The normalized capture goes to the system temp dir, with no size or location control #72

From the /project:verify review of step 9 (PR #69).

cli._label normalizes into TemporaryDirectory(prefix="flabel-"), which uses the system temp directory. Spec §10 requires the normalized copy to live in a per-run temporary directory, so the placement is right.

The operational risk: docs/prd.md anticipates multi-GB captures. On hosts where /tmp is a RAM-backed tmpfs — the default on many systemd distributions, and common in containers — normalizing a large gzipped pcapng holds the decompressed file, any editcap intermediates, and the normalized output concurrently. That can exhaust tmpfs and fail a run for a reason that has nothing to do with the capture.

The CLI contract is closed, so there is no --temp-dir to reach for and adding one is out of scope.

Options

• Honour TMPDIR explicitly and document it in README.md / docs/dev-setup.md (Python's tempfile already respects it, so this may be documentation only).
• Default the workspace to a sibling of --output-dir, which the operator has already chosen and sized for the run's output.
• Estimate the requirement from the input size and fail early with a clear message rather than mid-conversion.

The second is the most predictable: the operator picked a directory big enough for the run directory, and the normalized capture is the same order of magnitude as the input.

Also noted in review: the comment justifying the temp directory cites spec §13's "never copy capture data outside the run directory", which cuts the other way — /tmp is also outside it. §10 is the section that sanctions the temp copy. The placement is right; the stated reason should be corrected.