The problem
An append-only store that never reclaims grows with every write, including every rewrite of the same record. Reclaim is what makes append-only affordable.
Reachability, not age
The vacuum walks from every durable pin: the branch heads, the retained snapshots, and any reference directory you name. Everything it reaches is kept. Everything else is the deletion set.
Two commands
stats reports. It enumerates the store strictly, walks reachability, and tells you what is live and what is reclaimable. It deletes nothing.
vacuum --dry-run runs the whole pass and reports the deletion set without removing anything. vacuum --sweep removes exactly that set. Any policy blocker refuses before deletion. A failure during unlinking is reported with the progress reached.
haematite vacuum /var/lib/haematite/ward --dry-runThe step-by-step is in Storage and vacuum.