The cleanup agent that deleted my model caches

On September 29, 2026, at about 11:41 Pacific, I asked an agent to free up disk space. By its own measure it did a good job. It found big folders nobody had touched in a while and deleted them.

Two of them were my local model caches, ~/.cache/huggingface and ~/.ollama/models. A training run that was reading from them broke partway through. Our CI didn’t notice, because the check that guards our model list is a static scan.

The agent did what it was asked with what it knew. Nothing had told it which big, quiet folders mattered.

It happened twice more

October 6. A cleanup session removed 286 temporary directories in one batch, filtered only by modification time, with no check of each folder before it went. One of them was a live test fixture. The test using it failed mid-run with MODULE_NOT_FOUND. The lesson written into our rules: a scan over a batch of temp folders is not proof that nothing is about to read one. Check each item right before you delete it.

October 21. I approved a restart to reclaim swap space. macOS empties /private/tmp and the per-user temp folder at boot. Some frozen evidence from an earlier investigation was sitting there, cited by a handoff doc. The cleanup session had been careful to keep those folders during the cleanup itself. It just hadn’t copied them anywhere before the restart. We rebuilt 243 files byte for byte, and every checksum matched. Some older run outputs were lost for good. None of them were needed to resume the work.

Measure with df

The October cleanup shows why the measuring rule matters. At the start, the data volume was 99% full, with 6.8 GB free. By the time it was done, before the restart, there were 80.4 GB free. After the restart, 92.8 GB.

Every one of those numbers came from df. That matters more than it sounds. du tells you how big a folder looks. df tells you how much free space the disk actually has. On a Mac those can be very different: cloned files share storage, local snapshots keep deleted data alive, and a file a running process still has open keeps its space until the process exits. An agent that scores itself by du can delete a lot of important things and get almost nothing back.

The audit also found the cause that would have kept filling it. Our own test suites weren’t cleaning up their temporary databases. On October 18 alone they left 3,862 folders behind, 29.9 GiB in all. Clearing 4,139 stale test folders was the single biggest win of the day, worth 34.6 GB by df. The fix for the tests was certified and ready to land the same day: zero leaked folders per run with it, against about six folders and 115 MiB for every five checks without it.

What my agents read now

The top of my global agent instructions now starts with a list of paths no agent may ever delete, and three rules for everything else. Here is the shape of it, with example paths:

## Disk cleanup: never delete these paths

Before any cleanup, dedupe or "reclaim space" task, read this section.
Never delete, move or archive these, even if they look stale or huge:

- `~/models/`: pinned local model files.
- `~/.ollama/models`: the Ollama model store.
- `~/.cache/huggingface`: weights in use by running jobs.
- Any `*.key`, `*.pem` or `*.age` file. Loss is unrecoverable.

Anything else you may delete only when it is verifiably safe:
1. Nothing is using it right now (check open files and running processes).
2. No document, report or ticket cites a file inside it.
3. You write a manifest of what you deleted, and why, before deleting.

Measure free space with `df`, never `du`.

A restart, logout or OS update wipes `/tmp`, `/private/tmp` and `$TMPDIR`.
Before one, copy anything you will cite later to durable storage and check the copy.

What it cost to learn

A broken training run, a failed test and an afternoon of rebuilding evidence. A person who had worked on that machine for a month would probably have known which folders mattered. An agent starts every session as a stranger to your disk.

So tell it. Write down what must never be deleted, how to prove something else is safe to delete, and how to measure what it got back. Then make it write down what it did.