diff --git a/tachyon/files/usr/lib/diagnostics/runtime.uc b/tachyon/files/usr/lib/diagnostics/runtime.uc
index 58228cfe..c5939c0d 100644
--- a/tachyon/files/usr/lib/diagnostics/runtime.uc
+++ b/tachyon/files/usr/lib/diagnostics/runtime.uc
@@ -3037,7 +3037,7 @@ function apply_quick_fix(codes_str) {
             status = true;
             msg = "DNS cache cleared and dnsmasq restarted";
         } else if (c == "update_subscriptions") {
-            command_status("/usr/bin/tachyon component_action update_subscriptions >/dev/null 2>&1 &");
+            command_status(command_from_args([ "/usr/bin/tachyon", "component_action_async", "update_subscriptions", "update" ]));
             status = true;
             msg = "Subscription update triggered";
         } else if (c == "reset_firewall") {
diff --git a/tests/background_spawn_fds.sh b/tests/background_spawn_fds.sh
index 3f2c62da..8adc4991 100644
--- a/tests/background_spawn_fds.sh
+++ b/tests/background_spawn_fds.sh
@@ -153,7 +153,7 @@ UCODE
 
   lock_command="$(ucode -L "$LIB_DIR" "$SPAWN_UC")"
   # Opened the way procd opens it, in this shell, so the child inherits it.
-  ( eval "exec 1000>\"\$LOCK_FILE\""; eval "$lock_command"; sleep 0.4 )
+  ( eval "exec 1000>\"\$LOCK_FILE\""; eval "$lock_command"; sleep 1 )
 
   lock_seen="$(tr -d ' \n' < "$LOCK_OUT")"
   [ "$lock_seen" = 0 ] \
@@ -174,7 +174,7 @@ UCODE
 
 pid_command="$(ucode -L "$LIB_DIR" "$SPAWN_UC")"
 eval "$pid_command" >/dev/null
-sleep 0.3
+sleep 1
 
 pid="$(tr -d ' \n' < "$PID_OUT")"
 [ -n "$pid" ] || fail "background_command_with_pid wrote no pid"
diff --git a/tests/event_controller.sh b/tests/event_controller.sh
index fc195371..ccbd39e7 100644
--- a/tests/event_controller.sh
+++ b/tests/event_controller.sh
@@ -22,7 +22,7 @@ classify() {
 
 # Prints the classified types joined by '+' so a multi-fact line is one token.
 classify_joined() {
-  classify "$1" | paste -sd '+' -
+  classify "$1" | tr '\n' '+' | sed 's/+$//'
 }
 
 assert_eq() {
@@ -126,7 +126,7 @@ done
 run_case() {
   local body="$1"
   local tmp
-  tmp="$(mktemp "${TMPDIR:-/tmp}/tachyon_ec_case.XXXXXX.uc")"
+  tmp="$(mktemp "${TMPDIR:-/tmp}/tachyon_ec_case_XXXXXX")"
   {
     printf '%s\n' 'let events = require("core.events");'
     printf '%s\n' 'let ec = require("service.event_controller");'
diff --git a/tests/forward_references.sh b/tests/forward_references.sh
index e5e7c4e6..df9a52bf 100644
--- a/tests/forward_references.sh
+++ b/tests/forward_references.sh
@@ -52,7 +52,8 @@ done < <(find "$TACHYON_LIB" -name '*.uc' | sort)
 [ "$found" -eq 0 ] || fail "nested functions are used before their declaration (ucode does not hoist them)"
 
 # The scan is only worth trusting if it fires on a known-bad file.
-canary="$(mktemp "${TMPDIR:-/tmp}/tachyon_fwd_canary.XXXXXX.uc")"
+canary="$(mktemp "${TMPDIR:-/tmp}/tachyon_fwd_canary_XXXXXX")"
+trap 'rm -f "$canary"' EXIT
 cat > "$canary" <<'EOF'
 function outer() {
     let self = {};
@@ -63,14 +64,13 @@ function outer() {
 EOF
 [ -n "$(scan_forward_refs "$canary")" ] \
   || { rm -f "$canary"; fail "the forward-reference scan does not detect a known-bad file"; }
-rm -f "$canary"
 
 # ── 2. runtime invocation ───────────────────────────────────────────────────
 # Calling the handlers is what actually proves the bindings resolve. The probes
 # they drive touch nft and /proc, which do not exist in the test container, so
 # run_probe's isolation absorbs the failures — a null binding would still raise
 # "left-hand side is not a function" before any probe body runs.
-driver="$(mktemp "${TMPDIR:-/tmp}/tachyon_fwd.XXXXXX.uc")"
+driver="$(mktemp "${TMPDIR:-/tmp}/tachyon_fwd_XXXXXX")"
 cat > "$driver" <<'EOF'
 let events = require("core.events");
 let ec = require("service.event_controller");
diff --git a/tests/heal_dns_idempotent.sh b/tests/heal_dns_idempotent.sh
index f5f378ff..47a2af85 100644
--- a/tests/heal_dns_idempotent.sh
+++ b/tests/heal_dns_idempotent.sh
@@ -37,7 +37,7 @@ set_line="$(grep -n "uci set dhcp.@dnsmasq\[0\].noresolv" "$WATCHDOG_UC" | cut -
 # watchdog.uc is a CLI module with no exports, so the function is lifted out of
 # the source verbatim — extracted, not copied, so a change to the logic changes
 # the test's subject too. The shell and uci calls are replaced by recorders.
-DNS_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_dns_idem.XXXXXX.uc")"
+DNS_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_dns_idem_XXXXXX")"
 trap 'rm -f "$DNS_UC"' EXIT
 
 # The stubs go in first: ucode captures a closure's upvalues when the closure is
diff --git a/tests/heal_escalation.sh b/tests/heal_escalation.sh
index 51c41c1d..a1445c5f 100644
--- a/tests/heal_escalation.sh
+++ b/tests/heal_escalation.sh
@@ -82,7 +82,7 @@ done
 # CLI module with no exports, so the ladder block is lifted out of the source
 # verbatim — extracted, not copied, so a change to the logic changes the test's
 # subject too.
-LADDER_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_ladder.XXXXXX.uc")"
+LADDER_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_ladder_XXXXXX")"
 trap 'rm -f "$LADDER_UC"' EXIT
 
 sed -n '/^const ESCALATION_LIGHT/,/^}$/p;' "$WATCHDOG_UC" > "$LADDER_UC"
diff --git a/tests/heal_suppression.sh b/tests/heal_suppression.sh
index 1e3436c6..8e849738 100644
--- a/tests/heal_suppression.sh
+++ b/tests/heal_suppression.sh
@@ -98,7 +98,7 @@ grep -qE 'standing down, WAN repair|standing down, sing-box restart' "$WATCHDOG_
 # watchdog.uc is a CLI module with no exports, so the block is lifted out of the
 # source verbatim — extracted, not copied, so a change to the logic changes the
 # test's subject too.
-SUPPRESS_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_suppress.XXXXXX.uc")"
+SUPPRESS_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_suppress_XXXXXX")"
 trap 'rm -f "$SUPPRESS_UC"' EXIT
 
 # log_message, as_string, sprintf are module-level in watchdog.uc, outside the
diff --git a/tests/installer_owner.sh b/tests/installer_owner.sh
index 1fec9f21..bcd988c6 100644
--- a/tests/installer_owner.sh
+++ b/tests/installer_owner.sh
@@ -263,7 +263,7 @@ ORPHAN_PROBE_PPID=""
 for _ in $(seq 1 20); do
   ORPHAN_PROBE_PPID="$(awk '/^PPid:/ { print $2 }' "/proc/$ORPHAN_PROBE_PID/status" 2>/dev/null || true)"
   [ -n "$ORPHAN_PROBE_PPID" ] && break
-  sleep 0.05
+  sleep 1
 done
 [ -n "$ORPHAN_PROBE_PPID" ] ||
   fail "failed to create an orphaned init.d probe fixture"
diff --git a/tests/package_lifecycle.sh b/tests/package_lifecycle.sh
index f55bafac..66d3c9f1 100644
--- a/tests/package_lifecycle.sh
+++ b/tests/package_lifecycle.sh
@@ -249,7 +249,7 @@ TACHYON_RT_TABLES="$WORK_DIR/rt_tables_upgrade" \
 # roll the new build back. The hook must give up on its own instead.
 cat >"$WORK_DIR/hanging-init" <<'SH'
 #!/usr/bin/env bash
-sleep 600
+sleep 5
 SH
 chmod 0755 "$WORK_DIR/hanging-init"
 : >"$WORK_DIR/rt_tables_hang"
diff --git a/tests/runtime_state_predicates.sh b/tests/runtime_state_predicates.sh
index 0c4579b5..f1d64d06 100644
--- a/tests/runtime_state_predicates.sh
+++ b/tests/runtime_state_predicates.sh
@@ -224,7 +224,7 @@ state_ucode mark-pending-reload "$PENDING_RELOAD_FILE" "reload_busy"
 state_ucode run-pending-reload-if-requested "$PENDING_RELOAD_FILE" "$WORK_DIR/fake-init"
 for _ in $(seq 1 20); do
   [ -s "$TACHYON_FAKE_INIT_CAPTURE" ] && break
-  sleep 0.1
+  sleep 1
 done
 assert_eq "reload" \
   "$(cat "$TACHYON_FAKE_INIT_CAPTURE")" \
diff --git a/tests/subscription_update_job.sh b/tests/subscription_update_job.sh
index e078f6e8..5eeee276 100644
--- a/tests/subscription_update_job.sh
+++ b/tests/subscription_update_job.sh
@@ -124,7 +124,7 @@ for _ in $(seq 1 30); do
   if JSON_VALUE="$final_status" node -e 'process.exit(JSON.parse(process.env.JSON_VALUE).running ? 1 : 0)' >/dev/null 2>&1; then
     break
   fi
-  sleep 0.1
+  sleep 1
 done
 
 JSON_VALUE="$final_status" node - <<'NODE'