Module fsck 

keel fsck — journal integrity check, safe repairs, and retention pruning (architecture spec §6: “journal corruption → SQLite WAL recovery, plus keel fsck”).

The check pass is read-only and safe against a live application. It runs, in order:

1. PRAGMA integrity_check — page-level SQLite corruption. Unrepairable here (WAL recovery already ran at open), so a failure short-circuits the structural checks and points at restore-or-recreate.
2. The frozen-schema presence check — is this file a keel journal at all?
3. The flow-ledger invariants (keel_journal::admin documents each and why its repair is safe): orphan steps (dangerous: deterministic flow ids mean a rerun would replay a stranger’s steps), dangling leases (lease fields on a non-running flow), stale running steps (a running step inside a completed/dead flow), and the expired cache backlog. Dead flows are reported for visibility, never repaired — they are the evidence keel flows --dead inspects.

--fix applies exactly those safe repairs (plus a WAL checkpoint to reclaim space); checks in the report always describes the pre-fix state and repairs what was done, so one run tells the whole story.

Retention: --prune <AGE>

There is no retention key in the frozen policy schema, so retention is an explicit operator action: keel fsck --prune 30d deletes completed flows (and their steps) not updated for the given age — never running (resumable), failed (resumable), or dead (evidence), and never a flow with outbox rows. Caveat printed with every prune: a pruned flow cannot replay; rerunning the same entrypoint+args starts a fresh flow that executes live.

Determinism (dx-spec §5): the --json twin is a pure function of the journal bytes and the injected now — no wall-clock reads here.

Structs

FsckOptions

The keel fsck switches: apply safe repairs, and/or prune completed flows older than an age ("90s", "45m", "12h", "30d").

Functions

run

keel fsck [--fix] [--prune <AGE>] for project, judging cache expiry and prune cutoffs against the injected now_ms.