@bli-cockpit/cli 0.2.154 → 0.2.156

package/dist/commands/doctor-pipeline.js

@@ -1,7 +1,5 @@
 import { withDoctorLockWait } from "./doctor-lock-wait.js";
 import { doctorBackfillBudgetSeconds, doctorLockWaitSeconds } from "./doctor-budget.js";
-import fs from "node:fs/promises";
-import path from "node:path";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
@@ -12,7 +10,7 @@ import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
-import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
+import { FOOTPRINT_NEEDS_FIX_BYTES, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
@@ -32,7 +30,6 @@ import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
  * `doctor-pipeline-verdicts.ts`, and every one of them is re-exported from
  * here so callers keep one address.
  */
-const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export async function checkBackfillState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
     const roots = await doctorRoots(context);
@@ -137,18 +134,14 @@ export async function checkGcState(context) {
     if (context.io.env["COCKPIT_DISABLE_GC"] === "1") {
         return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
-    const paths = getCollectorRuntimePaths(context.command.homeDir);
-    const marker = path.join(paths.state_dir, ".last-raw-evidence-gc");
-    const info = await fs.stat(marker).catch(() => null);
-    if (info && Date.now() - info.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
-    }
-    return needsFix("gc-checked", "due", "cleanup is due");
+    // BLI-11106: the GC runs on every sync tick and costs one manifest read per
+    // old pack, so there is no "already ran today" to report; doctor runs it too.
+    return needsFix("gc-checked", "due", "cleanup runs on every sync; running it now");
 }
 export async function fixGcState(context) {
     const result = await runRawEvidenceLocalGc(getCollectorRuntimePaths(context.command.homeDir), context.io.env);
     if (result.skipped) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
+        return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
     if (result.removed_dirs === 0) {
         return ok("gc-checked", "nothing_eligible", rawEvidenceGcSummary(result));
@@ -156,21 +149,47 @@ export async function fixGcState(context) {
     return ok("gc-checked", `removed_${result.removed_dirs}`, rawEvidenceGcSummary(result));
 }
 /**
- * BLI-3619: what Cockpit is holding on this machine, in one line.
+ * BLI-3619 / BLI-11106: what Tower is holding on this machine, in one line.
  *
- * Green means the staging tree fits under the cap. Over the cap is `needs_fix`
- * and the fix is the same prune the tick runs, forced past its daily throttle;
- * if it is still over afterwards, the message names the one command that goes
- * further. Every number here is metadata — byte counts and file counts, never
- * a path.
+ * Green means the staging tree fits under the cap AND the whole collector
+ * footprint (staging, logs, state, spool) is under 512 MB. Either one crossed
+ * is `needs_fix`, and the message names the bucket holding the bytes. The fix
+ * is the same prune the tick runs; if it is still over afterwards, the message
+ * names the one command that goes further. Every number here is metadata —
+ * byte counts and file counts, never a path.
  */
 export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
-    return footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes
-        ? needsFix("disk-bounded", "over_staging_cap", message)
-        : ok("disk-bounded", "within_staging_cap", message);
+    if (footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes) {
+        return needsFix("disk-bounded", "over_staging_cap", message);
+    }
+    const over = footprintOverSentence(footprint);
+    if (over)
+        return needsFix("disk-bounded", "footprint_over_512mb", `${over}; ${message}`);
+    return ok("disk-bounded", "within_staging_cap", message);
+}
+/**
+ * "812.0 MB held, over the 512 MB line; most of it is sync logs (600.0 MB)",
+ * or null when the footprint is under the line. Logged either way, because a
+ * row that only speaks when it is red cannot say the check ran.
+ */
+export function footprintOverSentence(footprint) {
+    const total = footprintTotalBytes(footprint);
+    const holder = footprintHolder(footprint);
+    const over = total > FOOTPRINT_NEEDS_FIX_BYTES;
+    console.error("[cockpit-doctor] collector footprint", JSON.stringify({
+        reason: over ? "footprint_over_512mb" : "footprint_within_512mb",
+        total_bytes: total,
+        limit_bytes: FOOTPRINT_NEEDS_FIX_BYTES,
+        holder: holder?.label ?? null,
+        holder_bytes: holder?.bytes ?? 0,
+        study_entries_not_counted: footprint.state.study_entries,
+    }));
+    if (!over)
+        return null;
+    return `${mib(total)} MB held, over the ${mib(FOOTPRINT_NEEDS_FIX_BYTES)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -188,7 +207,6 @@ export async function fixDiskState(context) {
     const redelivered = redeliveryLine(redelivery);
     const pruned = await runStagingPrune(paths, {
         env: context.io.env,
-        force: true,
     });
     if (pruned.status === "fail") {
         return fail("disk-bounded", pruned.reason, "the prune could not run; nothing was deleted");
@@ -198,6 +216,10 @@ export async function fixDiskState(context) {
     }
     const footprint = await readDiskFootprint(paths);
     const message = diskRowMessage(footprint, pruned.cap_bytes);
+    const over = pruned.cap_blocked_by_uncommitted ? null : footprintOverSentence(footprint);
+    if (over) {
+        return needsFix("disk-bounded", "footprint_over_512mb", `freed ${mib(pruned.deleted_bytes)} MB; ${over}; ${message}`);
+    }
     if (!pruned.cap_blocked_by_uncommitted) {
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }

package/dist/commands/heartbeat.js

@@ -133,7 +133,7 @@ export function buildCollectorHeartbeat(options) {
  * that a green, syncing, up-to-date laptop was sitting on 1.8 GB of evidence the
  * server had never received, and a fleet-wide failure nobody can see is the
  * BLI-2528 shape exactly. The walk is bounded by the pack tree the prune keeps
- * under a 2 GB cap, and it is best-effort: a read that fails returns nulls and
+ * under a 256 MiB cap, and it is best-effort: a read that fails returns nulls and
  * says so, so the heartbeat omits both fields rather than claiming zero.
  */
 export async function readHeartbeatStagingFacts(options) {

package/dist/commands/local-help-commands.js

@@ -348,11 +348,11 @@ export function localSubcommandHelp(command) {
                 "Usage: cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
                 "",
                 "Reclaims this machine's disk. Prints what it would delete and why, per bucket,",
-                "then deletes: staged evidence Tower has already accepted goes after a 48-hour",
-                "retry window, and anything the upload ledger has NOT vouched for is kept,",
+                "then deletes: a staged copy Tower has already accepted goes (a retry re-reads",
+                "the source file), and anything the upload ledger has NOT vouched for is kept,",
                 "counted and named — retention never deletes undelivered evidence.",
-                "--dry-run stops after the printing. --all-committed drops the retry window,",
-                "so every already-accepted copy goes now, and is the only thing that removes a",
+                "--dry-run stops after the printing. --all-committed drops any retry window set",
+                "with COCKPIT_STAGING_RETENTION_HOURS, so every already-accepted copy goes now, and is the only thing that removes a",
                 "manual-study-evidence-vault folder (and only when every file in it is accepted).",
                 "--reconcile asks Tower's own upload ledger about every object this machine's",
                 "local memory can no longer classify (\"unknown\") before the buckets print — a",
@@ -361,9 +361,9 @@ export function localSubcommandHelp(command) {
                 "object instead of \"unknown\". A server failure never blocks the rest of clean",
                 "and is printed on its own line. Combine with --dry-run to ask and print",
                 "without deleting.",
-                "The scheduled sync does the same prune once a day (reconciling one batch first",
-                "when there is anything unknown); this is the door for a laptop that is full",
-                "right now.",
+                "The scheduled sync does the same prune on every tick (reconciling one batch first",
+                "when there is anything unknown); this is the door for \"show me\" and for a",
+                "laptop that has been off.",
             ],
         ],
         [

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.154");
+    writeLine(io?.stdout ?? process.stdout, "0.2.156");
     return 0;
   }
 

package/dist/commands/status-disk-line.js

@@ -0,0 +1,22 @@
+/**
+ * `cockpit status`'s `Disk:` line (BLI-11106): the same footprint line
+ * `cockpit doctor`'s disk row opens with, so a person who pastes `status` into
+ * Slack also pastes what the collector holds on disk and when it last cleaned
+ * up. Human output only; `status --json` is unchanged. Split out of
+ * `status.ts` to keep that file under the readability ratchet.
+ */
+import { footprintLine } from "./doctor-disk-words.js";
+import { readDiskFootprint } from "../disk-usage.js";
+import { describeError } from "../health-detail.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+/** Never throws: an unreadable footprint is a named line, not a failed status. */
+export async function statusDiskLine(homeDir) {
+    try {
+        const footprint = await readDiskFootprint(getCollectorRuntimePaths(homeDir));
+        return `Disk: ${footprintLine(footprint)}`;
+    }
+    catch (error) {
+        console.error("[cockpit-status] could not read the disk footprint", JSON.stringify({ reason: "footprint_read_failed", ...describeError(error) }));
+        return "Disk: could not be read (footprint_read_failed)";
+    }
+}

package/dist/commands/status.js

@@ -22,6 +22,7 @@ import { displayTicketId, displayWorkLabel, shortSha, stuckEvidenceLine, } from
 import { discoverCommandWorktrees } from "./local-discovery.js";
 import { refreshSetupReceipt } from "./setup-receipt.js";
 import { setupReceiptBlock } from "./setup-receipt-lines.js";
+import { statusDiskLine } from "./status-disk-line.js";
 import { defaultCodexSessionDirs } from "../adapters/codex-attribution.js";
 import { describeError } from "../health-detail.js";
 import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
@@ -77,6 +78,7 @@ async function writeMultiRepoStatus(command, io, backfillCursor, setupReceipt, w
         return writeMultiRepoJson(io, backfillCursor, setupReceipt, statuses);
     writeLine(io.stdout, "Tower status — every repo below this folder");
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
+    writeLine(io.stdout, await statusDiskLine(command.homeDir));
     for (const status of statuses) {
         writeLine(io.stdout, `- ${status.repo_label ?? status.repo}/${status.worktree_label ?? "worktree"} · ${status.branch} · head:${shortSha(status.head_sha)} · ${status.upload_state}`);
     }
@@ -108,14 +110,14 @@ async function writeSingleRepoStatus(command, io, backfillCursor, setupReceipt)
     });
     if (command.json)
         return writeSingleRepoJson(io, status, backfillCursor, setupReceipt);
-    writeSingleRepoLines(io, status, backfillCursor, setupReceipt);
+    writeSingleRepoLines(io, status, backfillCursor, setupReceipt, await statusDiskLine(command.homeDir));
     return 0;
 }
 function writeSingleRepoJson(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, JSON.stringify({ ...status, backfill_cursor: backfillCursor, setup_receipt: setupReceipt?.receipt ?? null }, null, 2));
     return 0;
 }
-function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
+function writeSingleRepoLines(io, status, backfillCursor, setupReceipt, disk) {
     writeLine(io.stdout, "Tower status");
     writeLine(io.stdout, `Installed: ${status.installed ? "yes" : "no"}`);
     writeLine(io.stdout, `Signed in: ${signedInLine(status.session_state)}`);
@@ -142,6 +144,7 @@ function writeSingleRepoLines(io, status, backfillCursor, setupReceipt) {
     writeLine(io.stdout, `Last health note problem: ${status.last_health_receipt_failure_reason ?? "none"}`);
     writeLine(io.stdout, `Old sessions: ${backfillCursorLine(backfillCursor)}`);
     writeLine(io.stdout, `Stuck files: ${stuckEvidenceLine(status)}`);
+    writeLine(io.stdout, disk);
     for (const detail of status.details)
         writeLine(io.stdout, `- ${detail}`);
     writeConnectedBlock(io, setupReceipt);

package/dist/commands/sync-followups-staging.js

@@ -10,9 +10,11 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * laptop forever.
  *
  * Same shape as the memory install beside it and for the same reasons: it runs
- * only once collection's own outcome is decided and reported, at most once a
- * day, it cannot throw, and its outcome is its own named receipt rather than a
- * sync failure. A machine that cannot prune is a machine short of disk, and
+ * only once collection's own outcome is decided and reported, it cannot throw,
+ * and its outcome is its own named receipt rather than a sync failure. Unlike
+ * the memory install it runs on EVERY tick (BLI-11106): the upload above has
+ * just recorded which objects the server committed, and their staged copies
+ * go in this same tick rather than a day or two later. A machine that cannot prune is a machine short of disk, and
  * that must never also be a machine that stops collecting.
  *
  * The rule itself is `disk-retention.ts`: only objects the upload ledger
@@ -24,7 +26,7 @@ const RECONCILE_BATCHES_PER_TICK = 1;
  * ledger's own memory is capped, so a laptop that keeps accumulating
  * `unknown` state needs SOMETHING asking the server on a schedule, not only
  * when a person happens to type `cockpit clean --reconcile`. One batch a tick
- * is not throttled to once a day like the prune below — an `unknown` backlog
+ * is bounded to one batch rather than drained whole — an `unknown` backlog
  * drains at up to 500 hashes/15 min, and the ordinary case (nothing unknown)
  * costs one cheap local read and no network call at all, so it never competes
  * with collection for the tick's time. A reconcile failure never blocks the
@@ -59,9 +61,10 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
             detail: redactedSyncErrorDetail(error),
         }));
     }
-    // The daily throttle is the steady state — reporting it would post a receipt
-    // on 95 of every 96 ticks for no new information.
-    if (result.reason !== "throttled_recent_run") {
+    // A tick with nothing to prune is the steady state: `[collector prune]`
+    // already logged it locally with the bytes scanned, and posting a receipt on
+    // 95 of every 96 ticks would say nothing new.
+    if (result.reason !== "nothing_to_prune") {
         events.push(stagingPruneEvent(result));
     }
     if (events.length === 0)
@@ -78,8 +81,8 @@ export async function runStagingPruneAfterSync(command, io, dashboardUrl, option
 /**
  * Never throws (`runEvidenceReconcile` already never does); returns `null`
  * for the boring, common case — nothing this tick was `unknown` — so that
- * case costs no receipt either, the same rule the prune's own daily throttle
- * follows above.
+ * case costs no receipt either, the same rule the prune's own
+ * `nothing_to_prune` follows above.
  */
 async function runReconcileFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceReconcile({
@@ -102,7 +105,7 @@ async function runReconcileFollowUp(command, io, dashboardUrl, options) {
  * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
  * the boring, common case — nothing on this disk is undelivered — so the steady
  * state costs no receipt, the same rule the reconcile follow-up above and the
- * prune's daily throttle below both follow.
+ * prune's `nothing_to_prune` below both follow.
  */
 async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
     const result = await runEvidenceRedelivery({

package/dist/commands/sync.js

@@ -24,8 +24,10 @@
  *
  * Both arms below do the same things in the same order, because a tick that
  * THREW is still a tick a machine survived and the fleet has to be able to tell
- * that from silence (BLI-3551). The one difference is the staging prune, which
- * the throwing arm has never run.
+ * that from silence (BLI-3551). Both arms also run the staging prune: a tick
+ * that threw after uploading still leaves committed copies the prune may take,
+ * and waiting for the next clean tick is how a sick machine fills its disk
+ * (BLI-11106).
  *
  * Split out of commands/local.ts (BLI-3578), then into the siblings above
  * (BLI-3982). The scan and upload engine underneath is `./session-sync.ts`;
@@ -78,8 +80,8 @@ export async function runSync(command, io) {
         await sendSyncHeartbeat(command, io, dashboardUrl, result.heartbeat);
         await reportTickOutcome(command, io, dashboardUrl, result.completion);
         await convergeAfterTick(command, io, dashboardUrl);
-        // BLI-3619: and the disk stops growing without bound — same daily cadence,
-        // same rule that a follow-up never blocks or fails collection.
+        // BLI-3619 / BLI-11106: every tick, the staged copies of whatever the
+        // server just committed go; a follow-up never blocks or fails collection.
         await runStagingPruneAfterSync(command, io, dashboardUrl);
         return result.exitCode;
     }
@@ -94,6 +96,7 @@ export async function runSync(command, io) {
         });
         await reportTickThrew(command, io, dashboardUrl, error, errorCode);
         await convergeAfterTick(command, io, dashboardUrl);
+        await runStagingPruneAfterSync(command, io, dashboardUrl);
         throw error;
     }
 }

package/dist/cursors/raw-evidence-cursor.js

@@ -195,8 +195,21 @@ function parseSessionEntry(value) {
         uploaded_at: optionalString(record["uploaded_at"]),
         uploaded_byte_size: optionalNumberOrNull(record["uploaded_byte_size"]),
         last_seen_at: lastSeenAt,
+        ...parseStubReoffer(record["stub_reoffer"]),
     };
 }
+function parseStubReoffer(value) {
+    if (!value || typeof value !== "object")
+        return {};
+    const record = value;
+    const markedAt = optionalString(record["marked_at"]);
+    const ids = Array.isArray(record["stub_pointer_ids"])
+        ? record["stub_pointer_ids"].filter((id) => typeof id === "string" && id.length > 0)
+        : [];
+    if (record["reason"] !== "stub_reoffered" || !markedAt || ids.length === 0)
+        return {};
+    return { stub_reoffer: { reason: "stub_reoffered", stub_pointer_ids: ids, marked_at: markedAt } };
+}
 function parseCheckpoints(value) {
     if (!value || typeof value !== "object")
         return null;

package/dist/disk-prune.js

@@ -15,19 +15,25 @@
  *   evidence that the drain is still running at all (the BLI-2528 lesson: what
  *   only speaks on failure cannot answer "did anything work today?").
  *
- * Throttled to once a day by a marker file, the same idiom the raw-evidence GC,
- * the scheduled self-update and the BLI Memory install use. Walking a pack tree
- * is cheap; doing it every fifteen minutes for a decision that changes on the
- * scale of hours is not.
+ * Runs on EVERY tick (BLI-11106). It used to sit behind a once-a-day marker
+ * file, and that is how 534 MB of committed, past-window copies were still on
+ * the reference Mac when it was measured: the drain existed and had not run
+ * yet. The inventory reads each pack's small `manifest.json` rather than its
+ * payload, so a tick with nothing to delete costs one directory walk and logs
+ * `nothing_to_prune` with the bytes it scanned. `COCKPIT_DISABLE_GC=1` is the
+ * only off switch.
+ *
+ * Every non-dry run leaves `last-prune.json` (one small object, overwritten)
+ * so `cockpit doctor` and `cockpit status` can say when it last ran and what
+ * it freed without re-running it.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
 import { planStagingRetention, retentionOptionsFromEnv, } from "./disk-retention.js";
 import { RAW_EVIDENCE_DIR, readStagingInventory } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
+import { writeLastPruneReceipt } from "./prune-receipt.js";
 import { readRawEvidenceStagingState, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
-export const STAGING_PRUNE_THROTTLE_MARKER = ".last-staging-prune";
-export const STAGING_PRUNE_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 /**
  * The prune the sync tick runs and `cockpit clean` / `cockpit doctor` reuse.
  * Never throws.
@@ -38,17 +44,14 @@ export async function runStagingPrune(paths, options = {}) {
     if (env["COCKPIT_DISABLE_GC"] === "1") {
         return skippedResult("disabled");
     }
-    if (!options.force && (await prunedRecently(paths, now))) {
-        return skippedResult("throttled_recent_run");
-    }
     try {
-        if (!options.dryRun && !options.force)
-            await markPruned(paths, now);
         const plan = await planFromDisk(paths, env, options, now);
         const result = options.dryRun
             ? dryRunResult(plan)
             : await applyPlan(paths, plan);
         reportPrune(result, { dryRun: Boolean(options.dryRun) });
+        if (!options.dryRun)
+            await writeLastPruneReceipt(paths, result, now);
         return result;
     }
     catch (error) {
@@ -75,7 +78,7 @@ async function applyPlan(paths, plan) {
     return {
         ...dryRunResult(plan),
         status: "ok",
-        reason: tally.files > 0 ? "pruned" : "nothing_eligible",
+        reason: tally.files > 0 || tally.packs > 0 ? "pruned" : "nothing_to_prune",
         deleted_files: tally.files,
         deleted_bytes: tally.bytes,
         removed_packs: tally.packs,
@@ -166,7 +169,9 @@ async function forgetStagedObjects(paths, hashes) {
 function dryRunResult(plan) {
     return {
         status: "ok",
-        reason: plan.delete.length > 0 ? "would_prune" : "nothing_eligible",
+        reason: plan.delete.length > 0 || plan.empty_packs.length > 0
+            ? "would_prune"
+            : "nothing_to_prune",
         deleted_files: plan.delete.length,
         deleted_bytes: plan.deleted_bytes + plan.empty_pack_manifest_bytes,
         removed_packs: plan.empty_packs.length,
@@ -221,6 +226,7 @@ export function reportPrune(result, options = { dryRun: false }) {
         kept_unknown: result.kept_unknown,
         kept_in_window: result.kept_in_window,
         cap_bytes: result.cap_bytes,
+        bytes_scanned: result.bytes_before,
         bytes_after: result.bytes_after,
         failed_deletions: result.failed_deletions,
     }));
@@ -234,14 +240,4 @@ export function reportPrune(result, options = { dryRun: false }) {
         cap_bytes: result.cap_bytes,
         bytes_after: result.bytes_after,
     }));
-}
-async function prunedRecently(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    const info = await fs.stat(marker).catch(() => null);
-    return Boolean(info && now.getTime() - info.mtimeMs < STAGING_PRUNE_MIN_INTERVAL_MS);
-}
-async function markPruned(paths, now) {
-    const marker = path.join(paths.state_dir, STAGING_PRUNE_THROTTLE_MARKER);
-    await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
-    await fs.writeFile(marker, now.toISOString()).catch(() => undefined);
 }

package/dist/disk-retention.js

@@ -1,7 +1,10 @@
-/** How long a committed spare is kept so a retry still has local bytes. */
-export const DEFAULT_STAGING_RETENTION_MS = 48 * 60 * 60 * 1000;
+/**
+ * How long a committed spare is kept: zero (BLI-11106). A retry re-reads the
+ * source file, so the staged copy of a committed object is pure duplication.
+ */
+export const DEFAULT_STAGING_RETENTION_MS = 0;
 /** Ceiling on everything under `raw-evidence`, manifests included. */
-export const DEFAULT_STAGING_CAP_BYTES = 2 * 1024 * 1024 * 1024;
+export const DEFAULT_STAGING_CAP_BYTES = 256 * 1024 * 1024;
 /** Local knobs, read from the environment like `COCKPIT_DISABLE_GC`. */
 export const STAGING_CAP_ENV = "COCKPIT_STAGING_CAP_BYTES";
 export const STAGING_RETENTION_ENV = "COCKPIT_STAGING_RETENTION_HOURS";
@@ -33,7 +36,7 @@ export function planStagingRetention(inventory, options = {}) {
                 continue;
             }
             if (options.allCommitted || object.age_ms >= retentionMs) {
-                pushDeletion(plan, object, "committed_past_retry_window");
+                pushDeletion(plan, object, "committed_on_server");
                 continue;
             }
             committedInWindow.push(object);
@@ -61,11 +64,11 @@ export function planStagingRetention(inventory, options = {}) {
  * safe elsewhere.
  *
  * It does not run at all when the floor is already above the cap. That branch
- * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging is
- * evidence no ledger vouches for, against a 2 GB cap, so spending the retry
- * window on 1,027 committed spares would have deleted a day of local retry
- * copies and still ended over the cap. The cap takes a spare only when taking
- * it can actually get this machine under the cap.
+ * is not theoretical: on the reference Mac (2026-09-05) 8.0 GB of staging was
+ * evidence no ledger vouched for, against the cap of the day. With the default
+ * zero window it rarely matters (committed spares are already gone); it keeps
+ * an opted-in window honest by taking a spare only when that can actually get
+ * this machine under the cap.
  */
 function applyByteCap(plan, committedInWindow, capBytes, inventory) {
     let projected = plan.bytes_before - plan.deleted_bytes;

package/dist/disk-usage-footprint.js

@@ -1,9 +1,11 @@
 /**
- * The whole-machine read: staging, rotated logs, the spool, and the vaults a
- * person made by hand — the four places Cockpit ever writes bytes on a laptop.
+ * The whole-machine read: staging, rotated logs, the spool, the vaults a
+ * person made by hand, and (BLI-11106) the rest of the state directory plus
+ * the last prune's receipt.
  *
- * The staging half is the rest of this family; what lives here is the other
- * three and the one function that puts all four together.
+ * The staging half is the rest of this family; the state-dir audit is
+ * `state-dir-audit.ts` and the receipt `prune-receipt.ts`. What lives here is
+ * the one function that puts them together.
  */
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -11,6 +13,8 @@ import { MANUAL_VAULT_PREFIX, } from "./disk-usage-facts.js";
 import { directoryBytes, listPackFiles } from "./disk-usage-files.js";
 import { readStagingInventory } from "./disk-usage-scan.js";
 import { rotatedLogFootprint } from "./log-rotation.js";
+import { readLastPruneReceipt } from "./prune-receipt.js";
+import { readStateDirFootprint } from "./state-dir-audit.js";
 /**
  * Everything on this machine Cockpit put there, in one read. Used by the sync
  * tick's prune, by `cockpit clean` and by `cockpit doctor`'s disk row, so all
@@ -22,6 +26,8 @@ export async function readDiskFootprint(paths, now = new Date()) {
         logs: await rotatedLogFootprint(paths),
         spool_bytes: await directoryBytes(paths.spool_dir),
         vaults: await readManualVaults(paths),
+        state: await readStateDirFootprint(paths),
+        last_prune: await readLastPruneReceipt(paths),
     };
 }
 /** The hand-made vaults: counted and named so nothing deletes them silently. */

package/dist/evidence-reconcile-client.js

@@ -35,8 +35,8 @@ export async function runEvidenceReconcile(options) {
         if (hashes.length === 0) {
             // No stderr line here on purpose: the sync tick calls this every 15
             // minutes and the steady state is "nothing unknown" — logging that
-            // every tick forever is exactly the receipt-on-95-of-96-ticks spam the
-            // daily prune throttle exists to avoid. `cockpit clean --reconcile`
+            // every tick forever is exactly the receipt-on-95-of-96-ticks spam that
+            // the follow-ups skip on their `nothing_*` reasons. `cockpit clean --reconcile`
             // still tells a person this on stdout (`reconcileLines` in clean.ts).
             return emptyResult("nothing_unknown");
         }