disk-space-saviour 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.18.0
+
+### Minor Changes
+
+- 2c706f1: Treat every regenerable project directory as `safe` regardless of how recently
+  the project was used, and block it only while something uses it. Detect
+  processes that keep a directory on their `PATH`, stop a long-running Bun script
+  or Codex daemon from blocking caches they do not use, prune old Codex daemon
+  releases, resolve partial nvm pins to the newest matching install, keep Node.js
+  versions that hold user-installed global packages, inspect Git safety in linked
+  worktrees and submodules, and report per-phase scan timings.
+
+## 0.17.0
+
+### Minor Changes
+
+- a518d7b: Reuse recent authenticated scans, stream safe global-cache cleanup before project discovery, and stop emergency scans as soon as the free-space goal is met. Add bounded discovery, persistent directory and size indexes, separate candidate/sizing progress counters, and macOS swap diagnostics while retaining fresh deletion checks.
+
 ## 0.16.0
 
 ### Minor Changes

package/README.md

@@ -30,17 +30,17 @@ dss emergency --free 20G --yes      # escalate tiers until 20 GiB is free
 dss docker scan --recursive         # containers and nested daemons
 ```
 
-Example (`dss scan ~/work` on two projects untouched for 40 days):
+Example (`dss scan ~/work` on two projects):
 
 ```
 disk-space-saviour scan of host (build-01) in 3.7s (report only, nothing was deleted)
 /: 75.8 GiB free of 193 GiB (61% used)
 
-MODERATE  2 items, 7.6 MiB
+SAFE  2 items, 7.6 MiB
      4.8 MiB  cargo-target  /home/me/work/api/target
      2.9 MiB  node-modules  /home/me/work/web/node_modules
 
-Reclaimable (cumulative): safe 0 B · moderate 7.6 MiB · aggressive 7.6 MiB; blocked 0 B
+Reclaimable (cumulative): safe 7.6 MiB · moderate 7.6 MiB · aggressive 7.6 MiB; blocked 0 B
 Audit log: /home/me/.local/state/disk-space-saviour/audit/dss-scan-2026-09-26T00-31-05-432Z-232874.json
 Run `dss clean --tier safe` to see the plan, add --yes to delete.
 ```
@@ -76,25 +76,34 @@ Run `dss --help` for every option. The most useful ones:
 - `--scanner NAME` restricts scanning to `projects`, `global`, `versions`,
   `agents` or `system`.
 - `--report FILE` limits cleaning to items in a saved `dss scan --json`
-  report. The current rules rescan those items before deletion.
+  report. `--from FILE` also accepts an audit JSON containing the full report.
+  Recent reports authenticated by this installation are reused; older, unsigned
+  or edited reports require discovery again. Changing discovery or action options
+  also rebuilds the plan. Every deletion still gets fresh checks.
+- `clean` automatically reuses a matching scan from the last 30 minutes.
+  `--fresh` bypasses this plan and the discovery/size index; `--cache-dir DIR`
+  chooses the state location (default `$XDG_STATE_HOME/disk-space-saviour`, or
+  `~/.local/state/disk-space-saviour`).
 
 ## Tiers
 
-Tiers are cumulative: `moderate` includes `safe`, and `aggressive` includes
-both.
+Tiers are cumulative: `moderate` includes `safe`. Regenerable data is never
+ranked by how recently it was used: a cache, build output or dependency
+directory is `safe` and is held back only while something uses it (see
+[Safety](#safety)).
 
-| Tier         | What it removes                                                                                                                                                                                                                                                                                       |
-| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `safe`       | Download and application caches, idle package-runner entries, old browser revisions, inactive lockfile-backed `node_modules`, dangling Docker images and build cache. Includes writable caches inside running containers.                                                                             |
-| `moderate`   | Whole `target/`, `.venv`, `build/` and similar folders of inactive projects; old agent scratch and Telegram downloaded media (secret-chat media may be irreplaceable); unused toolchain versions and tagged images; stopped containers. Container and tagged-image removal requires explicit consent. |
-| `aggressive` | For emergencies: everything regenerable, including build outputs of projects in active use. Only `dss emergency` reaches it.                                                                                                                                                                          |
+| Tier         | What it removes                                                                                                                                                                                                                                                                                                           |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `safe`       | Everything regenerable: download, runtime and application caches, idle package-runner entries, old browser revisions, `node_modules`, `vendor`, `target/`, `.venv`, `build/` and similar folders of any project, dangling Docker images and build cache.                                                                  |
+| `moderate`   | Data that is disposable but not regenerated by a tool: old agent scratch and Telegram downloaded media (secret-chat media may be irreplaceable), unused toolchain versions (never one holding globally installed packages or virtual environments), tagged images and stopped containers (both require explicit consent). |
+| `aggressive` | Accepted by `dss emergency` for compatibility; currently the same as `moderate`.                                                                                                                                                                                                                                          |
 
 Covered ecosystems: JavaScript/TypeScript (npm, yarn, pnpm, bun, deno,
 framework build caches), Python, Rust, JVM (Gradle, Maven, Kotlin, Android),
 Go, C/C++ (CMake, ccache, vcpkg, Conan), .NET, PHP, Ruby, Swift/Xcode, Dart,
 Haskell, Scala, Elixir, OCaml, Lean, Julia, R, Zig, and scripting languages.
 Also covered: version managers (nvm, pyenv, rbenv, SDKMAN!, rustup, elan,
-ghcup, opam, swiftly, VS Code Server, Claude Code and Copilot CLI), Playwright, playwright-go, Puppeteer
+ghcup, opam, swiftly, VS Code Server, Claude Code, the Codex daemon and Copilot CLI), Playwright, playwright-go, Puppeteer
 and Cypress browsers, HTTP caches of Chrome, Chromium, Edge, Brave, Opera,
 Opera GX, Vivaldi, Arc, Yandex Browser, Naver Whale, 360, QQ Browser, Firefox,
 LibreWolf, Waterfox, Zen and Floorp, IDE caches (JetBrains, VS Code, Cursor,
@@ -117,7 +126,19 @@ is needed. Agent scratch cleanup requires inactivity and Git safety checks.
   that a process holds open (`/proc/*/fd`, `cwd`, `exe`, or `lsof` on
   macOS) are skipped. So are projects with a running `cargo`, `gradle`,
   `npm`, `node` or similar tool, and anything modified within
-  `--older-than` (1h).
+  `--older-than` (1h). How long ago a project was last used does not
+  matter. A tool running elsewhere does not block a runtime cache it is not
+  using: a script of an installed project keeps no lock on the Bun install
+  cache, while `bun install`, `bunx` or an auto-installing script does.
+  A directory on the `PATH` of a running process is kept too: the process
+  may still start programs from it.
+- **Toolchain versions are kept while anything may need them.** The
+  manager's default and aliases, versions pinned by a project (`.nvmrc`,
+  `rust-toolchain.toml`, ...) and the newest install stay. A partial nvm pin
+  such as `20` keeps only the newest matching 20.x, as nvm resolves it. A
+  version holding globally installed npm packages or pyenv virtual
+  environments is blocked; bundled `npm`/`corepack` and use-m caches
+  (`<name>-v-<version>`) are reinstalled on demand and do not count.
   Container paths are checked individually before each bounded deletion batch.
 - **Rust builds are pruned in two parts.** `cargo-superseded` removes
   older hashes of a unit (`.rlib`, `.rmeta`, `.so`/`.dylib`/`.a`,
@@ -179,6 +200,38 @@ print completed findings marked `aborted`; incomplete findings remain blocked.
 The CLI exits 130 or 143 respectively. A second signal exits immediately.
 Library callers can pass an `AbortSignal` and an `onScanProgress` callback.
 
+Global caches run first, prioritizing rules that can use native sizing without
+recursive activity timestamps, and emit findings as each rule finishes. Non-interactive
+`clean` plans or deletes completed safe host caches while the remaining discovery
+continues. `emergency` does the same, checks actual free space after each deletion,
+and skips the remaining scan once the goal is met. Interactive runs show a plan
+before asking for deletion consent. A later phase hitting its budget blocks its
+partial findings while completed independent findings stay usable.
+
+Project discovery uses eight directory workers, prunes matched generated trees,
+Git objects, home media/Photos libraries, macOS Library and mounted volumes.
+Source activity is checked separately without sizing entire project trees again.
+Spotlight (`mdfind`) or `plocate`/`locate` supplies verified early hints when
+available; the walk also runs because an index can miss files. Version-pin discovery
+also prunes dependency/build trees.
+
+The persistent `index/` stores directory listings and candidate measurements.
+Each descendant directory's own mtime/ctime and identity is checked before reusing
+its listing, so a nested addition is visible even when an ancestor did not change.
+Unchanged directories avoid another listing; discovery still checks their metadata.
+Sizing uses bounded workers and `du -skx` when no recursive activity timestamp is
+needed. Sizes cached for up to an hour are labeled **estimated**, because changing
+an existing descendant need not update the candidate's directory mtime. Cleanup
+always bypasses that cache and rechecks processes, open files, Git, path boundaries
+and sizes. Safe cleanup also rechecks source activity. Explicit moderate cleanup
+preserves the ability to remove ignored dependencies when only source changed.
+Library callers opt into state with `cacheDir`.
+
+On macOS, reports include `sysctl vm.swapusage` and the largest resident/compressed
+memory consumers from `top`. These are memory diagnostics, not verified per-process
+swap ownership. When Docker Desktop consumes memory, saving work and restarting it
+or lowering its VM memory limit can help. dss never deletes swap files.
+
 Cache discovery honors tool configuration before default paths, including
 `GOMODCACHE`, `GOPATH`, `GOCACHE`, `CARGO_HOME`, `RUSTUP_HOME`,
 `GRADLE_USER_HOME`, `DENO_DIR`, `BUN_INSTALL_CACHE_DIR` and `XDG_CACHE_HOME`.
@@ -304,7 +357,7 @@ example and `examples/universal-app` for a report viewer.
 | `--audit-dir`, `DSS_AUDIT_DIR`   | `$XDG_STATE_HOME/disk-space-saviour/audit` | Where audit logs go                         |
 | `--backup-dir`, `DSS_BACKUP_DIR` | `…/disk-space-saviour/backups`             | Container log backups before `docker rm`    |
 | `--older-than`                   | `1h`                                       | Activity window; newer files are kept       |
-| `--inactive`                     | `30d`                                      | Project inactivity before `moderate`        |
+| `--inactive`                     | `30d`                                      | Idle time before agent scratch is abandoned |
 | `--min-size`                     | `1M`                                       | Smaller items are not reported              |
 | `--depth`                        | `3`                                        | Docker nesting depth                        |
 | `--journal-keep`                 | `512M`                                     | journald size to keep                       |

package/bin/dss.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 
-import { runCli } from '../src/cli.js';
+// Scans are bound by file system calls, which run on libuv's thread pool
+// (4 threads by default). It is sized on first use, so set it before any
+// module that may touch the file system is loaded.
+process.env.UV_THREADPOOL_SIZE ??= '32';
+const { runCli } = await import('../src/cli.js');
 
 const controller = new AbortController();
 let received = null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "disk-space-saviour",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Safely reclaims disk space: caches and build outputs of 20+ ecosystems, forgotten projects, and Docker (running, stopped and nested containers), with an emergency mode",
   "type": "module",
   "main": "src/index.js",

package/src/clean.js

@@ -18,6 +18,7 @@ import path from 'node:path';
 import { finished } from 'node:stream/promises';
 
 import { backupDirectory, startAudit, writeAudit } from './audit.js';
+import { PhaseTimer } from './timings.js';
 import { configureContainerHost } from './docker/writable.js';
 import { DockerCli, assertAllowed, parseDockerSize } from './docker/cli.js';
 import {
@@ -161,7 +162,8 @@ export class Cleaner {
     this.report = report;
     this.options = options;
     this.contexts = new Map();
-    this.health = new HealthWatch();
+    this.health = new HealthWatch(options.priorHealth);
+    this.timings = options.timings ?? new PhaseTimer();
     this.descriptors = new Map(
       (report.environments ?? []).map((env) => [env.id, env])
     );
@@ -234,7 +236,9 @@ export class Cleaner {
   }
 
   async #processScoped(ctx, item, entry) {
-    const fresh = await this.#recheck(ctx, item);
+    const fresh = await this.timings.measure('recheck', () =>
+      this.#recheck(ctx, item)
+    );
     if (fresh.reason) {
       entry.reason = fresh.reason;
       return;
@@ -247,9 +251,15 @@ export class Cleaner {
       entry.status = 'planned';
       return;
     }
-    await this.health.baseline(ctx.env, item);
-    await this.#execute(ctx, fresh.item, entry);
-    const lost = await this.health.check(ctx.env, item);
+    await this.timings.measure('health', () =>
+      this.health.baseline(ctx.env, item)
+    );
+    await this.timings.measure(`execute:${fresh.item.action?.type}`, () =>
+      this.#execute(ctx, fresh.item, entry)
+    );
+    const lost = await this.timings.measure('health', () =>
+      this.health.check(ctx.env, item)
+    );
     if (lost && !entry.reason) {
       entry.reason = lost;
     }
@@ -385,6 +395,7 @@ export class Cleaner {
           options: {
             ...this.options,
             homes: [item.recheck.home],
+            freshSizes: true,
             roots: this.report.options.roots ?? [],
           },
           now: this.options.now(),
@@ -429,9 +440,18 @@ export class Cleaner {
     if (
       ctx.env.kind === 'host' &&
       type === 'remove' &&
-      this.report.docker?.daemons?.some((daemon) => daemon.env === ctx.env.id)
+      (this.report.docker?.daemons?.some(
+        (daemon) => daemon.env === ctx.env.id
+      ) ||
+        this.options.streaming)
     ) {
-      const mounts = await runningBindMounts(new DockerCli(ctx.executor));
+      const docker = new DockerCli(ctx.executor);
+      if (this.options.streaming && !(await docker.info())) {
+        return this.options.docker === true
+          ? 'cannot verify running Docker bind mounts'
+          : null;
+      }
+      const mounts = await runningBindMounts(docker);
       for (const mount of mounts) {
         if (
           item.paths.some(
@@ -902,19 +922,25 @@ export function cleanOptions(report, input) {
  * @returns {Promise<object>} audit log
  */
 export async function clean(report, input = {}) {
-  report = await revalidateReport(report, input);
-  const options = cleanOptions(report, input);
+  const timings = new PhaseTimer();
+  report = await timings.measure('revalidate', () =>
+    revalidateReport(report, input)
+  );
+  const options = { ...cleanOptions(report, input), timings };
   const audit = startAudit(input.command ?? 'clean', {
     dryRun: Boolean(options.dryRun),
     tier: options.tier,
-    report: { createdAt: report.createdAt, totals: report.totals },
+    report,
+    entries: [...(input.priorEntries ?? [])],
   });
   const persistProgress = async (entry) => {
     if (!audit.entries.includes(entry)) {
       audit.entries.push(entry);
     }
     if (options.audit !== false) {
-      await writeAudit(audit, { ...options, inProgress: true });
+      await timings.measure('audit-write', () =>
+        writeAudit(audit, { ...options, inProgress: true })
+      );
     }
   };
   const cleaner = new Cleaner(report, {
@@ -923,11 +949,15 @@ export async function clean(report, input = {}) {
     onProgress: persistProgress,
   });
   audit.health = cleaner.health.records;
+  audit.timings = timings;
   if (options.audit !== false) {
     await writeAudit(audit, { ...options, inProgress: true });
   }
   try {
-    for (const item of planItems(report, options)) {
+    const done = new Set(audit.entries.map((entry) => entry.id));
+    for (const item of planItems(report, options).filter(
+      (item) => !done.has(item.id)
+    )) {
       if (options.signal?.aborted) {
         throw new Error('cleanup aborted');
       }
@@ -937,7 +967,9 @@ export async function clean(report, input = {}) {
       }
       options.onEntry?.(entry, item);
       if (options.audit !== false) {
-        await writeAudit(audit, { ...options, inProgress: true });
+        await timings.measure('audit-write', () =>
+          writeAudit(audit, { ...options, inProgress: true })
+        );
       }
     }
   } catch (error) {

package/src/cli.js

@@ -15,9 +15,11 @@ import { startAudit, writeAudit } from './audit.js';
 import { clean } from './clean.js';
 import { emergency } from './emergency.js';
 import { setTrace } from './exec.js';
-import { resolveGoal } from './options.js';
+import { resolveGoal, resolveOptions } from './options.js';
 import { formatAudit, formatReport } from './report.js';
 import { scan } from './scan.js';
+import { cleanDuringScan } from './fast-clean.js';
+import { defaultStateDirectory, loadScan } from './scan-state.js';
 import { formatBytes } from './units.js';
 
 export const USAGE = `Usage: dss <command> [paths...] [options]
@@ -43,7 +45,7 @@ Scope:
   --scanner NAME             projects, global, versions, agents, system
   --min-size SIZE            ignore smaller items (default 1M)
   --older-than AGE           activity window, newer files are kept (1h)
-  --inactive AGE             project inactivity for moderate tier (30d)
+  --inactive AGE             idle time before agent scratch counts as abandoned (30d)
   --journal-keep SIZE        journald size to keep (512M)
 
 Goals (emergency):
@@ -67,6 +69,9 @@ Consent:
 Output:
   --json                     print the report or audit log as JSON
   --report FILE              clean: use a report saved by scan --json
+  --from FILE                clean/emergency: reuse a scan or audit JSON
+  --fresh                    bypass the recent scan and persistent index
+  --cache-dir DIR            scan state (default: XDG state directory)
   --audit-dir DIR            audit logs ($DSS_AUDIT_DIR)
   --backup-dir DIR           container log backups ($DSS_BACKUP_DIR)
   --verbose                  list everything and trace commands (DSS_DEBUG=1)
@@ -106,6 +111,9 @@ const OPTIONS = {
   'allow-dirty-container': { type: 'string', multiple: true },
   'no-native': { type: 'boolean' },
   report: { type: 'string' },
+  from: { type: 'string' },
+  fresh: { type: 'boolean' },
+  'cache-dir': { type: 'string' },
   'audit-dir': { type: 'string' },
   'backup-dir': { type: 'string' },
   help: { type: 'boolean', short: 'h' },
@@ -182,6 +190,9 @@ export function toOptions(values, paths = []) {
     noNative: values['no-native'],
     auditDir: values['audit-dir'],
     backupDir: values['backup-dir'],
+    cacheDir: values.fresh
+      ? false
+      : (values['cache-dir'] ?? defaultStateDirectory()),
   };
 }
 
@@ -240,14 +251,7 @@ function dockerOnly(options, values) {
 export function scanAudit(report) {
   return startAudit('scan', {
     dryRun: true,
-    report: {
-      createdAt: report.createdAt,
-      durationMs: report.durationMs,
-      totals: report.totals,
-      environments: report.environments.map((env) => env.id),
-      errors: report.errors,
-      items: report.items,
-    },
+    report,
     entries: report.items.map((item) => ({
       id: item.id,
       env: item.env,
@@ -283,7 +287,7 @@ export function processIo() {
   };
 }
 
-const API = { scan, clean, emergency };
+const API = { scan, clean, emergency, cleanDuringScan };
 
 class Cli {
   constructor(io, api) {
@@ -321,10 +325,19 @@ class Cli {
   }
 
   async loadReport(options, values) {
-    if (!values.report) {
+    const file = values.from ?? values.report;
+    if (!file) {
+      const recent = await loadScan(resolveOptions(options));
+      if (recent) {
+        this.io.stderr(
+          `Reusing scan from ${recent.createdAt}; planned items will be checked before deletion.`
+        );
+        return recent;
+      }
       return this.api.scan(options);
     }
-    return JSON.parse(await fsp.readFile(values.report, 'utf8'));
+    const saved = JSON.parse(await fsp.readFile(file, 'utf8'));
+    return saved.report?.schema ? saved.report : saved;
   }
 
   confirmItem() {
@@ -371,6 +384,33 @@ class Cli {
   }
 
   async clean(options, values) {
+    if (
+      this.api.cleanDuringScan &&
+      !values.report &&
+      !values.from &&
+      !this.io.interactive
+    ) {
+      const recent = await loadScan(resolveOptions(options));
+      if (!recent) {
+        const result = await this.consent(values, (extra) =>
+          this.api.cleanDuringScan({
+            ...options,
+            ...extra,
+            streaming: options.docker !== false,
+          })
+        );
+        if (result.report.aborted) {
+          return this.printScan(result.report, options, values);
+        }
+        this.print(values, result.audit, () =>
+          formatAudit(result.audit, { verbose: values.verbose })
+        );
+        return result.audit.aborted ||
+          result.audit.entries.some((entry) => entry.status === 'failed')
+          ? 1
+          : 0;
+      }
+    }
     const report = await this.loadReport(options, values);
     if (report.aborted) {
       return this.printScan(report, options, values);
@@ -393,6 +433,32 @@ class Cli {
     } catch (error) {
       throw new UsageError(error.message);
     }
+    if (
+      this.api === API &&
+      !values.report &&
+      !values.from &&
+      !this.io.interactive
+    ) {
+      const recent = await loadScan(resolveOptions(options));
+      const audit = await this.consent(values, (extra) =>
+        this.api.emergency({
+          ...options,
+          ...(recent ? { report: recent } : {}),
+          ...extra,
+        })
+      );
+      if (audit.scanReport?.aborted) {
+        return this.printScan(audit.scanReport, options, values);
+      }
+      this.print(values, audit, () =>
+        formatAudit(audit, { verbose: values.verbose })
+      );
+      return audit.entries.some((entry) => entry.status === 'failed')
+        ? 1
+        : audit.goalMet
+          ? 0
+          : 3;
+    }
     const report = await this.loadReport(options, values);
     if (report.aborted) {
       return this.printScan(report, options, values);
@@ -461,7 +527,7 @@ export async function runCli(argv, deps = {}) {
     }
     options.onScanProgress = (progress) =>
       io.stderr(
-        `[scan] ${progress.env}: ${progress.scanner}, ${Math.round(progress.elapsedMs / 1000)}s, ${progress.items} items (${progress.status})`
+        `[scan] ${progress.env}: ${progress.scanner}, ${Math.round(progress.elapsedMs / 1000)}s, ${progress.candidates ?? progress.items} candidates, ${progress.filesSized ?? 0} files sized, ${progress.directoriesSized ?? 0} directories sized (${progress.status})`
       );
     return await dispatch(
       new Cli(io, deps.api ?? API),

package/src/docker/scan.js

@@ -634,6 +634,7 @@ class DockerScan {
       scanStatus: env.scanStatus,
       hint: env.probeHint ?? null,
       layerSource: env.writableLayer?.source ?? null,
+      timings: env.timings?.toJSON() ?? [],
     });
     if (await env.which('docker')) {
       try {

package/src/emergency.js

@@ -18,6 +18,7 @@ import { LocalEnv } from './env/local.js';
 import { TIERS, selectByTier, tierRank } from './items.js';
 import { resolveGoal, resolveOptions } from './options.js';
 import { revalidateReport, scan } from './scan.js';
+import { PhaseTimer } from './timings.js';
 
 /**
  * Used percentage the way `df` prints it: used / (used + available).
@@ -86,15 +87,45 @@ export async function emergency(input = {}) {
     path: target,
     diskBefore,
     bytesNeeded: bytesNeeded(goal, diskBefore),
+    // Shared by every cleanup pass of a streamed scan.
+    timings: new PhaseTimer(),
   });
   const report = input.report
     ? await revalidateReport(input.report, { ...input, env })
-    : await scan({ ...input, env });
-  audit.report = { createdAt: report.createdAt, totals: report.totals };
+    : goalMet(goal, diskBefore)
+      ? {
+          createdAt: new Date(options.now()).toISOString(),
+          items: [],
+          environments: [{ id: env.id, label: env.label }],
+          totals: {},
+        }
+      : await scan({
+          ...input,
+          env,
+          onScanPhase: async (phase) => {
+            audit.diskAfter = await escalate({
+              report: phase,
+              options: {
+                ...options,
+                tier: 'safe',
+                streaming: options.docker !== false,
+              },
+              env,
+              target,
+              goal,
+              audit,
+            });
+            return !goalMet(goal, audit.diskAfter);
+          },
+        });
+  audit.report = report;
   if (options.audit !== false) {
     await writeAudit(audit, { ...options, inProgress: true });
   }
-  let disk = diskBefore;
+  let disk = audit.diskAfter ?? diskBefore;
+  if (report.aborted) {
+    audit.scanReport = report;
+  }
   try {
     if (!goalMet(goal, disk)) {
       disk = await escalate({ report, options, env, target, goal, audit });
@@ -121,9 +152,11 @@ async function escalate({ report, options, env, target, goal, audit }) {
     ...options,
     env,
     onProgress: persistProgress,
+    priorHealth: audit.health,
+    timings: audit.timings,
   });
   audit.health = cleaner.health.records;
-  const done = new Set();
+  const done = new Set(audit.entries.map((entry) => entry.id));
   const targetDevice = await env.deviceId?.(target);
   const scoped = await Promise.all(
     wantedItems(report, options).map(async (item) => {
@@ -141,8 +174,10 @@ async function escalate({ report, options, env, target, goal, audit }) {
     })
   );
   const wanted = scoped.filter(Boolean);
-  let disk = audit.diskBefore;
-  let freed = 0;
+  let disk = audit.diskAfter ?? audit.diskBefore;
+  let freed = audit.entries
+    .filter((entry) => entry.status === 'planned')
+    .reduce((sum, entry) => sum + entry.plannedBytes, 0);
   for (const tier of TIERS.slice(0, tierRank(options.tier) + 1)) {
     audit.reachedTier = tier;
     const items = selectByTier(wanted, tier)