Harden storage cleanup and disk admission

[Th0rgal]

What changed

• reduce default mission-workspace retention to 1 day, with 7 days for paused/awaiting-user missions
• make the GC interval configurable and trigger an immediate, non-overlapping sweep under disk pressure
• add optional admission refusal at the warning threshold
• apply a configurable default disk estimate to local missions that omit one, while allowing remote-node missions to bypass local disk admission
• add an aggressive host cleanup script for stale DB backups, OpenCode logs/cache, Hermes staging/quarantine, oversized logs, and journals
• document the high-churn build-host profile and all new controls

Why

The production host hit ENOSPC twice even though workspace GC was enabled. GC ran only hourly, retained terminal work for seven days, reclaimed only standard mission directories, and admitted almost every mission without a disk estimate until the filesystem reached the critical threshold. Large parallel Lean/build fan-outs could consume the remaining capacity before the next sweep.

Production impact

This keeps execution opt-in through WORKSPACE_GC_EXECUTE, but makes enabled cleanup substantially faster and shorter-lived. Dedicated build hosts can refuse admission at Warn and assign a fail-safe estimate to requests that omit one. Remote-node work remains available during local disk pressure.

Validation

• cargo fmt --all --check
• cargo check
• cargo test mission_workspace_gc --lib (5 passed)
• cargo test disk_estimate_preserves_emergency_free_space --lib (1 passed)
• bash -n scripts/storage_hard_cleanup.sh
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandboxed-dashboard	Ready	Preview, Comment	Jul 20, 2026 3:14pm
sandboxed-sh	Ready	Preview, Comment	Jul 20, 2026 3:14pm

[Th0rgal]

Superseded by #643, rebuilt from the updated master so the PR contains only the storage-hardening commit.