     let recorded = old.statements(None).unwrap();
     assert_eq!(
         recorded[0].closing_balance,
@@ -158,7 +181,7 @@ fn a_recurring_run_has_an_end() {
     assert!(s.run_recurring(last).unwrap().is_empty());
     // One run an earlier version made of more than that opens, every
     // draft as generated.
-    let old = open_old_books("x_recurring_run_1044");
+    let (_dir, old) = open_old_books("x_recurring_run_1044");
     assert_eq!(old.ledger().next_entry_id(), 1045);
     old.verify().unwrap();
 }
@@ -206,7 +229,7 @@ fn disposal_proceeds_larger_than_a_line_are_refused() {
         assert!(s.run_depreciation(id, period).is_err(), "{period}");
     }
     // Depreciation an earlier version posted for 10000-01 opens.
-    let old = open_old_books("x_depreciation_year10000");
+    let (_dir, old) = open_old_books("x_depreciation_year10000");
     assert_eq!(old.ledger().get_entry(2).unwrap().date(), d(10000, 1, 31));
 }
 
diff --git a/crates/ledger-store/tests/concurrency.rs b/crates/ledger-store/tests/concurrency.rs
index a8c2fe8..49f7dc5 100644
--- a/crates/ledger-store/tests/concurrency.rs
+++ b/crates/ledger-store/tests/concurrency.rs
@@ -19,11 +19,33 @@ use rust_decimal::Decimal;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Barrier};
 
-fn test_dir(name: &str) -> std::path::PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(std::path::PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wanderbooks-conc-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 const ENTRIES: u32 = 400;
diff --git a/crates/ledger-store/tests/faults.rs b/crates/ledger-store/tests/faults.rs
index ac3da74..1a56fc1 100644
--- a/crates/ledger-store/tests/faults.rs
+++ b/crates/ledger-store/tests/faults.rs
@@ -15,11 +15,33 @@ use rust_decimal::Decimal;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wanderbooks-fault-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn post_one(store: &mut Store, n: u32) -> Result<(), ledger_store::StoreError> {
@@ -104,7 +126,7 @@ fn full_disk_case(name: &str, drafts: u32) -> String {
             "trap '' XFSZ; ulimit -f {blocks}; exec \"$0\" --exact child_append_until_the_disk_is_full --nocapture --test-threads=1"
         ))
         .arg(&exe)
-        .env("WB_FAULT_DIR", &dir)
+        .env("WB_FAULT_DIR", dir.as_os_str())
         .output()
         .unwrap();
     let stdout = String::from_utf8_lossy(&out.stdout);
diff --git a/crates/ledger-store/tests/format.rs b/crates/ledger-store/tests/format.rs
index d23a94e..a620620 100644
--- a/crates/ledger-store/tests/format.rs
+++ b/crates/ledger-store/tests/format.rs
@@ -27,12 +27,34 @@ use rust_decimal::Decimal;
 use serde_json::json;
 use std::path::{Path, PathBuf};
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir =
         std::env::temp_dir().join(format!("wanderbooks-format-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 /// Books with one posted entry, closed again.
diff --git a/crates/ledger-store/tests/parties.rs b/crates/ledger-store/tests/parties.rs
index 211e0e8..0c8165a 100644
--- a/crates/ledger-store/tests/parties.rs
+++ b/crates/ledger-store/tests/parties.rs
@@ -24,11 +24,33 @@ use std::str::FromStr;
 
 // ---------------------------------------------------------------- helpers
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-parties-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn dec(s: &str) -> Decimal {
diff --git a/crates/ledger-store/tests/party_tin.rs b/crates/ledger-store/tests/party_tin.rs
index 4018f77..1dfdad7 100644
--- a/crates/ledger-store/tests/party_tin.rs
+++ b/crates/ledger-store/tests/party_tin.rs
@@ -12,11 +12,33 @@ use ledger_store::{DB_FILE, JOURNAL_FILE, JournalWriter, Store};
 use serde_json::{Value, json};
 use std::path::{Path, PathBuf};
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-party-tin-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn journal(dir: &Path) -> Vec<(String, Value)> {
diff --git a/crates/ledger-store/tests/roles.rs b/crates/ledger-store/tests/roles.rs
index bdac86f..628863e 100644
--- a/crates/ledger-store/tests/roles.rs
+++ b/crates/ledger-store/tests/roles.rs
@@ -18,11 +18,33 @@ use serde_json::{Value, json};
 use std::path::{Path, PathBuf};
 use std::str::FromStr;
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-roles-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn dec(s: &str) -> Decimal {
diff --git a/crates/ledger-store/tests/settings.rs b/crates/ledger-store/tests/settings.rs
index d98a0ac..1d89c8e 100644
--- a/crates/ledger-store/tests/settings.rs
+++ b/crates/ledger-store/tests/settings.rs
@@ -17,14 +17,36 @@ use rust_decimal::Decimal;
 use serde_json::{Value, json};
 use std::path::PathBuf;
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!(
         "wanderbooks-store-settings-{name}-{}",
         std::process::id()
     ));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn d(y: i32, m: u32, day: u32) -> NaiveDate {
@@ -48,7 +70,7 @@ fn set(k: &str, v: Value) -> Change {
 }
 
 /// Books with a small chart.
-fn books(name: &str) -> (PathBuf, Store) {
+fn books(name: &str) -> (TestDir, Store) {
     let dir = test_dir(name);
     let mut s = Store::create(&dir, Currency::USD).unwrap();
     for (code, name, t) in [
diff --git a/crates/ledger-store/tests/snapshot.rs b/crates/ledger-store/tests/snapshot.rs
index 288a2ae..77aee40 100644
--- a/crates/ledger-store/tests/snapshot.rs
+++ b/crates/ledger-store/tests/snapshot.rs
@@ -8,11 +8,33 @@ use rust_decimal::Decimal;
 use std::io::Write;
 use std::path::PathBuf;
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wanderbooks-snap-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn usd(n: i64) -> Money {
diff --git a/crates/ledger-store/tests/spec_store.rs b/crates/ledger-store/tests/spec_store.rs
index 8e9ad25..d590558 100644
--- a/crates/ledger-store/tests/spec_store.rs
+++ b/crates/ledger-store/tests/spec_store.rs
@@ -21,11 +21,33 @@ use std::path::{Path, PathBuf};
 
 const GENESIS: &str = "0000000000000000000000000000000000000000000000000000000000000000";
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wb-spec-store-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn usd(amount: u64) -> Money {
diff --git a/crates/ledger-store/tests/store.rs b/crates/ledger-store/tests/store.rs
index 48bb9f5..160397c 100644
--- a/crates/ledger-store/tests/store.rs
+++ b/crates/ledger-store/tests/store.rs
@@ -13,11 +13,33 @@ fn usd(amount: u64) -> Money {
     Money::new(Decimal::from(amount), Currency::USD)
 }
 
-fn test_dir(name: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl AsRef<std::path::Path> for TestDir {
+    fn as_ref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn test_dir(name: &str) -> TestDir {
     let dir = std::env::temp_dir().join(format!("wanderbooks-{name}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    dir
+    TestDir(dir)
 }
 
 fn build_books(dir: &std::path::Path) -> Store {
@@ -1619,7 +1641,7 @@ fn old_books() -> Vec<PathBuf> {
 /// A fixture's books (journal and blobs, never expected.json) in a fresh
 /// directory of its own for `test`: opening writes a database and a lock
 /// beside them.
-fn old_books_copy(fixture: &std::path::Path, test: &str) -> PathBuf {
+fn old_books_copy(fixture: &std::path::Path, test: &str) -> TestDir {
     fn copy(from: &std::path::Path, to: &std::path::Path) {
         std::fs::create_dir_all(to).unwrap();
         for e in std::fs::read_dir(from).unwrap() {
diff --git a/crates/ledger-vault/tests/vault.rs b/crates/ledger-vault/tests/vault.rs
index d26e7f5..a2baff0 100644
--- a/crates/ledger-vault/tests/vault.rs
+++ b/crates/ledger-vault/tests/vault.rs
@@ -3,11 +3,27 @@
 use ledger_vault::{Error, Tin, TinType, Vault, W9File};
 use std::path::PathBuf;
 
-fn dir(tag: &str) -> PathBuf {
+/// A test's dir, removed when the test ends, pass or panic.
+struct TestDir(PathBuf);
+
+impl std::ops::Deref for TestDir {
+    type Target = std::path::Path;
+    fn deref(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn dir(tag: &str) -> TestDir {
     let d = std::env::temp_dir().join(format!("wb-vault-{tag}-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&d);
     std::fs::create_dir_all(&d).unwrap();
-    d
+    TestDir(d)
 }
 
 fn vault(d: &std::path::Path) -> Vault {
diff --git a/justfile b/justfile
index 4b3c27e..b9447b2 100644
--- a/justfile
+++ b/justfile
@@ -17,10 +17,12 @@ check: sweep-test-tmp
     cargo test --workspace
     @just sweep-test-tmp
 
-# Test books go in the system temp dir (often RAM). A test cleans up after
-# itself, but one killed mid-run (a mutant's timeout, ^C) can't: tens of
-# thousands piled up to 23 GB of RAM (2026-10-15). Remove this user's test
-# book dirs older than an hour, so a run in progress elsewhere keeps its own.
+# Test books go in the system temp dir (often RAM). Every test's dir is
+# removed when the test ends, pass or panic (a guard dropped on unwind;
+# until 2026-10-17 many were removed only on pass, or never: 117,000 piled
+# up). A run killed mid-test (a mutant's timeout, ^C) runs no destructor,
+# so this sweep removes this user's test book dirs older than an hour; a
+# run in progress elsewhere keeps its own.
 sweep-test-tmp:
     @find "${TMPDIR:-/tmp}" /tmp -maxdepth 1 -user "$(id -u)" -type d -mmin +60 \( -name 'wb-*' -o -name 'wanderbooks-*' -o -name 'ledger-*' \) -exec rm -rf {} + 2>/dev/null || true