VPS DISK RECLAIM AUDIT

Audit time: 2026-09-30 02:59 to 03:20 UTC · host DMIT-uOjT3uwxqo · run as user claude (not root) · strictly read-only.

Limit of this audit: as a non-root user I can see about 12.05 GiB of the 17.30 GiB in use. About 5.25 GiB is not visible to me (root-only directories such as /var/lib/docker, /var/lib/dreamcode-runner, /var/lib/private, /root). That part is not in any total below. See section 12 for the root commands that would measure it.

1. Baseline

Disk total:     21,040,922,624 B = 19.6 GiB   (df -h: 20G, /dev/vda1, ext4, one filesystem for / /tmp /home /var /opt)
Disk used:      18,578,153,472 B = 17.30 GiB
Disk free:       1,533,476,864 B =  1.428 GiB  (02:59:31Z; latest reading 03:18Z: 1,527,312,384 B = 1.422 GiB)
Use %:          93%
Inodes:         172,317 used of 1,310,720 = 14%   (not a constraint)
RAM available:  659 MiB of 1.9 GiB total; swap 460 MiB used of 1.0 GiB
Disk zone (owner policy): RED (1.0-1.5 GiB)

The free space keeps shrinking on its own (1.529 -> 1.432 -> 1.422 GiB over the last hours) because a live Claude session is writing scratch data (see section 5).

2. Largest Directories

du -x, stays on the root filesystem. All sizes in MiB.

Inside /var:

Inside /home/claude:

Inside /tmp:

3. Reclaim Candidates

Mutually exclusive paths only. No parent/child double counting. All sizes were measured, except the journal target (an estimate: 112.8 MiB minus a 50 MiB cap).
"Root" means the command needs root.

Not counted, but real:

• apt-get clean also removes pkgcache.bin and srcpkgcache.bin (79.8 MiB). apt rebuilds them on its next run, so the gain is transient.
• /var/lib/apt/lists (89.2 MiB) is re-downloaded by the next apt update, so cleaning it is also transient.

4. Keep / Do Not Touch

5. Claude-Specific Footprint

~/.claude:            280.6 MiB
   projects (transcripts) 249.6 MiB   (age: <1d 12 files 55.7 MiB, 1-3d 100 files 88.4, 3-7d 17 files 37.1, 7-30d 38 files 66.6)
   plugins 15.4, file-history 10.2, skills 4.5, paste-cache 2.1, cache 0.8, telemetry 0.7 ...
Claude /tmp:          1549.1 MiB  (/tmp/claude-1000)
   live session scratchpad 1077.4 (active)
   stale sessions 277.6 + 121.9 + 26.9 + 18.7 (qa-baseline) + small
   age of files in /tmp/claude-1000: <1d 928.0 MiB, 1-3d 106.6, 3-7d 105.3, 7-30d 299.2, >30d 81.0
Claude program files: 461.0 MiB  (~/.local/share/claude/versions: 2.1.284 231.8 + 2.1.285 229.2)
Claude caches:        1.2 MiB    (~/.cache/claude-cli-nodejs)
Claude logs/history:  /tmp/claude-debug.log 32 KB; transcripts are the history (see projects above)
Other:                /tmp/claude-0 and /tmp/claude-993 are empty (4 KB)
Total:                about 2,292 MiB = 2.24 GiB = 11.4% of the disk, 12.9% of used space

Is Claude a long-term growth source? Yes, three ways:

1. Session scratch in /tmp: one live session has written about 1 GiB in roughly two days. Earlier sessions left about 445 MiB more. /tmp is on the same 20 GB filesystem, so it is not free space.
2. Program versions: each auto-update adds a 230 MiB binary and the previous one stays while it is running. Two are kept now.
3. Transcripts: about 50-90 MiB per day recently, in ~/.claude/projects.

6. Node / pnpm Footprint

pnpm cache:           110.9 MiB  (~/.cache/pnpm)
                        96.3 MiB created by the M1 installs -> Class A
                        14.4 MiB older, not mine -> left alone (no evidence either way)
pnpm store:            63.1 MiB  (~/.local/share/pnpm)  Class C, shared, hardlinked (link count 2 verified)
npm cache:             97.1 MiB  (~/.npm)  _cacache 79.3 -> A; _npx 17.8 -> B
project node_modules:  luckyai/frontend 64.2, remote-dev 63.6 (each shares files with the store, so real cost is much lower)
global packages:       ~/.npm-global 54.2 (pnpm itself), ~/.proto-tools 17.8 (playwright, used by e2e)  -> C
reclaimable estimate:  A 175.6 MiB (96.3 + 79.3), B 17.8 MiB

7. Python Footprint

pip cache:          56.2 MiB   (~/.cache/pip/http)  -> A.  uv and poetry caches: absent
user site-packages: 84.2 MiB   (~/.local/lib/python3.11)  -> D, purpose unknown
temporary venvs:    /tmp/pdfvenv 105.5 MiB -> B
project venvs:      luckyai/venv 110.3 (in use), case-qa-hub/venv 46.1 (in use: services run ./venv/bin/python),
                    .config/case-drop/venv 39.6 (tool), .local/share/pubmd/venv 22.0 (publishing tool) -> all C
reclaimable estimate: A 56.2 MiB, B 105.5 MiB

A venv is not a cache here: only /tmp/pdfvenv is temporary and unused.

8. Browser / Playwright Footprint

Playwright:    264.8 MiB  (~/.cache/ms-playwright: chromium_headless_shell-1243 259.9, ffmpeg 4.9)
               created 2026-09-29 09:57 (re-installed by a session after an earlier cleanup deleted it)
               used by production?           NO
               used by the current VPS workflow? YES: Lucky.ai dev e2e scripts (frontend/e2e/*.cjs) require
                 /home/claude/.proto-tools/node_modules/playwright-core, last run Sep 29
               reconstructible?              YES, about 260 MiB download
               running now: no browser process, 0 open handles
Chromium:      absent (~/.cache/chromium, ~/.config/chromium)
Other:         ~/.cache/luckyai-uxtest 14.9 MiB (test outputs); ~/.cache/puppeteer absent
reclaimable estimate: B 264.8 + 14.9 = 279.7 MiB

Under the current development model heavy browser tests belong on WSL, so this is the biggest strong candidate. It is classed B, not A, because the Lucky.ai e2e workflow on this VPS still uses it, and deleting it once already broke a running test.

9. Logs / Journal

journal:            112.8 MiB in /var/log/journal (journalctl reports 20.8M because I cannot read all journals). No SystemMaxUse set.
application logs:   /var/log/caddy active logs 136.1 MiB (mem 57.9, main 54.9, pdf 23.3), held open by Caddy
rotated logs:       10 files main.fennec-lucky.com-*.log.gz, 66.0 MiB, Aug 16 to Sep 28 (2 are older than 30 days: 14 MiB)
other:              /var/log/installer 13.9 MiB (old installer logs)
reclaimable estimate: B ~62.8 (journal to 50 MiB) + B 66.0 (rotated caddy) = ~128.8 MiB. Both need root.

Caddy rotates its own logs (its default keeps the last 10 rolled files), so the rotated set does not grow without bound. Active logs must not be truncated while Caddy holds them.

10. APT / Package Cache

apt archives:       18.4 MiB   (1 file: cloudflared_2026.9.3_amd64.deb)  -> A
apt cache files:    79.8 MiB   (pkgcache.bin 39.9 + srcpkgcache.bin 39.9)  regenerate on next apt run, transient
apt lists:          89.2 MiB   (/var/lib/apt/lists)  re-downloaded by next `apt update`, transient
debconf etc.:       4.9 MiB    /var/cache/debconf, leave
reclaimable estimate: A 18.4 MiB durable (+79.8 MiB transient if `apt-get clean` is used)

Safe mechanism: apt-get clean (root). Not /var/lib/dpkg.

11. Backups / Bundles / Archives

Git repositories: remote-dev .git 920 KB (has origin); Lucky.ai dev .git 7.2 MiB, 987 loose objects, no remote; cdesktop-custom .git 95 MiB (one pack, has upstream). git gc would save only a few MiB, so it is not recommended. Build outputs (dist, build, coverage, ...) outside node_modules: none above 1 MiB.

12. Estimated Recovery

Class A (mutually exclusive):
  pnpm download cache (M1 installs)      96.3 MiB
  npm _cacache                           79.3 MiB
  pip http cache                         56.2 MiB
  /tmp/tmp1r7nbs2p                       16.6 MiB
  apt archive (cloudflared .deb)         18.4 MiB
  -------------------------------------------------
  SAFE_RECLAIM_A                        266.8 MiB   (248.4 without root, 18.4 with root)

Class B (mutually exclusive):
  ms-playwright                         264.8 MiB
  pages/ (stale case-17441 scratch)     154.4 MiB
  by-codex-upload scratch               121.9 MiB
  /tmp/pdfvenv                          105.5 MiB
  caddy rotated logs (root)              66.0 MiB
  journal to 50 MiB (root, estimate)    ~62.8 MiB
  dreamcode-runtime-audit                32.3 MiB
  dreamcode-spec scratch                 26.9 MiB
  ~/.npm/_npx                            17.8 MiB
  luckyai-uxtest                         14.9 MiB
  -------------------------------------------------
  CLASS_B_ADDITIONAL                    867.3 MiB   (738.5 without root, 128.8 with root)

SAFE_PLUS_B = 266.8 + 867.3 = 1,134.1 MiB

CURRENT_FREE                       1,462.4 MiB = 1.428 GiB   (RED)
+ SAFE A                            + 266.8 MiB
PROJECTED_FREE_AFTER_A             1,729.2 MiB = 1.689 GiB   (YELLOW)

+ CLASS B                           + 867.3 MiB
PROJECTED_FREE_AFTER_A_PLUS_B      2,596.5 MiB = 2.536 GiB   (GREEN)

Without any root action: A 248.4 -> 1.671 GiB; A+B 986.9 MiB -> 2.392 GiB.

These projections are estimates, not promises. Actual free space can differ because of sparse files, files deleted while still open, ext4 metadata and block rounding, and hardlinks. Free space is also moving on its own: the live session's scratch is growing, so any number is only right at the moment of measurement.

The largest unknown is the ~5.25 GiB I cannot see. To measure it (read-only, as root):

du -x -h -d1 /var/lib/docker /var/lib/dreamcode-runner /var/lib/private /root 2>/dev/null | sort -h
docker system df
journalctl --disk-usage
lsof +L1 2>/dev/null | head        # deleted-but-still-open files held by any user

Docker is running (two containers, Vaultwarden among them). Its images and layers are the most likely large part.

13. Recommended Cleanup Order

Ranked by class first, then size x safety, then rebuild cost, then effect on the workflow.

1. A pnpm download cache (M1 installs): 96.3 MiB, no workflow effect
2. A npm _cacache: 79.3 MiB
3. A pip http cache: 56.2 MiB
4. A /tmp/tmp1r7nbs2p: 16.6 MiB
5. A apt-get clean (root): 18.4 MiB
   (after step 5 the host is back in yellow, about 1.69 GiB)
6. B /tmp/pdfvenv: 105.5 MiB, safe, nothing uses it
7. B case-17441 .../scratchpad/pages: 154.4 MiB, regenerable
8. B by-codex-upload scratch: 121.9 MiB
9. B dreamcode-runtime-audit 32.3 + dreamcode-spec scratch 26.9 (retired project)
10. B journal cap (root): ~62.8 MiB
11. B rotated Caddy logs (root): 66.0 MiB
12. B ~/.npm/_npx 17.8 + luckyai-uxtest 14.9
13. B ms-playwright: 264.8 MiB. Biggest single item, but it needs your workflow decision (move Lucky.ai e2e to WSL, or accept a 260 MiB re-download)

Not on the list but worth a decision: the 455 MiB "duplicate" release backup, the three copies of the 17441 case package (~300 MiB), the retired cdesktop2 release (143.7 MiB), and asking the owner of the live session whether its 732 MiB of SQLite benchmark files can be pruned.

14. Commands Awaiting Approval

DO NOT RUN THEM. Each one is an exact path. Preview first (the find/du lines are read-only).

# ---------- SAFE A ----------
# A1 pnpm download cache created by the M1 installs (preview, then delete)
find /home/claude/.cache/pnpm -type f -newermt "2026-09-30 01:29:53" -printf '%s\t%p\n' | awk -F'\t' '{s+=$1;n++} END{printf "%d files, %.1f MiB\n",n,s/1048576}'
find /home/claude/.cache/pnpm -type f -newermt "2026-09-30 01:29:53" -print0 | xargs -0 rm --

# A2 npm download cache
rm -rf -- /home/claude/.npm/_cacache

# A3 pip HTTP cache
rm -rf -- /home/claude/.cache/pip/http

# A4 leftover Python temp dir
rm -rf -- /tmp/tmp1r7nbs2p

# A5 apt package archive (ROOT). Also drops apt's two cache files, which apt rebuilds later
apt-get clean

# ---------- VERIFY-FIRST B ----------
# B1 temporary venv (confirm nothing needs the pdf tooling in /tmp)
rm -rf -- /tmp/pdfvenv

# B2 regenerable page renders in stale case-17441 scratch (ex/ next to it is NOT touched)
rm -rf -- /tmp/claude-1000/-home-claude-case-17441/f3660e4b-6c45-455c-8324-94b0992879a3/scratchpad/pages

# B3 stale by-codex-upload sessions (check no output there is still wanted)
rm -rf -- /tmp/claude-1000/-home-claude-case-17441-by-codex-upload

# B4 retired DreamCode leftovers (save EXISTING_SOLUTION_AUDIT.md first if you want it)
rm -rf -- /tmp/dreamcode-runtime-audit
rm -rf -- /tmp/claude-1000/-home-claude-case-17441-DreamCode-dreamcode-spec

# B5 journal cap (ROOT)
journalctl --vacuum-size=50M

# B6 rotated Caddy access logs (ROOT). Preview: ls -l /var/log/caddy/main.fennec-lucky.com-*.log.gz
find /var/log/caddy -maxdepth 1 -name 'main.fennec-lucky.com-*.log.gz' -print0 | xargs -0 rm --

# B7 small caches
rm -rf -- /home/claude/.npm/_npx
rm -rf -- /home/claude/.cache/luckyai-uxtest

# B8 Playwright browsers (only after deciding the Lucky.ai e2e runs on WSL, or accepting the re-download).
#    Re-download later: cd /home/claude/.proto-tools && node node_modules/playwright-core/cli.js install chromium-headless-shell
rm -rf -- /home/claude/.cache/ms-playwright

Before B3 and B4 delete anything, close the review items in section 11 for the same directories (the unique PDFs, synth_out and temp DBs in -home-claude-case-17441 are not covered by these commands).

15. Final Status

AUDIT_COMPLETE_NO_FILES_DELETED

• No user or system files deleted.
• No caches pruned.
• No logs truncated.
• No packages removed.
• No repository modified.
• No service restarted.

Two disclosures, so the record is accurate:

• I removed two tiny temporary listing files that this audit itself created in my session scratch directory (a.list and b.list, a few KB, used to compare file names between the two case folders). Nothing else was removed.
• The only file written is this report. Read-only commands such as du, find, lsof, git count-objects and journalctl --disk-usage can update file access times, which is not a content change.

Waiting for your explicit approval of specific candidates.