Function evict_plan 

pub fn evict_plan(
    entries: &[(PathBuf, SystemTime)],
    now: SystemTime,
    retention: Duration,
    free_bytes: u64,
    floor_bytes: u64,
) -> Vec<PathBuf>

Which cache dirs to delete, given every dir in a cache root with its last-modified time, the current free space on that filesystem, and the floor to hold.

Pure so the policy is one testable function shared by both holders of a cache root (yubaba on the worker, qed for local containers) instead of two drifting copies. The callers own the read_dir / df / remove.

Two rules, in order: everything idle past retention goes unconditionally; then, while free_bytes is under floor_bytes, the least-recently-used survivor goes — LRU because the dir a build just touched is the one whose loss costs the next run the most.

free_bytes is what the caller measured BEFORE any deletion, so the count of extra evictions is a heuristic (this function cannot know a dir’s size without walking it). It is bounded and monotone: under sustained pressure each sweep drops one more dir, and a root that is entirely evicted simply rebuilds cold — the failure mode is a slow build, never a full disk.