@bli-cockpit/cli 0.2.154 → 0.2.155

package/dist/commands/clean.js

@@ -1,16 +1,19 @@
 /**
  * `cockpit clean` — what this machine is holding, why, and what goes.
  *
- * BLI-3619. The tick prunes on its own once a day; this is the door a person
- * opens when a laptop is full now. It prints the same buckets the retention
- * rule reasons in, one line each with its reason, and only then deletes:
+ * BLI-3619 / BLI-11106. The sync tick prunes on its own, every tick, and a
+ * staged copy goes the tick its commit is acknowledged; nobody should need
+ * this door. It is here for "show me" and for a machine that has been off.
+ * It prints the same buckets the retention rule reasons in, one line each with
+ * its reason, and only then deletes:
  *
- *   committed, past the 48 h retry window   goes
- *   committed, still inside the window      kept — unless the cap needs it
+ *   committed on the server                 goes
+ *   committed, inside an opted-in window    kept — unless the cap needs it
+ *                                           (only when COCKPIT_STAGING_RETENTION_HOURS is set)
  *   uncommitted                             kept, always, and named
  *   the ledger cannot say                   kept, always, and named apart
  *
- * `--dry-run` stops after the printing. `--all-committed` drops the retry
+ * `--dry-run` stops after the printing. `--all-committed` drops any opted-in
  * window — every committed spare goes now — and is also the only thing that
  * removes a `manual-study-evidence-vault-*` directory, and then only when every
  * object inside it is committed. Nothing here can delete evidence the upload
@@ -31,12 +34,13 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { writeLine } from "./cli-io.js";
+import { footprintLine } from "./doctor-disk-words.js";
 import { planFromDisk, runStagingPrune } from "../disk-prune.js";
 import { MANUAL_VAULT_PREFIX, readDiskFootprint, } from "../disk-usage.js";
 import { readRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
 import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
-import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { DEFAULT_LOG_ROTATION_KEEP, orphanedLogArchives, rotateCollectorLogsBestEffort, } from "../log-rotation.js";
 export async function runClean(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
     const now = new Date();
@@ -53,8 +57,9 @@ export async function runClean(command, io) {
     const vaults = command.allCommitted
         ? await vaultsSafeToRemove(paths, footprint.vaults)
         : [];
+    const logArchives = await orphanedLogArchives(paths);
     if (!command.json) {
-        for (const line of cleanLines(footprint, plan, vaults, command)) {
+        for (const line of cleanLines(footprint, plan, vaults, command, logArchives)) {
             writeLine(io.stdout, line);
         }
     }
@@ -67,7 +72,6 @@ export async function runClean(command, io) {
     const pruned = await runStagingPrune(paths, {
         env,
         now,
-        force: true,
         allCommitted: command.allCommitted,
         reclaimTerminal: true,
     });
@@ -86,20 +90,32 @@ export async function runClean(command, io) {
     return pruned.status === "fail" ? 1 : 0;
 }
 /** The bucket table a person reads before anything is deleted. */
-export function cleanLines(footprint, plan, vaults, command) {
+export function cleanLines(footprint, plan, vaults, command, logArchives = []) {
     const staging = footprint.staging;
     const lines = [
         command.dryRun ? "Tower clean (dry run)" : "Tower clean",
         `  staging          ${mb(staging.total_bytes)} MB across ${staging.pack_count} pack(s), ${staging.object_count} file(s)`,
         `  going            ${mb(plan.deleted_bytes + plan.empty_pack_manifest_bytes)} MB, ${plan.delete.length} file(s) — ${command.allCommitted
             ? "every committed copy (--all-committed)"
-            : `committed and past the ${Math.round(plan.retention_ms / 3_600_000)} h retry window`}`,
-        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, still inside the retry window`,
+            : plan.retention_ms > 0
+                ? `committed and past the opted-in ${Math.round(plan.retention_ms / 3_600_000)} h window`
+                : "committed on the server; the source file is still on disk for any retry"}`,
+        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, inside an opted-in retry window (none by default)`,
         `  kept uncommitted ${mb(plan.kept_uncommitted.bytes)} MB, ${plan.kept_uncommitted.count} file(s) — never delivered; retention will never delete these`,
         `  kept unknown     ${mb(plan.kept_unknown.bytes)} MB, ${plan.kept_unknown.count} file(s) — the upload ledger no longer reaches back this far and cannot say`,
-        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))`,
+        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))${logArchives.length > 0
+            ? `; ${logArchives.length} archive(s), ${mb(logArchives.reduce((sum, archive) => sum + archive.byte_size, 0))} MB, sit outside the ${DEFAULT_LOG_ROTATION_KEEP}-archive keep window and go`
+            : ""}`,
         `  spool            ${mb(footprint.spool_bytes)} MB`,
+        `  state files      ${mb(footprint.state.state_bytes)} MB — cursors, indexes and receipts, each bounded`,
     ];
+    if (footprint.state.other_bytes > 0) {
+        lines.push(`  unrecognised     ${mb(footprint.state.other_bytes)} MB across ${footprint.state.other_entries} entr(ies) — counted, never deleted by clean`);
+    }
+    if (footprint.state.study_entries > 0) {
+        lines.push(`  studies          ${footprint.state.study_entries} folder(s) an agent left here — not the collector's, not counted, never touched; new ones go in bli-cockpit-studies`);
+    }
+    lines.push(`  ${footprintLine(footprint)}`);
     for (const vault of footprint.vaults) {
         const removable = vaults.some((entry) => entry.name === vault.name);
         lines.push(`  ${vault.name} ${mb(vault.byte_size)} MB, ${vault.file_count} file(s) — ${removable
@@ -158,6 +174,8 @@ function cleanJson(footprint, plan, vaults, pruned, reconciled = null) {
         },
         rotated_log_bytes: footprint.logs.total_bytes,
         spool_bytes: footprint.spool_bytes,
+        state: footprint.state,
+        last_prune: footprint.last_prune,
         vaults: footprint.vaults,
         plan: {
             delete_count: plan.delete.length,

package/dist/commands/doctor-disk-words.js

@@ -28,9 +28,85 @@ export function redeliveryLine(result) {
     }
     return "the next `cockpit sync` re-offers them";
 }
+/**
+ * Over this, the whole collector footprint is a needs-fix row (BLI-11106).
+ * Delete-on-commit plus the 256 MiB staging cap and the log caps put a healthy
+ * machine far under it; crossing it means something is holding bytes, and the
+ * row names what.
+ */
+export const FOOTPRINT_NEEDS_FIX_BYTES = 512 * 1024 * 1024;
+/**
+ * Every bucket the collector owns, biggest first. Study folders an agent left
+ * under the state dir are not here: they are not the collector's, and no
+ * prune would ever explain them (they belong in `bli-cockpit-studies`).
+ */
+export function footprintBuckets(footprint) {
+    const staging = footprint.staging;
+    const buckets = [
+        { label: "staging, committed (goes on the next tick)", bytes: staging.committed_bytes },
+        {
+            label: "staging, uncommitted (evidence the server has not accepted yet)",
+            bytes: staging.uncommitted_bytes + staging.unknown_bytes,
+        },
+        { label: "staging, refused by the server", bytes: staging.terminal_bytes ?? 0 },
+        { label: "staging, pack manifests", bytes: stagingOverheadBytes(footprint) },
+        { label: "sync logs", bytes: footprint.logs.total_bytes },
+        { label: "collector state files", bytes: footprint.state.state_bytes },
+        { label: "upload spool", bytes: footprint.spool_bytes },
+        { label: "unrecognised files in the state dir", bytes: footprint.state.other_bytes },
+    ];
+    return buckets.filter((bucket) => bucket.bytes > 0).sort((a, b) => b.bytes - a.bytes);
+}
+export function footprintTotalBytes(footprint) {
+    return footprintBuckets(footprint).reduce((sum, bucket) => sum + bucket.bytes, 0);
+}
+/**
+ * The one footprint line doctor and status both print: staging committed /
+ * uncommitted, logs, state, and when the prune last ran and what it freed.
+ */
+export function footprintLine(footprint) {
+    const staging = footprint.staging;
+    const parts = [
+        `footprint ${mib(footprintTotalBytes(footprint))} MB`,
+        `staging ${mib(staging.committed_bytes)} MB committed / ${mib(staging.uncommitted_bytes + staging.unknown_bytes)} MB uncommitted`,
+        `logs ${mib(footprint.logs.total_bytes)} MB`,
+        `state ${mib(footprint.state.state_bytes + footprint.spool_bytes)} MB`,
+    ];
+    if (footprint.state.other_bytes > 0) {
+        parts.push(`unrecognised ${mib(footprint.state.other_bytes)} MB`);
+    }
+    parts.push(lastPrunePhrase(footprint));
+    return parts.join(", ");
+}
+/** `last prune: <when>, freed <n> MB`, plus the last time it freed anything. */
+export function lastPrunePhrase(footprint) {
+    const last = footprint.last_prune;
+    if (!last)
+        return "last prune: never";
+    const base = `last prune: ${minute(last.at)}, freed ${mib(last.freed_bytes)} MB`;
+    if (last.freed_bytes > 0 || !last.last_freed_at)
+        return base;
+    return `${base} (last freed ${mib(last.last_freed_bytes)} MB at ${minute(last.last_freed_at)})`;
+}
+/** The biggest bucket, named, for the needs-fix sentence; null when empty. */
+export function footprintHolder(footprint) {
+    return footprintBuckets(footprint)[0] ?? null;
+}
+function stagingOverheadBytes(footprint) {
+    const staging = footprint.staging;
+    const payload = staging.committed_bytes +
+        staging.uncommitted_bytes +
+        staging.unknown_bytes +
+        (staging.terminal_bytes ?? 0);
+    return Math.max(0, staging.total_bytes - payload);
+}
+function minute(iso) {
+    return iso.length >= 16 ? `${iso.slice(0, 16)}Z` : iso;
+}
 export function diskRowMessage(footprint, capBytes) {
     const staging = footprint.staging;
     const parts = [
+        footprintLine(footprint),
         `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
     ];
     // BLI-3797: "1,916.9 uncommitted" is a number, not a finding. The row now
@@ -51,9 +127,11 @@ export function diskRowMessage(footprint, capBytes) {
     if (staging.unknown_count > 0) {
         parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
     }
-    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
-    for (const vault of footprint.vaults) {
-        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
+    // BLI-11106: study folders an agent left under the state dir are named as a
+    // count, never sized or added to the footprint. They are not the
+    // collector's, and new ones belong in the sibling `bli-cockpit-studies`.
+    if (footprint.state.study_entries > 0) {
+        parts.push(`${footprint.state.study_entries} study folder(s) under the state dir are not counted (new studies go in bli-cockpit-studies beside it)`);
     }
     return parts.join("; ");
 }

package/dist/commands/doctor-pipeline.js

@@ -1,7 +1,5 @@
 import { withDoctorLockWait } from "./doctor-lock-wait.js";
 import { doctorBackfillBudgetSeconds, doctorLockWaitSeconds } from "./doctor-budget.js";
-import fs from "node:fs/promises";
-import path from "node:path";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
@@ -12,7 +10,7 @@ import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
-import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
+import { FOOTPRINT_NEEDS_FIX_BYTES, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
@@ -32,7 +30,6 @@ import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
  * `doctor-pipeline-verdicts.ts`, and every one of them is re-exported from
  * here so callers keep one address.
  */
-const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export async function checkBackfillState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
     const roots = await doctorRoots(context);
@@ -137,18 +134,14 @@ export async function checkGcState(context) {
     if (context.io.env["COCKPIT_DISABLE_GC"] === "1") {
         return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
-    const paths = getCollectorRuntimePaths(context.command.homeDir);
-    const marker = path.join(paths.state_dir, ".last-raw-evidence-gc");
-    const info = await fs.stat(marker).catch(() => null);
-    if (info && Date.now() - info.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
-    }
-    return needsFix("gc-checked", "due", "cleanup is due");
+    // BLI-11106: the GC runs on every sync tick and costs one manifest read per
+    // old pack, so there is no "already ran today" to report; doctor runs it too.
+    return needsFix("gc-checked", "due", "cleanup runs on every sync; running it now");
 }
 export async function fixGcState(context) {
     const result = await runRawEvidenceLocalGc(getCollectorRuntimePaths(context.command.homeDir), context.io.env);
     if (result.skipped) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
+        return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
     if (result.removed_dirs === 0) {
         return ok("gc-checked", "nothing_eligible", rawEvidenceGcSummary(result));
@@ -156,21 +149,47 @@ export async function fixGcState(context) {
     return ok("gc-checked", `removed_${result.removed_dirs}`, rawEvidenceGcSummary(result));
 }
 /**
- * BLI-3619: what Cockpit is holding on this machine, in one line.
+ * BLI-3619 / BLI-11106: what Tower is holding on this machine, in one line.
  *
- * Green means the staging tree fits under the cap. Over the cap is `needs_fix`
- * and the fix is the same prune the tick runs, forced past its daily throttle;
- * if it is still over afterwards, the message names the one command that goes
- * further. Every number here is metadata — byte counts and file counts, never
- * a path.
+ * Green means the staging tree fits under the cap AND the whole collector
+ * footprint (staging, logs, state, spool) is under 512 MB. Either one crossed
+ * is `needs_fix`, and the message names the bucket holding the bytes. The fix
+ * is the same prune the tick runs; if it is still over afterwards, the message
+ * names the one command that goes further. Every number here is metadata —
+ * byte counts and file counts, never a path.
  */
 export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
-    return footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes
-        ? needsFix("disk-bounded", "over_staging_cap", message)
-        : ok("disk-bounded", "within_staging_cap", message);
+    if (footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes) {
+        return needsFix("disk-bounded", "over_staging_cap", message);
+    }
+    const over = footprintOverSentence(footprint);
+    if (over)
+        return needsFix("disk-bounded", "footprint_over_512mb", `${over}; ${message}`);
+    return ok("disk-bounded", "within_staging_cap", message);
+}
+/**
+ * "812.0 MB held, over the 512 MB line; most of it is sync logs (600.0 MB)",
+ * or null when the footprint is under the line. Logged either way, because a
+ * row that only speaks when it is red cannot say the check ran.
+ */
+export function footprintOverSentence(footprint) {
+    const total = footprintTotalBytes(footprint);
+    const holder = footprintHolder(footprint);
+    const over = total > FOOTPRINT_NEEDS_FIX_BYTES;
+    console.error("[cockpit-doctor] collector footprint", JSON.stringify({
+        reason: over ? "footprint_over_512mb" : "footprint_within_512mb",
+        total_bytes: total,
+        limit_bytes: FOOTPRINT_NEEDS_FIX_BYTES,
+        holder: holder?.label ?? null,
+        holder_bytes: holder?.bytes ?? 0,
+        study_entries_not_counted: footprint.state.study_entries,
+    }));
+    if (!over)
+        return null;
+    return `${mib(total)} MB held, over the ${mib(FOOTPRINT_NEEDS_FIX_BYTES)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -188,7 +207,6 @@ export async function fixDiskState(context) {
     const redelivered = redeliveryLine(redelivery);
     const pruned = await runStagingPrune(paths, {
         env: context.io.env,
-        force: true,
     });
     if (pruned.status === "fail") {
         return fail("disk-bounded", pruned.reason, "the prune could not run; nothing was deleted");
@@ -198,6 +216,10 @@ export async function fixDiskState(context) {
     }
     const footprint = await readDiskFootprint(paths);
     const message = diskRowMessage(footprint, pruned.cap_bytes);
+    const over = pruned.cap_blocked_by_uncommitted ? null : footprintOverSentence(footprint);
+    if (over) {
+        return needsFix("disk-bounded", "footprint_over_512mb", `freed ${mib(pruned.deleted_bytes)} MB; ${over}; ${message}`);
+    }
     if (!pruned.cap_blocked_by_uncommitted) {
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }

package/dist/commands/heartbeat.js

@@ -133,7 +133,7 @@ export function buildCollectorHeartbeat(options) {
  * that a green, syncing, up-to-date laptop was sitting on 1.8 GB of evidence the
  * server had never received, and a fleet-wide failure nobody can see is the
  * BLI-2528 shape exactly. The walk is bounded by the pack tree the prune keeps
- * under a 2 GB cap, and it is best-effort: a read that fails returns nulls and
+ * under a 256 MiB cap, and it is best-effort: a read that fails returns nulls and
  * says so, so the heartbeat omits both fields rather than claiming zero.
  */
 export async function readHeartbeatStagingFacts(options) {

package/dist/commands/local-help-commands.js

@@ -348,11 +348,11 @@ export function localSubcommandHelp(command) {
                 "Usage: cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
                 "",
                 "Reclaims this machine's disk. Prints what it would delete and why, per bucket,",
-                "then deletes: staged evidence Tower has already accepted goes after a 48-hour",
-                "retry window, and anything the upload ledger has NOT vouched for is kept,",
+                "then deletes: a staged copy Tower has already accepted goes (a retry re-reads",
+                "the source file), and anything the upload ledger has NOT vouched for is kept,",
                 "counted and named — retention never deletes undelivered evidence.",
-                "--dry-run stops after the printing. --all-committed drops the retry window,",
-                "so every already-accepted copy goes now, and is the only thing that removes a",
+                "--dry-run stops after the printing. --all-committed drops any retry window set",
+                "with COCKPIT_STAGING_RETENTION_HOURS, so every already-accepted copy goes now, and is the only thing that removes a",
                 "manual-study-evidence-vault folder (and only when every file in it is accepted).",
                 "--reconcile asks Tower's own upload ledger about every object this machine's",
                 "local memory can no longer classify (\"unknown\") before the buckets print — a",
@@ -361,9 +361,9 @@ export function localSubcommandHelp(command) {
                 "object instead of \"unknown\". A server failure never blocks the rest of clean",
                 "and is printed on its own line. Combine with --dry-run to ask and print",
                 "without deleting.",
-                "The scheduled sync does the same prune once a day (reconciling one batch first",
-                "when there is anything unknown); this is the door for a laptop that is full",
-                "right now.",
+                "The scheduled sync does the same prune on every tick (reconciling one batch first",
+                "when there is anything unknown); this is the door for \"show me\" and for a",
+                "laptop that has been off.",
             ],
         ],
         [

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.154");
+    writeLine(io?.stdout ?? process.stdout, "0.2.155");
     return 0;
   }
 

package/dist/commands/status-disk-line.js

@@ -0,0 +1,22 @@
+/**
+ * `cockpit status`'s `Disk:` line (BLI-11106): the same footprint line
+ * `cockpit doctor`'s disk row opens with, so a person who pastes `status` into
+ * Slack also pastes what the collector holds on disk and when it last cleaned
+ * up. Human output only; `status --json` is unchanged. Split out of
+ * `status.ts` to keep that file under the readability ratchet.
+ */
+import { footprintLine } from "./doctor-disk-words.js";
+import { readDiskFootprint } from "../disk-usage.js";
+import { describeError } from "../health-detail.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+/** Never throws: an unreadable footprint is a named line, not a failed status. */
+export async function statusDiskLine(homeDir) {
+    try {
+        const footprint = await readDiskFootprint(getCollectorRuntimePaths(homeDir));
+        return `Disk: ${footprintLine(footprint)}`;
+    }
+    catch (error) {
+        console.error("[cockpit-status] could not read the disk footprint", JSON.stringify({ reason: "footprint_read_failed", ...describeError(error) }));
+        return "Disk: could not be read (footprint_read_failed)";
+    }
+}

package/dist/commands/status.js

@@ -22,6 +22,7 @@ import { displayTicketId, displayWorkLabel, shortSha, stuckEvidenceLine, } from
 import { discoverCommandWorktrees } from "./local-discovery.js";
 import { refreshSetupReceipt } from "./setup-receipt.js";
 import { setupReceiptBlock } from "./setup-receipt-lines.js";
+import { statusDiskLine } from "./status-disk-line.js";
 import { defaultCodexSessionDirs } from "../adapters/codex-attribution.js";
 import { describeError } from "../health-detail.js";
 import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
@@ -77,6 +78,7 @@ async function writeMultiRepoStatus(command, io, backfillCursor, setupReceipt, w
         return writeMultiRepoJson(io, backfillCursor, setupReceipt, statuses);
     writeLine(io.stdout, "Tower status — every repo below this folder");
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
+    writeLine(io.stdout, await statusDiskLine(command.homeDir));
     for (const status of statuses) {
         writeLine(io.stdout, `- ${status.repo_label ?? status.repo}/${status.worktree_label ?? "worktree"} · ${status.branch} · head:${shortSha(status.head_sha)} · ${status.upload_state}`);
     }
@@ -108,14 +110,14 @@ async function writeSingleRepoStatus(command, io, backfillCursor, setupReceipt)
     });
     if (command.json)
         return writeSingleRepoJson(io, status, backfillCursor, setupReceipt);
-    writeSingleRepoLines(io, status, backfillCursor, setupReceipt);
+    writeSingleRepoLines(io, status, backfillCursor, setupReceipt, await statusDiskLine(command.homeDir));
     return 0;
 }
 function writeSingleRepoJson(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, JSON.stringify({ ...status, backfill_cursor: backfillCursor, setup_receipt: setupReceipt?.receipt ?? null }, null, 2));
     return 0;
 }
-function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
+function writeSingleRepoLines(io, status, backfillCursor, setupReceipt, disk) {
     writeLine(io.stdout, "Tower status");
     writeLine(io.stdout, `Installed: ${status.installed ? "yes" : "no"}`);
     writeLine(io.stdout, `Signed in: ${signedInLine(status.session_state)}`);
@@ -142,6 +144,7 @@ function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, `Last health note problem: ${status.last_health_receipt_failure_reason ?? "none"}`);
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
     writeLine(io.stdout, `Stuck files: ${stuckEvidenceLine(status)}`);
+    writeLine(io.stdout, disk);
     for (const detail of status.details)
         writeLine(io.stdout, `- ${detail}`);
     writeConnectedBlock(io, setupReceipt);

package/dist/commands/sync-followups-staging.js

@@ -10,9 +10,11 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * laptop forever.
  *
  * Same shape as the memory install beside it and for the same reasons: it runs
- * only once collection's own outcome is decided and reported, at most once a
- * day, it cannot throw, and its outcome is its own named receipt rather than a
- * sync failure. A machine that cannot prune is a machine short of disk, and
+ * only once collection's own outcome is decided and reported, it cannot throw,
+ * and its outcome is its own named receipt rather than a sync failure. Unlike
+ * the memory install it runs on EVERY tick (BLI-11106): the upload above has
+ * just recorded which objects the server committed, and their staged copies
+ * go in this same tick rather than a day or two later. A machine that cannot prune is a machine short of disk, and
  * that must never also be a machine that stops collecting.
  *
  * The rule itself is `disk-retention.ts`: only objects the upload ledger
@@ -24,7 +26,7 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * ledger's own memory is capped, so a laptop that keeps accumulating
  * `unknown` state needs SOMETHING asking the server on a schedule, not only
  * when a person happens to type `cockpit clean --reconcile`. One batch a tick
- * is not throttled to once a day like the prune below — an `unknown` backlog
+ * is bounded to one batch rather than drained whole — an `unknown` backlog
  * drains at up to 500 hashes/15 min, and the ordinary case (nothing unknown)
  * costs one cheap local read and no network call at all, so it never competes
  * with collection for the tick's time. A reconcile failure never blocks the
@@ -59,9 +61,10 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
             detail: redactedSyncErrorDetail(error),
         }));
     }
-    // The daily throttle is the steady state — reporting it would post a receipt
-    // on 95 of every 96 ticks for no new information.
-    if (result.reason !== "throttled_recent_run") {
+    // A tick with nothing to prune is the steady state: `[collector prune]`
+    // already logged it locally with the bytes scanned, and posting a receipt on
+    // 95 of every 96 ticks would say nothing new.
+    if (result.reason !== "nothing_to_prune") {
         events.push(stagingPruneEvent(result));
     }
     if (events.length === 0)
@@ -78,8 +81,8 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
 /**
  * Never throws (`runEvidenceReconcile` already never does); returns `null`
  * for the boring, common case — nothing this tick was `unknown` — so that
- * case costs no receipt either, the same rule the prune's own daily throttle
- * follows above.
+ * case costs no receipt either, the same rule the prune's own
+ * `nothing_to_prune` follows above.
  */
 async function runReconcileFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceReconcile({
@@ -102,7 +105,7 @@ async function runReconcileFollowUp(command, io, dashboardUrl, options) {
  * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
  * the boring, common case — nothing on this disk is undelivered — so the steady
  * state costs no receipt, the same rule the reconcile follow-up above and the
- * prune's daily throttle below both follow.
+ * prune's `nothing_to_prune` below both follow.
  */
 async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceRedelivery({

package/dist/commands/sync.js

@@ -24,8 +24,10 @@
  *
  * Both arms below do the same things in the same order, because a tick that
  * THREW is still a tick a machine survived and the fleet has to be able to tell
- * that from silence (BLI-3551). The one difference is the staging prune, which
- * the throwing arm has never run.
+ * that from silence (BLI-3551). Both arms also run the staging prune: a tick
+ * that threw after uploading still leaves committed copies the prune may take,
+ * and waiting for the next clean tick is how a sick machine fills its disk
+ * (BLI-11106).
  *
  * Split out of commands/local.ts (BLI-3578), then into the siblings above
  * (BLI-3982). The scan and upload engine underneath is `./session-sync.ts`;
@@ -78,8 +80,8 @@ export async function runSync(command, io) {
         await sendSyncHeartbeat(command, io, dashboardUrl, result.heartbeat);
         await reportTickOutcome(command, io, dashboardUrl, result.completion);
         await convergeAfterTick(command, io, dashboardUrl);
-        // BLI-3619: and the disk stops growing without bound — same daily cadence,
-        // same rule that a follow-up never blocks or fails collection.
+        // BLI-3619 / BLI-11106: every tick, the staged copies of whatever the
+        // server just committed go; a follow-up never blocks or fails collection.
         await runStagingPruneAfterSync(command, io, dashboardUrl);
         return result.exitCode;
     }
@@ -94,6 +96,7 @@ export async function runSync(command, io) {
         });
         await reportTickThrew(command, io, dashboardUrl, error, errorCode);
         await convergeAfterTick(command, io, dashboardUrl);
+        await runStagingPruneAfterSync(command, io, dashboardUrl);
         throw error;
     }
 }

package/dist/disk-prune.js

@@ -15,19 +15,25 @@
  *   evidence that the drain is still running at all (the BLI-2528 lesson: what
  *   only speaks on failure cannot answer "did anything work today?").
  *
- * Throttled to once a day by a marker file, the same idiom the raw-evidence GC,
- * the scheduled self-update and the BLI Memory install use. Walking a pack tree
- * is cheap; doing it every fifteen minutes for a decision that changes on the
- * scale of hours is not.
+ * Runs on EVERY tick (BLI-11106). It used to sit behind a once-a-day marker
+ * file, and that is how 534 MB of committed, past-window copies were still on
+ * the reference Mac when it was measured: the drain existed and had not run
+ * yet. The inventory reads each pack's small `manifest.json` rather than its
+ * payload, so a tick with nothing to delete costs one directory walk and logs
+ * `nothing_to_prune` with the bytes it scanned. `COCKPIT_DISABLE_GC=1` is the
+ * only off switch.
+ *
+ * Every non-dry run leaves `last-prune.json` (one small object, overwritten)
+ * so `cockpit doctor` and `cockpit status` can say when it last ran and what
+ * it freed without re-running it.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
 import { planStagingRetention, retentionOptionsFromEnv, } from "./disk-retention.js";
 import { RAW_EVIDENCE_DIR, readStagingInventory } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
+import { writeLastPruneReceipt } from "./prune-receipt.js";
 import { readRawEvidenceStagingState, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
-export const STAGING_PRUNE_THROTTLE_MARKER = ".last-staging-prune";
-export const STAGING_PRUNE_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 /**
  * The prune the sync tick runs and `cockpit clean` / `cockpit doctor` reuse.
  * Never throws.
@@ -38,17 +44,14 @@ export async function runStagingPrune(paths, options = {}) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
         return skippedResult("disabled");
     }
-    if (!options.force && (await prunedRecently(paths, now))) {
-        return skippedResult("throttled_recent_run");
-    }
     try {
-        if (!options.dryRun && !options.force)
-            await markPruned(paths, now);
         const plan = await planFromDisk(paths, env, options, now);
         const result = options.dryRun
             ? dryRunResult(plan)
             : await applyPlan(paths, plan);
         reportPrune(result, { dryRun: Boolean(options.dryRun) });
+        if (!options.dryRun)
+            await writeLastPruneReceipt(paths, result, now);
         return result;
     }
     catch (error) {
@@ -75,7 +78,7 @@ async function applyPlan(paths, plan) {
     return {
         ...dryRunResult(plan),
         status: "ok",
-        reason: tally.files > 0 ? "pruned" : "nothing_eligible",
+        reason: tally.files > 0 || tally.packs > 0 ? "pruned" : "nothing_to_prune",
         deleted_files: tally.files,
         deleted_bytes: tally.bytes,
         removed_packs: tally.packs,
@@ -166,7 +169,9 @@ async function forgetStagedObjects(paths, hashes) {
 function dryRunResult(plan) {
     return {
         status: "ok",
-        reason: plan.delete.length > 0 ? "would_prune" : "nothing_eligible",
+        reason: plan.delete.length > 0 || plan.empty_packs.length > 0
+            ? "would_prune"
+            : "nothing_to_prune",
         deleted_files: plan.delete.length,
         deleted_bytes: plan.deleted_bytes + plan.empty_pack_manifest_bytes,
         removed_packs: plan.empty_packs.length,
@@ -221,6 +226,7 @@ export function reportPrune(result, options = { dryRun: false }) {
         kept_unknown: result.kept_unknown,
         kept_in_window: result.kept_in_window,
         cap_bytes: result.cap_bytes,
+        bytes_scanned: result.bytes_before,
         bytes_after: result.bytes_after,
         failed_deletions: result.failed_deletions,
     }));
@@ -234,14 +240,4 @@ export function reportPrune(result, options = { dryRun: false }) {
         cap_bytes: result.cap_bytes,
         bytes_after: result.bytes_after,
     }));
-}
-async function prunedRecently(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    const info = await fs.stat(marker).catch(() => null);
-    return Boolean(info && now.getTime() - info.mtimeMs < STAGING_PRUNE_MIN_INTERVAL_MS);
-}
-async function markPruned(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
-    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
 }

package/dist/disk-retention.js

@@ -1,7 +1,10 @@
-/** How long a committed spare is kept so a retry still has local bytes. */
-export const DEFAULT_STAGING_RETENTION_MS = 48 * 60 * 60 * 1000;
+/**
+ * How long a committed spare is kept: zero (BLI-11106). A retry re-reads the
+ * source file, so the staged copy of a committed object is pure duplication.
+ */
+export const DEFAULT_STAGING_RETENTION_MS = 0;
 /** Ceiling on everything under `raw-evidence`, manifests included. */
-export const DEFAULT_STAGING_CAP_BYTES = 2 * 1024 * 1024 * 1024;
+export const DEFAULT_STAGING_CAP_BYTES = 256 * 1024 * 1024;
 /** Local knobs, read from the environment like `COCKPIT_DISABLE_GC`. */
 export const STAGING_CAP_ENV = "COCKPIT_STAGING_CAP_BYTES";
 export const STAGING_RETENTION_ENV = "COCKPIT_STAGING_RETENTION_HOURS";
@@ -33,7 +36,7 @@ export function planStagingRetention(inventory, options = {}) {
                 continue;
             }
             if (options.allCommitted || object.age_ms >= retentionMs) {
-                pushDeletion(plan, object, "committed_past_retry_window");
+                pushDeletion(plan, object, "committed_on_server");
                 continue;
             }
             committedInWindow.push(object);
@@ -61,11 +64,11 @@ export function planStagingRetention(inventory, options = {}) {
  * safe elsewhere.
  *
  * It does not run at all when the floor is already above the cap. That branch
- * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging is
- * evidence no ledger vouches for, against a 2 GB cap, so spending the retry
- * window on 1,027 committed spares would have deleted a day of local retry
- * copies and still ended over the cap. The cap takes a spare only when taking
- * it can actually get this machine under the cap.
+ * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging was
+ * evidence no ledger vouched for, against the cap of the day. With the default
+ * zero window it rarely matters (committed spares are already gone); it keeps
+ * an opted-in window honest by taking a spare only when that can actually get
+ * this machine under the cap.
  */
 function applyByteCap(plan, committedInWindow, capBytes, inventory) {
     let projected = plan.bytes_before - plan.deleted_bytes;

package/dist/disk-usage-footprint.js

@@ -1,9 +1,11 @@
 /**
- * The whole-machine read: staging, rotated logs, the spool, and the vaults a
- * person made by hand — the four places Cockpit ever writes bytes on a laptop.
+ * The whole-machine read: staging, rotated logs, the spool, the vaults a
+ * person made by hand, and (BLI-11106) the rest of the state directory plus
+ * the last prune's receipt.
  *
- * The staging half is the rest of this family; what lives here is the other
- * three and the one function that puts all four together.
+ * The staging half is the rest of this family; the state-dir audit is
+ * `state-dir-audit.ts` and the receipt `prune-receipt.ts`. What lives here is
+ * the one function that puts them together.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -11,6 +13,8 @@ import { MANUAL_VAULT_PREFIX, } from "./disk-usage-facts.js";
 import { directoryBytes, listPackFiles } from "./disk-usage-files.js";
 import { readStagingInventory } from "./disk-usage-scan.js";
 import { rotatedLogFootprint } from "./log-rotation.js";
+import { readLastPruneReceipt } from "./prune-receipt.js";
+import { readStateDirFootprint } from "./state-dir-audit.js";
 /**
  * Everything on this machine Cockpit put there, in one read. Used by the sync
  * tick's prune, by `cockpit clean` and by `cockpit doctor`'s disk row, so all
@@ -22,6 +26,8 @@ export async function readDiskFootprint(paths, now = new Date()) {
         logs: await rotatedLogFootprint(paths),
         spool_bytes: await directoryBytes(paths.spool_dir),
         vaults: await readManualVaults(paths),
+        state: await readStateDirFootprint(paths),
+        last_prune: await readLastPruneReceipt(paths),
     };
 }
 /** The hand-made vaults: counted and named so nothing deletes them silently. */

package/dist/evidence-reconcile-client.js

@@ -35,8 +35,8 @@ export async function runEvidenceReconcile(options) {
         if (hashes.length === 0) {
             // No stderr line here on purpose: the sync tick calls this every 15
             // minutes and the steady state is "nothing unknown" — logging that
-            // every tick forever is exactly the receipt-on-95-of-96-ticks spam the
-            // daily prune throttle exists to avoid. `cockpit clean --reconcile`
+            // every tick forever is exactly the receipt-on-95-of-96-ticks spam that
+            // the follow-ups skip on their `nothing_*` reasons. `cockpit clean --reconcile`
             // still tells a person this on stdout (`reconcileLines` in clean.ts).
             return emptyResult("nothing_unknown");
         }

package/dist/log-rotation.js

@@ -37,9 +37,16 @@ import path from "node:path";
  * of a file operators can read. The tail is capped rather than copied whole, so
  * the archives cannot themselves become the disk problem — worst case on disk
  * is (keep + 1) x maxBytes per stream.
+ *
+ * BLI-11106 tightened the numbers: at most 2 archives and 20 MB of archive per
+ * stream (2 x 10 MiB), so both streams together never pass 60 MiB, live logs
+ * included. It was 3 x 20 MiB per stream (160 MiB worst case) and the
+ * reference Mac held 147 MB of it on 2026-09-30. An archive above the new keep
+ * window (`sync.log.3` on every machine that ran the old numbers) is swept on
+ * the first tick by `sweepOrphanedLogArchives` below.
  */
-export const DEFAULT_LOG_ROTATION_MAX_BYTES = 20 * 1024 * 1024;
-export const DEFAULT_LOG_ROTATION_KEEP = 3;
+export const DEFAULT_LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
+export const DEFAULT_LOG_ROTATION_KEEP = 2;
 /** The two files launchd writes for the scheduled tick. */
 export const ROTATED_LOG_NAMES = ["sync.log", "sync.err.log"];
 /**
@@ -129,27 +136,41 @@ async function rotateOne(filePath, maxBytes, keep) {
  * sentences and an operator is owed the second one.
  */
 export async function sweepOrphanedLogArchives(paths, options) {
+    const swept = [];
+    for (const archive of await orphanedLogArchives(paths, options)) {
+        const removed = await fs
+            .rm(path.join(paths.state_dir, archive.name), { force: true })
+            .then(() => true, () => false);
+        if (removed)
+            swept.push(archive);
+    }
+    return swept;
+}
+/**
+ * The archives the sweep above WOULD remove, without removing them — what
+ * `cockpit clean --dry-run` prints (BLI-11106). Same rule, one reader.
+ */
+export async function orphanedLogArchives(paths, options = {
+    keep: DEFAULT_LOG_ROTATION_KEEP,
+    names: ROTATED_LOG_NAMES,
+}) {
     const entries = await fs
         .readdir(paths.state_dir, { withFileTypes: true })
         .catch(() => []);
-    const swept = [];
+    const found = [];
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
         const reason = orphanArchiveReason(entry.name, options);
         if (!reason)
             continue;
-        const file = path.join(paths.state_dir, entry.name);
         const size = await fs
-            .stat(file)
+            .stat(path.join(paths.state_dir, entry.name))
             .then((info) => info.size)
             .catch(() => 0);
-        const removed = await fs.rm(file, { force: true }).then(() => true, () => false);
-        if (!removed)
-            continue;
-        swept.push({ name: entry.name, byte_size: size, reason });
+        found.push({ name: entry.name, byte_size: size, reason });
     }
-    return swept;
+    return found;
 }
 /**
  * Which stream this file belongs to and why it is outside the keep window, or

package/dist/prune-receipt.js

@@ -0,0 +1,87 @@
+/**
+ * `last-prune.json`: when the staging prune last ran and what it freed
+ * (BLI-11106).
+ *
+ * The prune runs on every sync tick, so "did it run?" is answered by a file it
+ * overwrites, never by a file that grows. One small JSON object, bounded by
+ * construction. `cockpit doctor` and `cockpit status` read it for the
+ * footprint line ("last prune: <when>, freed <n> MB") without re-running the
+ * prune themselves.
+ *
+ * It also carries the last time a prune actually freed something, because on
+ * a healthy machine the newest run is usually `nothing_to_prune` and "freed
+ * 0 MB" on its own cannot tell a working drain from a stuck one.
+ *
+ * The old once-a-day throttle marker is removed on the first write: it gates
+ * nothing any more, and a file that gates nothing is exactly the kind of
+ * leftover this ticket exists to stop.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describeError } from "./health-detail.js";
+export const LAST_PRUNE_FILE = "last-prune.json";
+/** The retired daily throttle marker; deleted on sight. */
+export const LEGACY_STAGING_PRUNE_MARKER = ".last-staging-prune";
+export async function readLastPruneReceipt(paths) {
+    const raw = await fs
+        .readFile(path.join(paths.state_dir, LAST_PRUNE_FILE), "utf8")
+        .catch(() => null);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.at !== "string" || typeof parsed.reason !== "string") {
+            return null;
+        }
+        return {
+            at: parsed.at,
+            reason: parsed.reason,
+            freed_bytes: numberOr0(parsed.freed_bytes),
+            deleted_files: numberOr0(parsed.deleted_files),
+            bytes_scanned: numberOr0(parsed.bytes_scanned),
+            bytes_after: numberOr0(parsed.bytes_after),
+            last_freed_at: typeof parsed.last_freed_at === "string" ? parsed.last_freed_at : null,
+            last_freed_bytes: numberOr0(parsed.last_freed_bytes),
+        };
+    }
+    catch {
+        // A torn or hand-edited receipt reads as "never ran"; the next tick
+        // overwrites it. Doctor prints "last prune: never" rather than guessing.
+        return null;
+    }
+}
+/** Never throws: a receipt that cannot be written is a log line, not a failed tick. */
+export async function writeLastPruneReceipt(paths, result, now) {
+    try {
+        const previous = await readLastPruneReceipt(paths);
+        const freed = result.deleted_bytes > 0;
+        const receipt = {
+            at: now.toISOString(),
+            reason: result.reason,
+            freed_bytes: result.deleted_bytes,
+            deleted_files: result.deleted_files,
+            bytes_scanned: result.bytes_before,
+            bytes_after: result.bytes_after,
+            last_freed_at: freed ? now.toISOString() : (previous?.last_freed_at ?? null),
+            last_freed_bytes: freed
+                ? result.deleted_bytes
+                : (previous?.last_freed_bytes ?? 0),
+        };
+        await fs.mkdir(paths.state_dir, { recursive: true });
+        const file = path.join(paths.state_dir, LAST_PRUNE_FILE);
+        const temp = `${file}.${process.pid}.tmp`;
+        await fs.writeFile(temp, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        await fs.rename(temp, file);
+        await fs
+            .rm(path.join(paths.state_dir, LEGACY_STAGING_PRUNE_MARKER), { force: true })
+            .catch(() => undefined);
+    }
+    catch (error) {
+        console.error("[collector prune] could not record the last-prune receipt", JSON.stringify({ reason: "last_prune_write_failed", ...describeError(error) }));
+    }
+}
+function numberOr0(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0
+        ? value
+        : 0;
+}

package/dist/raw-evidence-gc.js

@@ -10,27 +10,33 @@ const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
  * observed on the fleet is minutes, not hours.
  */
 const STAGING_ORPHAN_MS = 6 * 60 * 60 * 1000;
-// GC hashes every file in every old-but-kept dir to confirm uploads. Running
-// that on each 15-min sync would re-read the same gigabytes ~96x/day on
-// machines with unconfirmed evidence, so GC is throttled to once per day.
-const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/**
+ * The retired once-a-day throttle marker (BLI-11106). The GC runs every tick
+ * now, and deletes this file on sight so it stops being state nobody reads.
+ *
+ * Why every tick is affordable: the GC used to hash every file of every old
+ * pack to confirm it was uploaded, which re-read gigabytes on a machine with
+ * unconfirmed evidence. It now asks the pack's own `manifest.json` first, and a
+ * pack whose manifest names ANY hash the ledger has not committed is skipped
+ * without reading a payload byte. Only a pack the manifest says is fully
+ * committed is hashed, once, on the way to being deleted.
+ */
+export const LEGACY_GC_THROTTLE_MARKER = ".last-raw-evidence-gc";
 export async function runRawEvidenceLocalGc(paths, env = process.env, now = new Date()) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
         return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
     }
-    const throttleMarker = path.join(paths.state_dir, ".last-raw-evidence-gc");
-    const lastRun = await fs.stat(throttleMarker).catch(() => null);
-    if (lastRun && now.getTime() - lastRun.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return { skipped: true, removed_dirs: 0, freed_bytes: 0 };
-    }
-    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
-    await fs.writeFile(throttleMarker, now.toISOString()).catch(() => undefined);
+    await fs
+        .rm(path.join(paths.state_dir, LEGACY_GC_THROTTLE_MARKER), { force: true })
+        .catch(() => undefined);
     const cursor = await readRawEvidenceCursor(paths);
     const uploadedHashes = new Set(Object.keys(cursor.objects));
     const rawEvidenceRoot = path.join(paths.state_dir, "raw-evidence");
     const entries = await fs.readdir(rawEvidenceRoot, { withFileTypes: true }).catch(() => []);
     let removedDirs = 0;
     let freedBytes = 0;
+    let scannedDirs = 0;
+    let skippedByManifest = 0;
     for (const entry of entries) {
         if (!entry.isDirectory() || !entry.name.startsWith("work-"))
             continue;
@@ -40,6 +46,11 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
             continue;
         if (now.getTime() - dirStats.mtimeMs < RAW_EVIDENCE_RETENTION_MS)
             continue;
+        scannedDirs += 1;
+        if (await manifestNamesUncommitted(dir, uploadedHashes)) {
+            skippedByManifest += 1;
+            continue;
+        }
         const inspection = await inspectRawEvidenceDirForGc(dir, uploadedHashes);
         if (!inspection.deletable)
             continue;
@@ -50,12 +61,18 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
         freedBytes += inspection.byteSize;
     }
     // Log capping used to live here, and that is why it did not work: this GC
-    // is throttled to once a day and skipped entirely by COCKPIT_DISABLE_GC,
+    // was throttled to once a day and is skipped entirely by COCKPIT_DISABLE_GC,
     // while sync.log grows ~8 MB an hour on an active machine (measured on the
     // reference Mac, 2026-09-04: 219,866,695 bytes with the last GC 19 hours
-    // earlier). A daily truncate-to-zero of a file that reaches ~190 MB a day is
-    // not a cap, and sync.err.log had no cap at all. One owner now, running in
-    // the tick preamble: log-rotation.ts (BLI-3553).
+    // earlier). One owner now, running in the tick preamble: log-rotation.ts
+    // (BLI-3553).
+    console.error("[raw-evidence] gc sweep", JSON.stringify({
+        reason: removedDirs > 0 ? "gc_removed" : "nothing_to_prune",
+        scanned_dirs: scannedDirs,
+        skipped_by_manifest: skippedByManifest,
+        removed_dirs: removedDirs,
+        freed_bytes: freedBytes,
+    }));
     return {
         skipped: false,
         removed_dirs: removedDirs,
@@ -241,6 +258,29 @@ async function dirByteSize(dir) {
     }
     return total;
 }
+/**
+ * True when the pack's own manifest names a content hash the ledger has not
+ * committed, so the pack cannot be deleted and no payload needs reading. A
+ * missing or unreadable manifest answers false and falls through to the full
+ * hash check, which is the old, conservative path.
+ */
+async function manifestNamesUncommitted(dir, uploadedHashes) {
+    const manifest = await fs
+        .readFile(path.join(dir, "manifest.json"), "utf8")
+        .catch(() => null);
+    if (!manifest)
+        return false;
+    try {
+        const parsed = JSON.parse(manifest);
+        return (parsed.files ?? []).some((file) => typeof file.content_hash_sha256 === "string" &&
+            !uploadedHashes.has(file.content_hash_sha256));
+    }
+    catch {
+        // Not silent in effect: an unparseable manifest falls through to the full
+        // per-file hash check below, which decides on the bytes themselves.
+        return false;
+    }
+}
 async function inspectRawEvidenceDirForGc(dir, uploadedHashes) {
     const files = await listFiles(dir).catch(() => null);
     if (!files)

package/dist/state-dir-audit.js

@@ -0,0 +1,138 @@
+/**
+ * Everything the collector's state directory holds, sorted into who owns it
+ * and what bounds it (BLI-11106).
+ *
+ * `~/.local/state/bli-cockpit` (Windows: `%USERPROFILE%\.local\state\bli-cockpit`,
+ * the same layout with backslashes) is where the collector keeps its state.
+ * By 2026-09-30 it also held a gigabyte of study artifacts written by agents
+ * running benches and experiments (`memory-bench`, `memory-extract-*`,
+ * `chat-model-bench`, …). Those are not the collector's, the collector never
+ * reads them, and counting them as its footprint made `cockpit doctor`
+ * alarm about bytes no prune could ever explain.
+ *
+ * The rule: study artifacts belong in the SIBLING root
+ * `~/.local/state/bli-cockpit-studies` (same parent, same layout on Windows),
+ * see `studiesStateDir`. Existing study folders already under the state dir are
+ * recognised by name, left exactly where they are, and not counted. Anything
+ * the table below does not recognise is counted as `other`, so a new
+ * collector file that nobody registered still shows up in the footprint
+ * rather than hiding.
+ *
+ * Every collector entry carries the one-line reason it is bounded; the
+ * runbook (`docs/runbooks/cockpit-launchd-sync.md`, "What the state
+ * directory holds") prints the same table. Metadata only: entry names are
+ * fixed strings, never a person's path.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { directoryBytes } from "./disk-usage-files.js";
+/** The sibling root where agent-written studies live, never under the collector. */
+export const STUDIES_DIR_SUFFIX = "-studies";
+/**
+ * The collector's own entries first (checked before the study prefixes), then
+ * the studies. Order matters only where a study prefix could shadow a
+ * collector name; none does today, and the test pins that.
+ */
+export const STATE_DIR_RULES = [
+    { name: "raw-evidence", match: "exact", class: "staging", bound: "staged copies go the tick the server commits them; 256 MiB cap; uncommitted evidence is never deleted, only counted" },
+    { name: "sync.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },
+    { name: "sync.err.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },
+    { name: "spool", match: "exact", class: "spool", bound: "upload queue; each entry is deleted once the ingest door accepts it" },
+    { name: "cursors", match: "exact", class: "state", bound: "raw-evidence ledger and reconcile answers capped at 5,000 rows each; backfill cursors one small file each" },
+    { name: "raw-evidence-staging.json", match: "exact", class: "state", bound: "staged-object index and delivery attempts capped at 5,000 rows each" },
+    { name: "work-contexts", match: "exact", class: "state", bound: "one small file per worktree ever bound with `cockpit start`; overwritten, not pruned (a few KB each)" },
+    { name: "active-work-context.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "root-work-scan.json", match: "exact", class: "state", bound: "one file, overwritten by each root scan" },
+    { name: "setup-receipt.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "memory-install-receipt.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "last-prune.json", match: "exact", class: "state", bound: "one file, overwritten every tick" },
+    { name: "last-turn-trace.json", match: "exact", class: "state", bound: "one file, overwritten" },
+    { name: "sync.lock", match: "exact", class: "state", bound: "lock file, removed when the tick ends" },
+    { name: "backfill.lock", match: "exact", class: "state", bound: "lock file, removed when the backfill ends" },
+    { name: ".last-", match: "prefix", class: "state", bound: "24-byte throttle markers for self-update, autostart repair and the memory install" },
+    { name: "read-cache", match: "exact", class: "state", bound: "one response file per distinct Tower read, overwritten on refresh" },
+    { name: "memory-hook-stats.json", match: "exact", class: "state", bound: "fixed-size histograms, overwritten (BLI Memory hooks)" },
+    { name: "memory-hook-samples", match: "exact", class: "state", bound: "hourly content-free timing samples (BLI Memory hooks); not yet pruned, a few MB a week" },
+    { name: "memory-recall-seen", match: "exact", class: "state", bound: "one file per agent session, deleted after 7 days (BLI Memory hooks)" },
+    { name: "memory-stop-anchors.json", match: "exact", class: "state", bound: "one offset per transcript, overwritten (BLI Memory hooks)" },
+    { name: "memory-daemon-spawn.json", match: "exact", class: "state", bound: "one spawn stamp, overwritten (BLI Memory daemon)" },
+    { name: "memory-daemon.sock", match: "exact", class: "state", bound: "the daemon's socket, zero bytes" },
+    // Studies written by agents and scripts, not by the collector. Counted by
+    // name only, never sized, never deleted.
+    { name: "memory-bench", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-extract-", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-questions", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-hook-context-sweep", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-anchor-probe", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-dup-threshold", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-judge-effort", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-recurrence-backfill", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-supersede-from-record", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-reconcile-precision", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "memory-harvest-dedup", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "chat-model-bench", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "gpt6-bench-", match: "prefix", class: "study", bound: "agent study; belongs in bli-cockpit-studies" },
+    { name: "manual-study-evidence-vault", match: "prefix", class: "study", bound: "hand-made evidence vault; `cockpit clean --all-committed` removes it once every file is committed" },
+    { name: "issue-import", match: "exact", class: "study", bound: "one-off import receipts; belongs in bli-cockpit-studies" },
+    { name: "analysis", match: "exact", class: "study", bound: "local harvest-analysis output; belongs in bli-cockpit-studies" },
+    { name: "task-type-backlog", match: "prefix", class: "study", bound: "local harvest-analysis output; belongs in bli-cockpit-studies" },
+];
+/** Which rule an entry name falls under, or null for `other`. */
+export function classifyStateEntry(name) {
+    for (const rule of STATE_DIR_RULES) {
+        if (rule.match === "exact" ? name === rule.name : name.startsWith(rule.name)) {
+            return rule;
+        }
+    }
+    return null;
+}
+/**
+ * The sibling studies root, on either host family: the state dir's own path
+ * with `-studies` appended, so `/Users/x/.local/state/bli-cockpit` becomes
+ * `/Users/x/.local/state/bli-cockpit-studies` and
+ * `C:\Users\x\.local\state\bli-cockpit` becomes
+ * `C:\Users\x\.local\state\bli-cockpit-studies`. No separator is joined, so
+ * neither layout can be spelled wrong.
+ */
+export function studiesStateDir(paths) {
+    return `${paths.state_dir.replace(/[\\/]+$/u, "")}${STUDIES_DIR_SUFFIX}`;
+}
+/**
+ * Sizes the `state` and `other` entries of the state directory. Staging,
+ * logs and spool are measured by their own readers and skipped here; studies
+ * are counted but never walked, because a gigabyte of somebody's bench run is
+ * not worth a stat per file on every doctor call.
+ */
+export async function readStateDirFootprint(paths) {
+    const footprint = {
+        state_bytes: 0,
+        other_bytes: 0,
+        other_entries: 0,
+        study_entries: 0,
+    };
+    const entries = await fs
+        .readdir(paths.state_dir, { withFileTypes: true })
+        .catch(() => []);
+    for (const entry of entries) {
+        const rule = classifyStateEntry(entry.name);
+        const cls = rule?.class ?? "other";
+        if (cls === "staging" || cls === "logs" || cls === "spool")
+            continue;
+        if (cls === "study") {
+            footprint.study_entries += 1;
+            continue;
+        }
+        const full = path.join(paths.state_dir, entry.name);
+        const bytes = entry.isDirectory()
+            ? await directoryBytes(full)
+            : await fs.stat(full).then((info) => info.size, () => 0);
+        if (cls === "state") {
+            footprint.state_bytes += bytes;
+        }
+        else {
+            footprint.other_bytes += bytes;
+            footprint.other_entries += 1;
+        }
+    }
+    return footprint;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.154",
+  "version": "0.2.155",
   "private": false,
   "type": "module",
   "bin": {