@bli-cockpit/cli 0.2.150 → 0.2.155

package/dist/commands/local-args-collector-work.js

@@ -8,7 +8,7 @@
  * defaults, same refusal sentences.
  */
 import { IntentSourceSchema, WorkIntentSchema, WorkPhaseSchema, } from "@bli-cockpit/telemetry-core";
-import { assertNoPositionals, optionalConfidence, optionalNonEmpty, optionalPositiveInteger, optionalSchemaValue, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
+import { assertNoPositionals, optionalConfidence, optionalNonEmpty, optionalNonNegativeInteger, optionalPositiveInteger, optionalSchemaValue, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
 export function parseStartArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -134,6 +134,7 @@ export function parseBackfillArgs(args) {
             "--max-files",
             "--max-depth",
             "--max-repos",
+            "--lock-wait",
             "--yes",
             "--json",
         ],
@@ -146,6 +147,7 @@ export function parseBackfillArgs(args) {
             "--max-files",
             "--max-depth",
             "--max-repos",
+            "--lock-wait",
         ],
     });
     assertNoPositionals(values.positionals, "backfill");
@@ -169,7 +171,13 @@ export function parseBackfillArgs(args) {
         maxFiles: optionalPositiveInteger(values.flags.get("--max-files"), "--max-files"),
         maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
         maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
+        ...lockWaitMs(values.flags.get("--lock-wait")),
         yes: values.booleans.has("--yes"),
         json: values.booleans.has("--json"),
     };
+}
+/** `--lock-wait <seconds>` (0 = try once); absent means the 10-minute default (BLI-11091). */
+function lockWaitMs(value) {
+    const seconds = optionalNonNegativeInteger(value, "--lock-wait");
+    return seconds === undefined ? {} : { syncLockWaitMs: seconds * 1000 };
 }

package/dist/commands/local-help-commands.js

@@ -95,6 +95,7 @@ export function localSubcommandHelp(command) {
                 "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
                 "--backfill-budget defaults to 900 seconds; catch-up repeats chunks until complete, with progress every 30 seconds.",
                 "--lock-wait defaults to 600 seconds; progress prints every 30 seconds.",
+                "--json without either flag answers within 45 seconds; a repair that does not fit reads doctor_budget_spent.",
                 "--json includes steps, repairs, and needs_person. Exit 0 means nothing needs you.",
                 "Maintainers: --update-tag next keeps self-update on the prerelease candidate.",
             ],
@@ -267,7 +268,7 @@ export function localSubcommandHelp(command) {
         [
             "backfill",
             [
-                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
+                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
                 "",
                 "Backfills historical Codex and Claude Code session evidence using the saved collection roots from local config when --workspace is omitted.",
                 "Omit --source to scan both sources; there is no --source all literal.",
@@ -276,6 +277,8 @@ export function localSubcommandHelp(command) {
                 "Repo discovery scans 3 folder levels and up to 50 repos by default.",
                 "Raise --max-depth or --max-repos when a partial result reports a discovery cap.",
                 "--dry-run validates the paired collector and dashboard reachability, prints the same summary tables, and writes nothing.",
+                "Sessions outside every saved root upload too, labelled outside; only an explicit opt-out withholds a session.",
+                "When the scheduled sync holds the collection lock, backfill waits up to --lock-wait seconds (default 600) and exits 1 with sync_lock_held if it never frees.",
             ],
         ],
         [
@@ -345,11 +348,11 @@ export function localSubcommandHelp(command) {
                 "Usage: cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
                 "",
                 "Reclaims this machine's disk. Prints what it would delete and why, per bucket,",
-                "then deletes: staged evidence Tower has already accepted goes after a 48-hour",
-                "retry window, and anything the upload ledger has NOT vouched for is kept,",
+                "then deletes: a staged copy Tower has already accepted goes (a retry re-reads",
+                "the source file), and anything the upload ledger has NOT vouched for is kept,",
                 "counted and named — retention never deletes undelivered evidence.",
-                "--dry-run stops after the printing. --all-committed drops the retry window,",
-                "so every already-accepted copy goes now, and is the only thing that removes a",
+                "--dry-run stops after the printing. --all-committed drops any retry window set",
+                "with COCKPIT_STAGING_RETENTION_HOURS, so every already-accepted copy goes now, and is the only thing that removes a",
                 "manual-study-evidence-vault folder (and only when every file in it is accepted).",
                 "--reconcile asks Tower's own upload ledger about every object this machine's",
                 "local memory can no longer classify (\"unknown\") before the buckets print — a",
@@ -358,9 +361,9 @@ export function localSubcommandHelp(command) {
                 "object instead of \"unknown\". A server failure never blocks the rest of clean",
                 "and is printed on its own line. Combine with --dry-run to ask and print",
                 "without deleting.",
-                "The scheduled sync does the same prune once a day (reconciling one batch first",
-                "when there is anything unknown); this is the door for a laptop that is full",
-                "right now.",
+                "The scheduled sync does the same prune on every tick (reconciling one batch first",
+                "when there is anything unknown); this is the door for \"show me\" and for a",
+                "laptop that has been off.",
             ],
         ],
         [

package/dist/commands/local-help.js

@@ -109,7 +109,7 @@ export function localCommandHelp(command) {
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
         "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
-        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
+        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit serve [--port <port>] [--workspace <path>]",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.150");
+    writeLine(io?.stdout ?? process.stdout, "0.2.155");
     return 0;
   }
 

package/dist/commands/status-disk-line.js

@@ -0,0 +1,22 @@
+/**
+ * `cockpit status`'s `Disk:` line (BLI-11106): the same footprint line
+ * `cockpit doctor`'s disk row opens with, so a person who pastes `status` into
+ * Slack also pastes what the collector holds on disk and when it last cleaned
+ * up. Human output only; `status --json` is unchanged. Split out of
+ * `status.ts` to keep that file under the readability ratchet.
+ */
+import { footprintLine } from "./doctor-disk-words.js";
+import { readDiskFootprint } from "../disk-usage.js";
+import { describeError } from "../health-detail.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+/** Never throws: an unreadable footprint is a named line, not a failed status. */
+export async function statusDiskLine(homeDir) {
+    try {
+        const footprint = await readDiskFootprint(getCollectorRuntimePaths(homeDir));
+        return `Disk: ${footprintLine(footprint)}`;
+    }
+    catch (error) {
+        console.error("[cockpit-status] could not read the disk footprint", JSON.stringify({ reason: "footprint_read_failed", ...describeError(error) }));
+        return "Disk: could not be read (footprint_read_failed)";
+    }
+}

package/dist/commands/status.js

@@ -22,6 +22,7 @@ import { displayTicketId, displayWorkLabel, shortSha, stuckEvidenceLine, } from
 import { discoverCommandWorktrees } from "./local-discovery.js";
 import { refreshSetupReceipt } from "./setup-receipt.js";
 import { setupReceiptBlock } from "./setup-receipt-lines.js";
+import { statusDiskLine } from "./status-disk-line.js";
 import { defaultCodexSessionDirs } from "../adapters/codex-attribution.js";
 import { describeError } from "../health-detail.js";
 import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
@@ -77,6 +78,7 @@ async function writeMultiRepoStatus(command, io, backfillCursor, setupReceipt, w
         return writeMultiRepoJson(io, backfillCursor, setupReceipt, statuses);
     writeLine(io.stdout, "Tower status — every repo below this folder");
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
+    writeLine(io.stdout, await statusDiskLine(command.homeDir));
     for (const status of statuses) {
         writeLine(io.stdout, `- ${status.repo_label ?? status.repo}/${status.worktree_label ?? "worktree"} · ${status.branch} · head:${shortSha(status.head_sha)} · ${status.upload_state}`);
     }
@@ -108,14 +110,14 @@ async function writeSingleRepoStatus(command, io, backfillCursor, setupReceipt)
     });
     if (command.json)
         return writeSingleRepoJson(io, status, backfillCursor, setupReceipt);
-    writeSingleRepoLines(io, status, backfillCursor, setupReceipt);
+    writeSingleRepoLines(io, status, backfillCursor, setupReceipt, await statusDiskLine(command.homeDir));
     return 0;
 }
 function writeSingleRepoJson(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, JSON.stringify({ ...status, backfill_cursor: backfillCursor, setup_receipt: setupReceipt?.receipt ?? null }, null, 2));
     return 0;
 }
-function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
+function writeSingleRepoLines(io, status, backfillCursor, setupReceipt, disk) {
     writeLine(io.stdout, "Tower status");
     writeLine(io.stdout, `Installed: ${status.installed ? "yes" : "no"}`);
     writeLine(io.stdout, `Signed in: ${signedInLine(status.session_state)}`);
@@ -142,6 +144,7 @@ function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, `Last health note problem: ${status.last_health_receipt_failure_reason ?? "none"}`);
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
     writeLine(io.stdout, `Stuck files: ${stuckEvidenceLine(status)}`);
+    writeLine(io.stdout, disk);
     for (const detail of status.details)
         writeLine(io.stdout, `- ${detail}`);
     writeConnectedBlock(io, setupReceipt);

package/dist/commands/sync-followups-staging.js

@@ -10,9 +10,11 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * laptop forever.
  *
  * Same shape as the memory install beside it and for the same reasons: it runs
- * only once collection's own outcome is decided and reported, at most once a
- * day, it cannot throw, and its outcome is its own named receipt rather than a
- * sync failure. A machine that cannot prune is a machine short of disk, and
+ * only once collection's own outcome is decided and reported, it cannot throw,
+ * and its outcome is its own named receipt rather than a sync failure. Unlike
+ * the memory install it runs on EVERY tick (BLI-11106): the upload above has
+ * just recorded which objects the server committed, and their staged copies
+ * go in this same tick rather than a day or two later. A machine that cannot prune is a machine short of disk, and
  * that must never also be a machine that stops collecting.
  *
  * The rule itself is `disk-retention.ts`: only objects the upload ledger
@@ -24,7 +26,7 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * ledger's own memory is capped, so a laptop that keeps accumulating
  * `unknown` state needs SOMETHING asking the server on a schedule, not only
  * when a person happens to type `cockpit clean --reconcile`. One batch a tick
- * is not throttled to once a day like the prune below — an `unknown` backlog
+ * is bounded to one batch rather than drained whole — an `unknown` backlog
  * drains at up to 500 hashes/15 min, and the ordinary case (nothing unknown)
  * costs one cheap local read and no network call at all, so it never competes
  * with collection for the tick's time. A reconcile failure never blocks the
@@ -59,9 +61,10 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
             detail: redactedSyncErrorDetail(error),
         }));
     }
-    // The daily throttle is the steady state — reporting it would post a receipt
-    // on 95 of every 96 ticks for no new information.
-    if (result.reason !== "throttled_recent_run") {
+    // A tick with nothing to prune is the steady state: `[collector prune]`
+    // already logged it locally with the bytes scanned, and posting a receipt on
+    // 95 of every 96 ticks would say nothing new.
+    if (result.reason !== "nothing_to_prune") {
         events.push(stagingPruneEvent(result));
     }
     if (events.length === 0)
@@ -78,8 +81,8 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
 /**
  * Never throws (`runEvidenceReconcile` already never does); returns `null`
  * for the boring, common case — nothing this tick was `unknown` — so that
- * case costs no receipt either, the same rule the prune's own daily throttle
- * follows above.
+ * case costs no receipt either, the same rule the prune's own
+ * `nothing_to_prune` follows above.
  */
 async function runReconcileFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceReconcile({
@@ -102,7 +105,7 @@ async function runReconcileFollowUp(command, io, dashboardUrl, options) {
  * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
  * the boring, common case — nothing on this disk is undelivered — so the steady
  * state costs no receipt, the same rule the reconcile follow-up above and the
- * prune's daily throttle below both follow.
+ * prune's `nothing_to_prune` below both follow.
  */
 async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceRedelivery({

package/dist/commands/sync.js

@@ -24,8 +24,10 @@
  *
  * Both arms below do the same things in the same order, because a tick that
  * THREW is still a tick a machine survived and the fleet has to be able to tell
- * that from silence (BLI-3551). The one difference is the staging prune, which
- * the throwing arm has never run.
+ * that from silence (BLI-3551). Both arms also run the staging prune: a tick
+ * that threw after uploading still leaves committed copies the prune may take,
+ * and waiting for the next clean tick is how a sick machine fills its disk
+ * (BLI-11106).
  *
  * Split out of commands/local.ts (BLI-3578), then into the siblings above
  * (BLI-3982). The scan and upload engine underneath is `./session-sync.ts`;
@@ -78,8 +80,8 @@ export async function runSync(command, io) {
         await sendSyncHeartbeat(command, io, dashboardUrl, result.heartbeat);
         await reportTickOutcome(command, io, dashboardUrl, result.completion);
         await convergeAfterTick(command, io, dashboardUrl);
-        // BLI-3619: and the disk stops growing without bound — same daily cadence,
-        // same rule that a follow-up never blocks or fails collection.
+        // BLI-3619 / BLI-11106: every tick, the staged copies of whatever the
+        // server just committed go; a follow-up never blocks or fails collection.
         await runStagingPruneAfterSync(command, io, dashboardUrl);
         return result.exitCode;
     }
@@ -94,6 +96,7 @@ export async function runSync(command, io) {
         });
         await reportTickThrew(command, io, dashboardUrl, error, errorCode);
         await convergeAfterTick(command, io, dashboardUrl);
+        await runStagingPruneAfterSync(command, io, dashboardUrl);
         throw error;
     }
 }

package/dist/cursors/raw-evidence-cursor.js

@@ -165,10 +165,14 @@ function parseObjectEntry(value) {
     const committedAt = optionalString(record["committed_at"]);
     if (!objectKey || !committedAt)
         return null;
+    const sourceKey = optionalString(record["source_key"]);
     return {
         object_key: objectKey,
         byte_size: optionalNumber(record["byte_size"]),
         committed_at: committedAt,
+        ...(sourceKey
+            ? { source_key: sourceKey, checkpoints: parseCheckpoints(record["checkpoints"]) }
+            : {}),
     };
 }
 function parseSessionEntry(value) {
@@ -193,6 +197,16 @@ function parseSessionEntry(value) {
         last_seen_at: lastSeenAt,
     };
 }
+function parseCheckpoints(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const out = {};
+    for (const [offset, hash] of Object.entries(value)) {
+        if (/^\d+$/.test(offset) && typeof hash === "string")
+            out[offset] = hash;
+    }
+    return out;
+}
 function rawEvidenceCursorPath(paths, filename = PRIMARY_CURSOR_FILENAME) {
     return path.join(paths.cursors_dir, filename);
 }

package/dist/disk-prune.js

@@ -15,19 +15,25 @@
  *   evidence that the drain is still running at all (the BLI-2528 lesson: what
  *   only speaks on failure cannot answer "did anything work today?").
  *
- * Throttled to once a day by a marker file, the same idiom the raw-evidence GC,
- * the scheduled self-update and the BLI Memory install use. Walking a pack tree
- * is cheap; doing it every fifteen minutes for a decision that changes on the
- * scale of hours is not.
+ * Runs on EVERY tick (BLI-11106). It used to sit behind a once-a-day marker
+ * file, and that is how 534 MB of committed, past-window copies were still on
+ * the reference Mac when it was measured: the drain existed and had not run
+ * yet. The inventory reads each pack's small `manifest.json` rather than its
+ * payload, so a tick with nothing to delete costs one directory walk and logs
+ * `nothing_to_prune` with the bytes it scanned. `COCKPIT_DISABLE_GC=1` is the
+ * only off switch.
+ *
+ * Every non-dry run leaves `last-prune.json` (one small object, overwritten)
+ * so `cockpit doctor` and `cockpit status` can say when it last ran and what
+ * it freed without re-running it.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
 import { planStagingRetention, retentionOptionsFromEnv, } from "./disk-retention.js";
 import { RAW_EVIDENCE_DIR, readStagingInventory } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
+import { writeLastPruneReceipt } from "./prune-receipt.js";
 import { readRawEvidenceStagingState, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
-export const STAGING_PRUNE_THROTTLE_MARKER = ".last-staging-prune";
-export const STAGING_PRUNE_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 /**
  * The prune the sync tick runs and `cockpit clean` / `cockpit doctor` reuse.
  * Never throws.
@@ -38,17 +44,14 @@ export async function runStagingPrune(paths, options = {}) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
         return skippedResult("disabled");
     }
-    if (!options.force && (await prunedRecently(paths, now))) {
-        return skippedResult("throttled_recent_run");
-    }
     try {
-        if (!options.dryRun && !options.force)
-            await markPruned(paths, now);
         const plan = await planFromDisk(paths, env, options, now);
         const result = options.dryRun
             ? dryRunResult(plan)
             : await applyPlan(paths, plan);
         reportPrune(result, { dryRun: Boolean(options.dryRun) });
+        if (!options.dryRun)
+            await writeLastPruneReceipt(paths, result, now);
         return result;
     }
     catch (error) {
@@ -75,7 +78,7 @@ async function applyPlan(paths, plan) {
     return {
         ...dryRunResult(plan),
         status: "ok",
-        reason: tally.files > 0 ? "pruned" : "nothing_eligible",
+        reason: tally.files > 0 || tally.packs > 0 ? "pruned" : "nothing_to_prune",
         deleted_files: tally.files,
         deleted_bytes: tally.bytes,
         removed_packs: tally.packs,
@@ -166,7 +169,9 @@ async function forgetStagedObjects(paths, hashes) {
 function dryRunResult(plan) {
     return {
         status: "ok",
-        reason: plan.delete.length > 0 ? "would_prune" : "nothing_eligible",
+        reason: plan.delete.length > 0 || plan.empty_packs.length > 0
+            ? "would_prune"
+            : "nothing_to_prune",
         deleted_files: plan.delete.length,
         deleted_bytes: plan.deleted_bytes + plan.empty_pack_manifest_bytes,
         removed_packs: plan.empty_packs.length,
@@ -221,6 +226,7 @@ export function reportPrune(result, options = { dryRun: false }) {
         kept_unknown: result.kept_unknown,
         kept_in_window: result.kept_in_window,
         cap_bytes: result.cap_bytes,
+        bytes_scanned: result.bytes_before,
         bytes_after: result.bytes_after,
         failed_deletions: result.failed_deletions,
     }));
@@ -234,14 +240,4 @@ export function reportPrune(result, options = { dryRun: false }) {
         cap_bytes: result.cap_bytes,
         bytes_after: result.bytes_after,
     }));
-}
-async function prunedRecently(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    const info = await fs.stat(marker).catch(() => null);
-    return Boolean(info && now.getTime() - info.mtimeMs < STAGING_PRUNE_MIN_INTERVAL_MS);
-}
-async function markPruned(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
-    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
 }

package/dist/disk-retention.js

@@ -1,7 +1,10 @@
-/** How long a committed spare is kept so a retry still has local bytes. */
-export const DEFAULT_STAGING_RETENTION_MS = 48 * 60 * 60 * 1000;
+/**
+ * How long a committed spare is kept: zero (BLI-11106). A retry re-reads the
+ * source file, so the staged copy of a committed object is pure duplication.
+ */
+export const DEFAULT_STAGING_RETENTION_MS = 0;
 /** Ceiling on everything under `raw-evidence`, manifests included. */
-export const DEFAULT_STAGING_CAP_BYTES = 2 * 1024 * 1024 * 1024;
+export const DEFAULT_STAGING_CAP_BYTES = 256 * 1024 * 1024;
 /** Local knobs, read from the environment like `COCKPIT_DISABLE_GC`. */
 export const STAGING_CAP_ENV = "COCKPIT_STAGING_CAP_BYTES";
 export const STAGING_RETENTION_ENV = "COCKPIT_STAGING_RETENTION_HOURS";
@@ -33,7 +36,7 @@ export function planStagingRetention(inventory, options = {}) {
                 continue;
             }
             if (options.allCommitted || object.age_ms >= retentionMs) {
-                pushDeletion(plan, object, "committed_past_retry_window");
+                pushDeletion(plan, object, "committed_on_server");
                 continue;
             }
             committedInWindow.push(object);
@@ -61,11 +64,11 @@ export function planStagingRetention(inventory, options = {}) {
  * safe elsewhere.
  *
  * It does not run at all when the floor is already above the cap. That branch
- * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging is
- * evidence no ledger vouches for, against a 2 GB cap, so spending the retry
- * window on 1,027 committed spares would have deleted a day of local retry
- * copies and still ended over the cap. The cap takes a spare only when taking
- * it can actually get this machine under the cap.
+ * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging was
+ * evidence no ledger vouched for, against the cap of the day. With the default
+ * zero window it rarely matters (committed spares are already gone); it keeps
+ * an opted-in window honest by taking a spare only when that can actually get
+ * this machine under the cap.
  */
 function applyByteCap(plan, committedInWindow, capBytes, inventory) {
     let projected = plan.bytes_before - plan.deleted_bytes;

package/dist/disk-usage-footprint.js

@@ -1,9 +1,11 @@
 /**
- * The whole-machine read: staging, rotated logs, the spool, and the vaults a
- * person made by hand — the four places Cockpit ever writes bytes on a laptop.
+ * The whole-machine read: staging, rotated logs, the spool, the vaults a
+ * person made by hand, and (BLI-11106) the rest of the state directory plus
+ * the last prune's receipt.
  *
- * The staging half is the rest of this family; what lives here is the other
- * three and the one function that puts all four together.
+ * The staging half is the rest of this family; the state-dir audit is
+ * `state-dir-audit.ts` and the receipt `prune-receipt.ts`. What lives here is
+ * the one function that puts them together.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -11,6 +13,8 @@ import { MANUAL_VAULT_PREFIX, } from "./disk-usage-facts.js";
 import { directoryBytes, listPackFiles } from "./disk-usage-files.js";
 import { readStagingInventory } from "./disk-usage-scan.js";
 import { rotatedLogFootprint } from "./log-rotation.js";
+import { readLastPruneReceipt } from "./prune-receipt.js";
+import { readStateDirFootprint } from "./state-dir-audit.js";
 /**
  * Everything on this machine Cockpit put there, in one read. Used by the sync
  * tick's prune, by `cockpit clean` and by `cockpit doctor`'s disk row, so all
@@ -22,6 +26,8 @@ export async function readDiskFootprint(paths, now = new Date()) {
         logs: await rotatedLogFootprint(paths),
         spool_bytes: await directoryBytes(paths.spool_dir),
         vaults: await readManualVaults(paths),
+        state: await readStateDirFootprint(paths),
+        last_prune: await readLastPruneReceipt(paths),
     };
 }
 /** The hand-made vaults: counted and named so nothing deletes them silently. */

package/dist/evidence-reconcile-client.js

@@ -35,8 +35,8 @@ export async function runEvidenceReconcile(options) {
         if (hashes.length === 0) {
             // No stderr line here on purpose: the sync tick calls this every 15
             // minutes and the steady state is "nothing unknown" — logging that
-            // every tick forever is exactly the receipt-on-95-of-96-ticks spam the
-            // daily prune throttle exists to avoid. `cockpit clean --reconcile`
+            // every tick forever is exactly the receipt-on-95-of-96-ticks spam that
+            // the follow-ups skip on their `nothing_*` reasons. `cockpit clean --reconcile`
             // still tells a person this on stdout (`reconcileLines` in clean.ts).
             return emptyResult("nothing_unknown");
         }

package/dist/log-rotation.js

@@ -37,9 +37,16 @@ import path from "node:path";
  * of a file operators can read. The tail is capped rather than copied whole, so
  * the archives cannot themselves become the disk problem — worst case on disk
  * is (keep + 1) x maxBytes per stream.
+ *
+ * BLI-11106 tightened the numbers: at most 2 archives and 20 MB of archive per
+ * stream (2 x 10 MiB), so both streams together never pass 60 MiB, live logs
+ * included. It was 3 x 20 MiB per stream (160 MiB worst case) and the
+ * reference Mac held 147 MB of it on 2026-09-30. An archive above the new keep
+ * window (`sync.log.3` on every machine that ran the old numbers) is swept on
+ * the first tick by `sweepOrphanedLogArchives` below.
  */
-export const DEFAULT_LOG_ROTATION_MAX_BYTES = 20 * 1024 * 1024;
-export const DEFAULT_LOG_ROTATION_KEEP = 3;
+export const DEFAULT_LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
+export const DEFAULT_LOG_ROTATION_KEEP = 2;
 /** The two files launchd writes for the scheduled tick. */
 export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
 /**
@@ -129,27 +136,41 @@ async function rotateOne(filePath, maxBytes, keep) {
  * sentences and an operator is owed the second one.
  */
 export async function sweepOrphanedLogArchives(paths, options) {
+    const swept = [];
+    for (const archive of await orphanedLogArchives(paths, options)) {
+        const removed = await fs
+            .rm(path.join(paths.state_dir, archive.name), { force: true })
+            .then(() => true, () => false);
+        if (removed)
+            swept.push(archive);
+    }
+    return swept;
+}
+/**
+ * The archives the sweep above WOULD remove, without removing them — what
+ * `cockpit clean --dry-run` prints (BLI-11106). Same rule, one reader.
+ */
+export async function orphanedLogArchives(paths, options = {
+    keep: DEFAULT_LOG_ROTATION_KEEP,
+    names: ROTATED_LOG_NAMES,
+}) {
     const entries = await fs
         .readdir(paths.state_dir, { withFileTypes: true })
         .catch(() => []);
-    const swept = [];
+    const found = [];
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
         const reason = orphanArchiveReason(entry.name, options);
         if (!reason)
             continue;
-        const file = path.join(paths.state_dir, entry.name);
         const size = await fs
-            .stat(file)
+            .stat(path.join(paths.state_dir, entry.name))
             .then((info) => info.size)
             .catch(() => 0);
-        const removed = await fs.rm(file, { force: true }).then(() => true, () => false);
-        if (!removed)
-            continue;
-        swept.push({ name: entry.name, byte_size: size, reason });
+        found.push({ name: entry.name, byte_size: size, reason });
     }
-    return swept;
+    return found;
 }
 /**
  * Which stream this file belongs to and why it is outside the keep window, or

package/dist/prune-receipt.js

@@ -0,0 +1,87 @@
+/**
+ * `last-prune.json`: when the staging prune last ran and what it freed
+ * (BLI-11106).
+ *
+ * The prune runs on every sync tick, so "did it run?" is answered by a file it
+ * overwrites, never by a file that grows. One small JSON object, bounded by
+ * construction. `cockpit doctor` and `cockpit status` read it for the
+ * footprint line ("last prune: <when>, freed <n> MB") without re-running the
+ * prune themselves.
+ *
+ * It also carries the last time a prune actually freed something, because on
+ * a healthy machine the newest run is usually `nothing_to_prune` and "freed
+ * 0 MB" on its own cannot tell a working drain from a stuck one.
+ *
+ * The old once-a-day throttle marker is removed on the first write: it gates
+ * nothing any more, and a file that gates nothing is exactly the kind of
+ * leftover this ticket exists to stop.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describeError } from "./health-detail.js";
+export const LAST_PRUNE_FILE = "last-prune.json";
+/** The retired daily throttle marker; deleted on sight. */
+export const LEGACY_STAGING_PRUNE_MARKER = ".last-staging-prune";
+export async function readLastPruneReceipt(paths) {
+    const raw = await fs
+        .readFile(path.join(paths.state_dir, LAST_PRUNE_FILE), "utf8")
+        .catch(() => null);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.at !== "string" || typeof parsed.reason !== "string") {
+            return null;
+        }
+        return {
+            at: parsed.at,
+            reason: parsed.reason,
+            freed_bytes: numberOr0(parsed.freed_bytes),
+            deleted_files: numberOr0(parsed.deleted_files),
+            bytes_scanned: numberOr0(parsed.bytes_scanned),
+            bytes_after: numberOr0(parsed.bytes_after),
+            last_freed_at: typeof parsed.last_freed_at === "string" ? parsed.last_freed_at : null,
+            last_freed_bytes: numberOr0(parsed.last_freed_bytes),
+        };
+    }
+    catch {
+        // A torn or hand-edited receipt reads as "never ran"; the next tick
+        // overwrites it. Doctor prints "last prune: never" rather than guessing.
+        return null;
+    }
+}
+/** Never throws: a receipt that cannot be written is a log line, not a failed tick. */
+export async function writeLastPruneReceipt(paths, result, now) {
+    try {
+        const previous = await readLastPruneReceipt(paths);
+        const freed = result.deleted_bytes > 0;
+        const receipt = {
+            at: now.toISOString(),
+            reason: result.reason,
+            freed_bytes: result.deleted_bytes,
+            deleted_files: result.deleted_files,
+            bytes_scanned: result.bytes_before,
+            bytes_after: result.bytes_after,
+            last_freed_at: freed ? now.toISOString() : (previous?.last_freed_at ?? null),
+            last_freed_bytes: freed
+                ? result.deleted_bytes
+                : (previous?.last_freed_bytes ?? 0),
+        };
+        await fs.mkdir(paths.state_dir, { recursive: true });
+        const file = path.join(paths.state_dir, LAST_PRUNE_FILE);
+        const temp = `${file}.${process.pid}.tmp`;
+        await fs.writeFile(temp, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        await fs.rename(temp, file);
+        await fs
+            .rm(path.join(paths.state_dir, LEGACY_STAGING_PRUNE_MARKER), { force: true })
+            .catch(() => undefined);
+    }
+    catch (error) {
+        console.error("[collector prune] could not record the last-prune receipt", JSON.stringify({ reason: "last_prune_write_failed", ...describeError(error) }));
+    }
+}
+function numberOr0(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0
+        ? value
+        : 0;
+}