diff --git a/app/src-tauri/src/commands/migration_commands.rs b/app/src-tauri/src/commands/migration_commands.rs
index 1327f15..a9ee7a2 100644
--- a/app/src-tauri/src/commands/migration_commands.rs
+++ b/app/src-tauri/src/commands/migration_commands.rs
@@ -227,58 +227,40 @@ async fn container_label(container_id: &str, label: &str) -> Option<String> {
 // Migrate
 // ─────────────────────────────────────────────────────────────────────────────
 
-/// Project ids with a migration running **in this process right now**.
-///
-/// Two things need it. `reconcile_project_statuses` is callable from the
-/// frontend at any time, not only at startup, and a live migration looks
-/// exactly like a crashed one from the outside (state file says `in-progress`,
-/// container carries the label) — without this guard a reconcile mid-run would
-/// rewrite the phase to `interrupted` underneath a migration that is fine.
-/// It also makes a second concurrent `migrate_project_to_base` for the same
-/// project impossible.
-static ACTIVE_MIGRATIONS: std::sync::OnceLock<
-    std::sync::Mutex<std::collections::HashSet<String>>,
-> = std::sync::OnceLock::new();
-
-fn active_migrations() -> &'static std::sync::Mutex<std::collections::HashSet<String>> {
-    ACTIVE_MIGRATIONS.get_or_init(|| std::sync::Mutex::new(std::collections::HashSet::new()))
-}
-
 /// Whether a migration for this project is running **in this process right
 /// now**. Every command that stops, removes or recreates the project's
 /// container has to consult it: the window between `remove_container` and the
 /// create that follows looks exactly like "no container", and an ordinary
 /// Start landing in it creates a second container under the same name.
+///
+/// **This is now a view onto [`crate::project_lock`], not a set of its own.**
+/// It used to be the app's only mutual-exclusion primitive, and it was one-way:
+/// a migration claimed a project, everything else merely polled this once at
+/// entry and never claimed anything. Two non-migration writers of
+/// `triple-c-snapshot-{id}:latest` — a compaction and a recreate — could not
+/// see each other at all. Folding the set into the shared registry means there
+/// is exactly one answer to "is something happening to this project", and this
+/// function is the specialisation of it that reconcile still needs: a *live*
+/// migration is indistinguishable from a crashed one from the outside, and only
+/// this process knows which it is looking at.
 pub(crate) fn is_migrating(project_id: &str) -> bool {
-    active_migrations()
-        .lock()
-        .unwrap_or_else(|e| e.into_inner())
-        .contains(project_id)
+    crate::project_lock::is_held_by(project_id, crate::project_lock::ProjectOp::Migration)
 }
 
-/// RAII marker: removes the project from [`ACTIVE_MIGRATIONS`] however the
-/// migration ends, including an early `?`.
-struct ActiveGuard(String);
+/// RAII marker: releases the project's [`crate::project_lock`] claim however
+/// the migration ends, including an early `?`.
+///
+/// Kept as a named type rather than using [`crate::project_lock::ProjectGuard`]
+/// directly so the migration path keeps reading as "take the migration guard",
+/// and so the one place that decides what a migration's claim *is* stays here.
+struct ActiveGuard(#[allow(dead_code)] crate::project_lock::ProjectGuard);
 
 impl ActiveGuard {
-    /// `None` when a migration is already running for this project.
+    /// `None` when a migration — or anything else — already holds this project.
     fn acquire(project_id: &str) -> Option<Self> {
-        let mut set = active_migrations()
-            .lock()
-            .unwrap_or_else(|e| e.into_inner());
-        if !set.insert(project_id.to_string()) {
-            return None;
-        }
-        Some(Self(project_id.to_string()))
-    }
-}
-
-impl Drop for ActiveGuard {
-    fn drop(&mut self) {
-        active_migrations()
-            .lock()
-            .unwrap_or_else(|e| e.into_inner())
-            .remove(&self.0);
+        crate::project_lock::try_acquire(project_id, crate::project_lock::ProjectOp::Migration)
+            .ok()
+            .map(Self)
     }
 }
 
@@ -1163,7 +1145,23 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
                 }
             }
         }
-        Ok(None) => return,
+        Ok(None) => {
+            // **`Ok(None)` is not the same as "no file".** `migration_store::load`
+            // now reports an *unparseable* record as absent while deliberately
+            // leaving it on disk, so that `has_record` goes on protecting the
+            // rollback pin it describes. Returning here on that would leave the
+            // file — and therefore a permanently "claimed" pin — behind a Reset
+            // that has just deleted the snapshot and both volumes the record
+            // could possibly refer to.
+            if !migration_store::has_record(project_id).unwrap_or(false) {
+                return;
+            }
+            log::warn!(
+                "Project {} has a migration record that could not be read; removing it anyway \
+                 because a Reset supersedes it",
+                project_id
+            );
+        }
         Err(e) => log::warn!(
             "Could not read the migration record for {} while cleaning up: {}",
             project_id,
@@ -1172,6 +1170,10 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
     }
     let _ = migration_store::clear_staging(project_id);
     let _ = migration_store::clear(project_id);
+    // The pins this project had are gone with the snapshot; their grace clocks
+    // are meaningless and would otherwise sit in the migrations directory
+    // forever.
+    migration_store::clear_ownerless_for_project(project_id);
 }
 
 fn default_docker_socket() -> String {
diff --git a/app/src-tauri/src/commands/project_commands.rs b/app/src-tauri/src/commands/project_commands.rs
index 09030ef..0473b64 100644
--- a/app/src-tauri/src/commands/project_commands.rs
+++ b/app/src-tauri/src/commands/project_commands.rs
@@ -221,20 +221,35 @@ pub async fn start_project_container(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<Project, String> {
-    // A migration removes the container and creates its replacement moments
-    // later. Starting in that window finds no container, creates a second one
-    // under the same name, and the migration's own create then fails on the
-    // name conflict — which sends it into an auto-rollback that also cannot
-    // create. The UI already refuses (`canMigrate` gates on the container being
-    // stopped and no run being in flight); this is the same gate on the side
-    // that actually owns the invariant.
-    if crate::commands::migration_commands::is_migrating(&project_id) {
-        return Err(
-            "A container base update is running for this project. Wait for it to finish, then start the project."
-                .to_string(),
-        );
-    }
+    // **Acquired, not polled.** A migration removes the container and creates
+    // its replacement moments later. Starting in that window finds no
+    // container, creates a second one under the same name, and the migration's
+    // own create then fails on the name conflict — which sends it into an
+    // auto-rollback that also cannot create. This used to be a one-shot
+    // `is_migrating` read, which covered that case and no other: a start also
+    // commits `triple-c-snapshot-{id}:latest`, so it races a *compaction*
+    // committing the same tag with nothing between them. The claim is held for
+    // the whole start rather than checked at its door.
+    //
+    // The UI already refuses (`canMigrate` gates on the container being stopped
+    // and no run being in flight); this is the same gate on the side that
+    // actually owns the invariant.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Recreate)?;
+    start_project_container_locked(project_id, app_handle, state).await
+}
 
+/// The body of [`start_project_container`], with **no claim of its own**.
+///
+/// Split out for exactly one caller: [`rebuild_project_container`] already
+/// holds the project under [`crate::project_lock::ProjectOp::Reset`] for its
+/// whole run, and a Reset that then went through the public command would be
+/// refused by its own guard. Every other path must go through the command.
+async fn start_project_container_locked(
+    project_id: String,
+    app_handle: tauri::AppHandle,
+    state: State<'_, AppState>,
+) -> Result<Project, String> {
     let mut project = state
         .projects_store
         .get(&project_id)
@@ -539,6 +554,14 @@ pub async fn stop_project_container(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
+    // Stop had **no** exclusion at all, which is the one gap CLAUDE.md's "every
+    // command that stops, removes or recreates the container consults
+    // `is_migrating`" rule already named and this function did not honour. A
+    // stop lands on the container a migration is mid-swap on, and it closes the
+    // exec sessions a compaction's config replay is not expecting to lose.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Recreate)?;
+
     let project = state
         .projects_store
         .get(&project_id)
@@ -571,13 +594,13 @@ pub async fn rebuild_project_container(
 ) -> Result<Project, String> {
     // Reset deletes both volumes and the snapshot image. Doing that while a
     // migration is mid-flight pulls the ground out from under it and leaves an
-    // orphan migration record pointing at images that no longer exist.
-    if crate::commands::migration_commands::is_migrating(&project_id) {
-        return Err(
-            "A container base update is running for this project. Wait for it to finish before resetting."
-                .to_string(),
-        );
-    }
+    // orphan migration record pointing at images that no longer exist — and
+    // doing it while a *compaction* is mid-flight is worse, because the
+    // compaction then commits `flat(old)` back over the `:latest` this just
+    // destroyed and resurrects the system layer the user asked to be rid of.
+    // Held for the whole Reset, including the start at the end of it.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Reset)?;
 
     let project = state
         .projects_store
@@ -611,8 +634,9 @@ pub async fn rebuild_project_container(
         log::warn!("Failed to remove project volumes for project {}: {}", project_id, e);
     }
 
-    // Start fresh
-    start_project_container(project_id, app_handle, state).await
+    // Start fresh. The locked variant, because `_guard` above is this project's
+    // claim and the public command would be refused by it.
+    start_project_container_locked(project_id, app_handle, state).await
 }
 
 /// Reconcile project statuses against actual Docker container state.
@@ -656,9 +680,14 @@ pub async fn reconcile_project_statuses(
         ) {
             continue;
         }
-        // ...but never for a project this process is actively migrating: the
-        // container is legitimately absent for part of that run.
-        if crate::commands::migration_commands::is_migrating(&project.id) {
+        // ...but never for a project this process is actively working on. A
+        // migration's container is legitimately absent between the
+        // `remove_container` and the create that follows, and so is a Reset's,
+        // and so is a start's before its create returns. Reconciling into any
+        // of those windows writes `Stopped` over a project that is mid-run.
+        // Broadened from `is_migrating` to the whole lock for exactly that
+        // reason — the migration was never the only operation with a gap.
+        if crate::project_lock::held(&project.id).is_some() {
             continue;
         }
 
diff --git a/app/src-tauri/src/docker/disk.rs b/app/src-tauri/src/docker/disk.rs
index 43d7b65..f1007bc 100644
--- a/app/src-tauri/src/docker/disk.rs
+++ b/app/src-tauri/src/docker/disk.rs
@@ -75,6 +75,23 @@ use crate::storage::migration_store;
 /// its warm cache and short enough that abandoned trees are collected.
 pub const BUILD_CACHE_DEFAULT_UNTIL_HOURS: i64 = 168;
 
+/// How long [`docker_cli`] waits for the `docker` command line tool.
+///
+/// Long enough for `buildx du` over a large build tree on a cold daemon, short
+/// enough that a wedged daemon does not hold the Scan button down forever. A
+/// prune uses the same bound; a prune that outruns it has still done its work
+/// on the daemon, and the next scan reports the result.
+const DOCKER_CLI_TIMEOUT_SECS: u64 = 45;
+
+/// The bound for a `builder prune`, which is a different kind of wait.
+///
+/// `buildx du` is a query and 45 seconds is generous for it. A prune of a
+/// 60 GB cache genuinely takes minutes, and cancelling it does not undo the
+/// daemon-side work — it only loses the `Total reclaimed space:` line, so the
+/// run would be reported as a failure that in fact freed the space. Ten minutes
+/// is a bound against a wedged daemon rather than against a slow one.
+const DOCKER_PRUNE_TIMEOUT_SECS: u64 = 600;
+
 // ---------------------------------------------------------------------------
 // Scan result
 // ---------------------------------------------------------------------------
@@ -123,6 +140,27 @@ pub struct ProjectDiskRow {
     pub home_volume_present: bool,
     pub config_volume_bytes: i64,
     pub config_volume_present: bool,
+    /// **The one snapshot figure the row adds up from.**
+    ///
+    /// The Snapshot column shows this and [`Self::total_bytes`] is computed
+    /// from it, so the Total column reconciles with its parts. It did not
+    /// before: `total_bytes` used `size - shared_size` unconditionally while
+    /// the column fell back to [`Self::snapshot_above_base_bytes`] or to `—`,
+    /// and in that fallback branch `size - shared_size` is the *whole base
+    /// image*. A row could show `—` for its snapshot and still carry 4.7 GB of
+    /// base in its total, which `triple_c_total_bytes` then added again as a
+    /// base-image row.
+    ///
+    /// The rule, in order:
+    ///
+    /// 1. `df()` computed a shared size → `size - shared`, the daemon's own
+    ///    measurement of what is unique to this image.
+    /// 2. No shared size but the base lineage is known → the layer arithmetic
+    ///    in [`layer_stats`].
+    /// 3. Neither → the full size. Not a fallback to zero: an image nothing
+    ///    shares with and whose lineage is unknown really does cost its whole
+    ///    size, and a flattened snapshot is exactly that shape.
+    pub snapshot_attributed_bytes: i64,
     pub total_bytes: i64,
     /// A migration is in flight; every action on this row is blocked.
     pub migrating: bool,
@@ -293,8 +331,6 @@ pub enum ReclaimTarget {
     ProbeContainers,
     /// `triple-c-scrub-*` containers left by an interrupted secret rewrite.
     ScrubContainers,
-    /// One orphaned volume, ticked individually by name.
-    OrphanVolume { name: String },
     /// Rewrite a project's stacked commit layers into a single layer. The
     /// highest-yield action in this module.
     CompactSnapshot { project_id: String },
@@ -325,6 +361,27 @@ pub enum DestructiveTarget {
     /// A rollback pin whose migration is still awaiting confirmation — the only
     /// copy of that migration's rollback target.
     RollbackPin { project_id: String, tag: String },
+    /// A `triple-c-home-*` / `triple-c-claude-config-*` volume whose project id
+    /// is in no `projects.json` this app can find.
+    ///
+    /// **It was a `ReclaimTarget` at `Safety::Safe`** — a tick and the group
+    /// Reclaim button, no confirmation. The object behind that tick is a
+    /// `triple-c-claude-config-*` volume holding a Claude OAuth credential,
+    /// every installed plugin and skill, and every conversation transcript the
+    /// project ever had, and the *same volume* for a project still in the store
+    /// requires typing the project's name. The only difference between the two
+    /// is a lookup against a file this app has been wrong about before: a
+    /// second app instance's project is absent from an in-memory list, a
+    /// corrupt `projects.json` empties it, and a data directory restored
+    /// without it empties it too. So it is confirmed like everything else that
+    /// has no other copy — see [`destroy`], where the typed string is the
+    /// **volume name**, there being no project name to type.
+    OrphanVolume {
+        name: String,
+        /// The id parsed out of the volume name. Display only — it names no
+        /// project in the store, which is the whole reason this variant exists.
+        project_id: String,
+    },
 }
 
 impl ReclaimTarget {
@@ -339,7 +396,6 @@ impl ReclaimTarget {
             | ReclaimTarget::MigrationStaging
             | ReclaimTarget::ProbeContainers
             | ReclaimTarget::ScrubContainers
-            | ReclaimTarget::OrphanVolume { .. }
             | ReclaimTarget::BuildCache { .. } => Safety::Safe,
             // A rewrite and a cache flush: nothing is lost, but time is.
             ReclaimTarget::CompactSnapshot { .. } | ReclaimTarget::ClearCaches { .. } => {
@@ -373,9 +429,11 @@ impl DestructiveTarget {
             DestructiveTarget::HomeVolume { project_id }
             | DestructiveTarget::ConfigVolume { project_id }
             | DestructiveTarget::SnapshotImage { project_id }
-            | DestructiveTarget::RollbackPin { project_id, .. } => project_id,
+            | DestructiveTarget::RollbackPin { project_id, .. }
+            | DestructiveTarget::OrphanVolume { project_id, .. } => project_id,
         }
     }
+
 }
 
 /// One offered action, with its measured cost.
@@ -577,6 +635,33 @@ pub fn parse_project_volume_name(name: &str) -> Option<(&str, &'static str)> {
     None
 }
 
+/// This project's share of its snapshot image, in bytes.
+///
+/// The single rule behind [`ProjectDiskRow::snapshot_attributed_bytes`], pulled
+/// out of [`scan`] so it can be tested without a daemon — the bug it fixes was
+/// two call sites disagreeing, and a rule that lives in one function cannot
+/// disagree with itself.
+///
+/// 1. `df()` computed a shared size → `size - shared`. The daemon's own
+///    measurement of what is unique to this image, and the only exact answer
+///    available.
+/// 2. No shared size, but the base lineage is known → the layer arithmetic from
+///    [`layer_stats`].
+/// 3. Neither → `size - shared`, which with no shared size is the full image.
+///    Deliberately not zero: an image that shares nothing measurable really
+///    does cost its whole size, and a flattened snapshot is exactly that shape.
+pub fn snapshot_attribution(
+    snapshot_bytes: i64,
+    snapshot_shared_bytes: i64,
+    above_base_bytes: Option<i64>,
+) -> i64 {
+    let unique = (snapshot_bytes - snapshot_shared_bytes.max(0)).max(0);
+    if snapshot_shared_bytes > 0 {
+        return unique;
+    }
+    above_base_bytes.map(|b| b.max(0)).unwrap_or(unique)
+}
+
 /// What a snapshot's layer stack looks like relative to its base.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
 pub struct LayerStats {
@@ -795,34 +880,85 @@ pub fn parse_reclaimed_space(output: &str) -> i64 {
 /// never match, and the flattened intermediate is left to whatever `untag_image`
 /// happens to delete on its own.
 pub fn compaction_dockerfile(snapshot_ref: &str, scrub_script: &str) -> String {
-    // The scrub script is multi-line shell. `RUN` takes it verbatim only if the
-    // newlines are escaped, so it is folded onto one line with `;` separators —
-    // the script is already a sequence of statements and a `for` loop, both of
-    // which survive that.
-    let folded = fold_shell_script(scrub_script);
     format!(
         "FROM {snapshot_ref} AS src\n\
-         RUN {folded}\n\
+         RUN {run}\n\
          FROM scratch\n\
          COPY --from=src / /\n\
-         LABEL {LABEL_MANAGED}=true\n"
+         LABEL {LABEL_MANAGED}=true\n",
+        run = run_exec_form(scrub_script)
     )
 }
 
-/// Collapse a multi-line `/bin/sh` program into a single `RUN` line.
+/// Render a multi-line `/bin/sh` program as a `RUN` the daemon will actually
+/// execute.
 ///
-/// Blank lines go; every other line is joined with a space. The script's own
-/// syntax already terminates its statements (`;` inside the `for`, newlines
-/// after each simple command are not load-bearing because each line here is a
-/// complete word sequence), so this is a join and not a rewrite — but it is
-/// pinned by a test against the real script for exactly that reason.
-fn fold_shell_script(script: &str) -> String {
-    script
-        .lines()
-        .map(str::trim)
-        .filter(|line| !line.is_empty())
-        .collect::<Vec<_>>()
-        .join(" ")
+/// ## What was here before, and why it never worked once
+///
+/// The scrub script is multi-line shell, and a Dockerfile instruction does not
+/// continue over a bare newline — so the script was folded onto one line by
+/// joining its lines **with a space**. That is not a rewrite the shell
+/// tolerates. `for p in …` on one line and `do` on the next are separated by a
+/// newline that *is* load-bearing; joining them produces
+/// `… for p in …; do [ -e "$p" ] || continue sz=$(…) …`, and `sh` stops at:
+///
+/// ```text
+/// /bin/sh: line 0: syntax error: unexpected "do"
+/// ERROR: process "/bin/sh -c total=0 for p in …" did not complete successfully: exit code: 2
+/// ```
+///
+/// Verified with a real `docker build`, not reasoned about. The build failed on
+/// its first stage every single time, so `compact_snapshot` has always returned
+/// a failure — the headline action of the whole panel, broken since it landed.
+/// Nothing was lost, because the failure is before anything is removed, but
+/// nothing was ever reclaimed either. The test that was supposed to catch this
+/// asserted only that the `RUN` was *one line*, which the broken fold satisfied
+/// perfectly.
+///
+/// ## Why the JSON exec form rather than a better fold
+///
+/// Any fold is a rewrite of somebody else's shell, and the script is not this
+/// module's to own — `container::snapshot_scrub_script` is free to grow a
+/// `case`, an `if`, a heredoc or a function, and each of those breaks a
+/// different set of join rules. Inserting `;` between lines is wrong for
+/// exactly the same reason a space was: `; do` is fine, but `if x; then; y` is
+/// not.
+///
+/// So the script is not transformed at all. `RUN ["/bin/sh", "-c", "<script>"]`
+/// is the exec form, its arguments are a JSON array, and JSON strings carry
+/// newlines as `\n` escapes — so the program reaches `sh` byte-for-byte as
+/// written, on one Dockerfile line, with no assumption about its shape. The
+/// exec form does not go through a shell of its own, which is why `/bin/sh -c`
+/// is named explicitly.
+///
+/// A BuildKit heredoc (`RUN <<EOF`) would also work and is not available here:
+/// [`build_from_dockerfile`] goes through bollard's plain `POST /build`, i.e.
+/// the classic builder with no BuildKit session, where the heredoc syntax is
+/// not parsed.
+fn run_exec_form(script: &str) -> String {
+    // `serde_json` does the escaping, so a quote, a backslash or a newline in
+    // the script cannot break out of the array — the failure mode a
+    // hand-rolled escaper would eventually have.
+    serde_json::to_string(&["/bin/sh", "-c", script])
+        .unwrap_or_else(|_| "[\"/bin/sh\", \"-c\", \"exit 1\"]".to_string())
+}
+
+/// Recover the shell program out of a [`run_exec_form`] `RUN` line.
+///
+/// Exists for the test that runs `sh -n` over it: a Dockerfile is a string, and
+/// the only way to assert the thing the daemon will execute is syntactically
+/// valid is to pull that exact string back out and hand it to a shell.
+///
+/// `pub(crate)` rather than `#[cfg(test)]` deliberately. `container.rs` owns the
+/// scrub script and wants to assert that a compaction runs *its* script, not a
+/// mangled copy — and the honest form of that assertion is
+/// `script_from_run_line(run) == snapshot_scrub_script()`, byte for byte, which
+/// is a far stronger statement than "the folded one-liner still parses".
+#[allow(dead_code)] // used by `disk_tests.rs`, and by `container.rs`'s own test
+pub(crate) fn script_from_run_line(run_line: &str) -> Option<String> {
+    let json = run_line.strip_prefix("RUN ")?;
+    let parts: Vec<String> = serde_json::from_str(json).ok()?;
+    parts.get(2).cloned()
 }
 
 /// The `rm -rf` program that clears a project's regenerable package caches.
@@ -983,16 +1119,29 @@ pub fn is_docker_desktop(operating_system: &str) -> bool {
 pub fn project_store_trust(
     projects: &[Project],
     json_exists: bool,
-    json_parsed: bool,
+    json_ids: Option<&[String]>,
 ) -> Result<HashSet<String>, String> {
-    if !json_parsed {
+    let Some(json_ids) = json_ids else {
         return Err(
             "projects.json could not be read, so there is no way to tell an orphaned volume from a \
              live project's. Nothing is listed here until it can be."
                 .to_string(),
         );
-    }
-    if projects.is_empty() && json_exists {
+    };
+    // **The union, not the in-memory list.** `projects` is
+    // `state.projects_store.list()`, a snapshot this process loaded at startup.
+    // A project added by a *second* copy of the app — the same daemon, the same
+    // data directory, a different process — is on disk and not in that list, so
+    // its live home and config volumes matched "no project claims this" and
+    // were offered for deletion, at `Safety::Safe`, while the very same volumes
+    // for a project this instance knows about require typing the project name.
+    // Reading the file is the only way to close that; the in-memory list is
+    // still unioned in because a project added here a moment ago is authoritative
+    // too, and because the ids on disk are read as opaque strings.
+    let mut known: HashSet<String> = json_ids.iter().cloned().collect();
+    known.extend(projects.iter().map(|p| p.id.clone()));
+
+    if known.is_empty() && json_exists {
         return Err(
             "The project list loaded empty from a projects.json that exists, which is what a \
              recovered-from-corrupt store looks like. Orphan detection is suppressed rather than \
@@ -1000,26 +1149,54 @@ pub fn project_store_trust(
                 .to_string(),
         );
     }
-    Ok(projects.iter().map(|p| p.id.clone()).collect())
+    Ok(known)
 }
 
-/// Re-read `projects.json` from disk to answer [`project_store_trust`]'s two
-/// questions. The in-memory store cannot answer them: by the time it is
-/// consulted, a corrupt file has already been swallowed into an empty list.
-fn projects_json_health() -> (bool, bool) {
+/// Re-read `projects.json` from disk: whether it exists, and the project ids it
+/// actually holds.
+///
+/// The in-memory store cannot answer either question. By the time it is
+/// consulted a corrupt file has already been swallowed into an empty list, and
+/// a second app instance's writes are not in it at all.
+///
+/// `None` for the ids means "could not be read or parsed", which is not the
+/// same as "holds no projects" and must never be collapsed into it. An id that
+/// is not a string is skipped rather than failing the whole read — the file is
+/// still parseable, so the honest answer is the ids it does carry.
+///
+/// Blocking `std::fs`, so every async caller goes through
+/// [`projects_json_snapshot_async`].
+fn projects_json_snapshot() -> (bool, Option<Vec<String>>) {
     let Some(path) = dirs::data_dir().map(|d| d.join("triple-c").join("projects.json")) else {
-        return (false, false);
+        return (false, None);
     };
     if !path.exists() {
-        return (false, true);
+        return (false, Some(Vec::new()));
     }
     let parsed = std::fs::read_to_string(&path)
         .ok()
         .and_then(|data| serde_json::from_str::<Vec<serde_json::Value>>(&data).ok())
-        .is_some();
+        .map(|entries| {
+            entries
+                .iter()
+                .filter_map(|entry| entry.get("id")?.as_str().map(str::to_string))
+                .collect::<Vec<_>>()
+        });
     (true, parsed)
 }
 
+/// [`projects_json_snapshot`] off the async worker.
+///
+/// A `read_to_string` on a spinning disk, a network home directory or a
+/// Windows volume behind an antivirus filter blocks the whole tokio worker
+/// thread it lands on, and this one is called from inside [`scan`] — the
+/// longest-running command in the app.
+async fn projects_json_snapshot_async() -> (bool, Option<Vec<String>>) {
+    tokio::task::spawn_blocking(projects_json_snapshot)
+        .await
+        .unwrap_or((false, None))
+}
+
 // ---------------------------------------------------------------------------
 // Scan
 // ---------------------------------------------------------------------------
@@ -1172,6 +1349,15 @@ pub async fn scan(projects: &[Project]) -> Result<DiskUsageReport, String> {
         // same image once per project and make the column meaningless.
         let snapshot_unique = (snapshot_bytes - snapshot_shared_bytes).max(0);
 
+        // See `ProjectDiskRow::snapshot_attributed_bytes`. One function, so the
+        // column and the total cannot be derived from two different rules
+        // again.
+        let snapshot_attributed_bytes = snapshot_attribution(
+            snapshot_bytes,
+            snapshot_shared_bytes,
+            stats.above_base_bytes,
+        );
+
         rows.push(ProjectDiskRow {
             project_id: project.id.clone(),
             project_name: project.name.clone(),
@@ -1196,7 +1382,8 @@ pub async fn scan(projects: &[Project]) -> Result<DiskUsageReport, String> {
             home_volume_present: home.is_some(),
             config_volume_bytes,
             config_volume_present: config.is_some(),
-            total_bytes: snapshot_unique
+            snapshot_attributed_bytes,
+            total_bytes: snapshot_attributed_bytes
                 + container_writable_bytes
                 + home_volume_bytes
                 + config_volume_bytes,
@@ -1258,9 +1445,9 @@ pub async fn scan(projects: &[Project]) -> Result<DiskUsageReport, String> {
     // as exact.
     let base_images_bytes = base_images.iter().map(|b| b.bytes).sum();
 
-    let (json_exists, json_parsed) = projects_json_health();
+    let (json_exists, json_ids) = projects_json_snapshot_async().await;
     let (orphan_volumes_list, orphan_volumes_unavailable) =
-        match project_store_trust(projects, json_exists, json_parsed) {
+        match project_store_trust(projects, json_exists, json_ids.as_deref()) {
             Ok(known) => {
                 let facts: Vec<VolumeFacts> = volumes.iter().map(volume_facts).collect();
                 (orphan_volumes(&facts, &known, true), None)
@@ -1271,6 +1458,14 @@ pub async fn scan(projects: &[Project]) -> Result<DiskUsageReport, String> {
 
     let build_cache = build_cache_usage(&build_cache_records).await;
 
+    // `total_bytes` now excludes each snapshot's shared base wherever the base
+    // could be identified, so adding `base_images_bytes` counts each base
+    // exactly once rather than once per project on top of once per project.
+    // The residue is the case where a snapshot shares nothing measurable *and*
+    // its lineage is unknown: its full size is attributed to the project, which
+    // is right, and if the base it descends from is also on the daemon it
+    // appears as its own row too. Docker would have reported a shared size if
+    // those two genuinely shared layers, so that combination means they do not.
     let triple_c_total_bytes = rows.iter().map(|r| r.total_bytes).sum::<i64>()
         + base_images_bytes
         + orphan_image_bytes
@@ -1287,7 +1482,17 @@ pub async fn scan(projects: &[Project]) -> Result<DiskUsageReport, String> {
         orphan_volume_bytes,
         orphan_volumes_unavailable,
         build_cache,
-        images_total_bytes: images.iter().map(|i| i.size).sum(),
+        // **`layers_size`, not the sum of the images.** Every image's `size`
+        // includes every layer it inherits, so summing them counts a shared
+        // 4.7 GB base once per snapshot — measured at ~33 GB of phantom on a
+        // real ten-project daemon, presented under "Everything on this daemon"
+        // right beside "Attributable to Triple-C". `df()` already returns the
+        // deduplicated figure and nothing read it. The sum is kept only for a
+        // daemon that does not report one.
+        images_total_bytes: usage
+            .layers_size
+            .filter(|size| *size > 0)
+            .unwrap_or_else(|| images.iter().map(|i| i.size).sum()),
         containers_total_bytes: containers
             .iter()
             .map(|c| c.size_rw.unwrap_or(0).max(0))
@@ -1378,11 +1583,38 @@ async fn build_cache_usage(records: &[BuildCache]) -> BuildCacheUsage {
 /// (or a Windows named pipe) for one endpoint is a worse trade than shelling
 /// out, which `commands/aws_commands.rs` already does for the AWS CLI.
 async fn docker_cli(args: &[&str]) -> Result<String, String> {
-    let output = tokio::process::Command::new("docker")
+    docker_cli_with_timeout(args, DOCKER_CLI_TIMEOUT_SECS).await
+}
+
+async fn docker_cli_with_timeout(args: &[&str], timeout_secs: u64) -> Result<String, String> {
+    // **A timeout, because this sits inside `scan`.** `buildx du` talks to the
+    // daemon, and a daemon that is wedged — a hung storage driver, a Docker
+    // Desktop VM mid-restart — simply never answers. Without a bound the panel
+    // shows "Scanning…" for as long as the app is open, with no error and
+    // nothing to retry. On expiry the build-cache figures fall back to `df()`'s
+    // and say so in `cli_error`, which is the same degradation path a missing
+    // CLI already takes.
+    //
+    // `kill_on_drop` is what makes the timeout real: dropping the future
+    // otherwise leaves the child running and still holding whatever it was
+    // waiting on.
+    let run = tokio::process::Command::new("docker")
         .args(args)
-        .output()
-        .await
-        .map_err(|e| format!("Could not run `docker {}`: {}", args.join(" "), e))?;
+        .kill_on_drop(true)
+        .output();
+    let output = match tokio::time::timeout(std::time::Duration::from_secs(timeout_secs), run).await
+    {
+        Ok(result) => result
+            .map_err(|e| format!("Could not run `docker {}`: {}", args.join(" "), e))?,
+        Err(_) => {
+            return Err(format!(
+                "`docker {}` did not answer within {} seconds and was cancelled — the daemon may \
+                 be busy or wedged",
+                args.join(" "),
+                timeout_secs
+            ))
+        }
+    };
     if !output.status.success() {
         return Err(format!(
             "`docker {}` failed: {}",
@@ -1549,10 +1781,14 @@ pub async fn list_reclaimable(
                 daemon_wide: target.is_daemon_wide(),
                 target,
             label: format!("Ownerless rollback pins ({} images)", pin_count),
-            detail: "`pre-migration-*` tags whose migration record is gone, so nothing can roll \
-                     back to them. Untagged here; the image is then collected as a superseded \
-                     snapshot layer under the same rules."
-                .to_string(),
+            detail: format!(
+                "`pre-migration-*` tags whose migration record has been gone for more than {} \
+                 days, so nothing can roll back to them. A pin that lost its record more \
+                 recently is not here — it is listed under this project's own removals, where \
+                 deleting it takes a typed confirmation. Untagged here; the image is then \
+                 collected as a superseded snapshot layer under the same rules.",
+                migration::STALE_PIN_MAX_AGE_DAYS
+            ),
             bytes: pin_bytes,
             bytes_are_exact: true,
             bytes_floor: None,
@@ -1561,7 +1797,14 @@ pub async fn list_reclaimable(
         });
     }
 
-    let staging_bytes = survey_migration_staging(projects);
+    let staging_bytes = {
+        // Same reason as the executor below: `read_dir` + `metadata` per entry
+        // is blocking IO, and this runs inside the panel's plan step.
+        let owned: Vec<Project> = projects.to_vec();
+        tokio::task::spawn_blocking(move || survey_migration_staging(&owned))
+            .await
+            .unwrap_or(0)
+    };
     if staging_bytes > 0 {
         items.push({
             // Safety and reach are read off the target, never restated: a literal
@@ -1596,7 +1839,7 @@ pub async fn list_reclaimable(
                 migration::PROBE_LABEL_MIGRATION
             )],
         )]),
-        is_migration_probe,
+        is_reapable_migration_probe,
     )
     .await;
     if probes.1 > 0 {
@@ -1611,7 +1854,8 @@ pub async fn list_reclaimable(
                 target,
             label: format!("Migration probe containers ({})", probes.1),
             detail: "Throwaway containers a migration used to read a filesystem manifest and \
-                     did not get to remove."
+                     did not get to remove. Only ones that have been sitting there for a while \
+                     are listed — a probe that is still running looks exactly the same."
                 .to_string(),
             bytes: probes.0,
             bytes_are_exact: true,
@@ -1623,7 +1867,7 @@ pub async fn list_reclaimable(
 
     let scrubs = survey_containers_by_filter(
         HashMap::from([("name".to_string(), vec!["triple-c-scrub-".to_string()])]),
-        is_scrub_container,
+        is_reapable_scrub_container,
     )
     .await;
     if scrubs.1 > 0 {
@@ -1638,7 +1882,8 @@ pub async fn list_reclaimable(
                 target,
             label: format!("Secret-scrub scratch containers ({})", scrubs.1),
             detail: "`triple-c-scrub-*` containers left by an interrupted rewrite of a snapshot's \
-                     baked-in environment."
+                     baked-in environment. Only ones that have been sitting there for a while \
+                     are listed — the same name is used by a rewrite that is still running."
                 .to_string(),
             bytes: scrubs.0,
             bytes_are_exact: true,
@@ -1648,53 +1893,18 @@ pub async fn list_reclaimable(
         });
     }
 
-    // --- Orphaned volumes, one tick each ------------------------------------
-    //
-    // Deliberately not aggregated. Each of these was some project's home or
-    // `.claude` directory, and the user is the only one who can say whether the
-    // project it belonged to is really gone.
-    for volume in &report.orphan_volumes {
-        items.push({
-            // Safety and reach are read off the target, never restated: a literal
-            // here that disagreed with the classifier is exactly the drift this
-            // module cannot afford.
-            let target = ReclaimTarget::OrphanVolume {
-                name: volume.name.clone(),
-            };
-            ReclaimItem {
-                safety: target.safety(),
-                daemon_wide: target.is_daemon_wide(),
-                target,
-            label: format!("{} ({} volume)", volume.name, volume.role),
-            detail: format!(
-                "Named for project id {}, which is not in Triple-C's project list, and no \
-                 container is attached to it.{} {}",
-                volume.project_id,
-                match &volume.created_at {
-                    Some(created) => format!(" Docker created it on {}.", created),
-                    None => String::new(),
-                },
-                if volume.role == "config" {
-                    "This is a `.claude` volume — it held that project's Claude credential, \
-                     plugins and session transcripts."
-                } else {
-                    "This is a home volume — it held that project's dotfiles, shell history and \
-                     installed toolchains."
-                }
-            ),
-            bytes: volume.bytes,
-            bytes_are_exact: true,
-            bytes_floor: None,
-            blocked: None,
-        }
-        });
-    }
-
     // --- Per-project semi-safe work -----------------------------------------
     for row in &report.projects {
-        let blocked_by_migration = row
-            .migrating
-            .then(|| "A base-image migration is in flight for this project.".to_string());
+        // The **live** lock first, then the scan's own snapshot as a fallback.
+        // `row.migrating` is as old as the scan that produced it — seconds or
+        // minutes — and it only ever knew about migrations. The lock knows
+        // about a compaction, a Reset and a start too, and it knows now.
+        let blocked_by_migration = crate::project_lock::held(&row.project_id)
+            .map(|holder| format!("{}.", holder.describe()))
+            .or_else(|| {
+                row.migrating
+                    .then(|| "A base-image migration is in flight for this project.".to_string())
+            });
 
         // A ceiling of zero means flattening this snapshot cannot come out
         // ahead — almost always because its unique delta is smaller than the
@@ -1801,10 +2011,51 @@ pub async fn list_reclaimable(
 
     // --- Destructive, for display only --------------------------------------
     let mut destructive = Vec::new();
+
+    // Orphaned volumes, one item each and never aggregated. Each of these was
+    // some project's home or `.claude` directory, and the user is the only one
+    // who can say whether the project it belonged to is really gone — which is
+    // why this is here rather than in `items`. See
+    // `DestructiveTarget::OrphanVolume`.
+    for volume in &report.orphan_volumes {
+        destructive.push(DestructiveItem {
+            target: DestructiveTarget::OrphanVolume {
+                name: volume.name.clone(),
+                project_id: volume.project_id.clone(),
+            },
+            project_id: volume.project_id.clone(),
+            // No project in the store answers to this id — the volume's own
+            // name is the only handle there is, and it is what has to be typed.
+            project_name: volume.name.clone(),
+            label: format!("{} ({} volume)", volume.name, volume.role),
+            loses: format!(
+                "Named for project id {}, which is not in Triple-C's project list, and no \
+                 container is attached to it.{} {} Not recoverable. Type the volume name to \
+                 confirm.",
+                volume.project_id,
+                match &volume.created_at {
+                    Some(created) => format!(" Docker created it on {}.", created),
+                    None => String::new(),
+                },
+                if volume.role == "config" {
+                    "This is a `.claude` volume — it held that project's Claude credential, \
+                     plugins and session transcripts."
+                } else {
+                    "This is a home volume — it held that project's dotfiles, shell history and \
+                     installed toolchains."
+                }
+            ),
+            bytes: volume.bytes,
+            blocked: None,
+        });
+    }
     for row in &report.projects {
-        let blocked = row
-            .migrating
-            .then(|| "A base-image migration is in flight for this project.".to_string());
+        let blocked = crate::project_lock::held(&row.project_id)
+            .map(|holder| format!("{}.", holder.describe()))
+            .or_else(|| {
+                row.migrating
+                    .then(|| "A base-image migration is in flight for this project.".to_string())
+            });
         if row.home_volume_present {
             destructive.push(DestructiveItem {
                 target: DestructiveTarget::HomeVolume {
@@ -1851,25 +2102,25 @@ pub async fn list_reclaimable(
                         The project falls back to the base image next time it starts, and \
                         rebuilds from there. Volumes are untouched."
                     .to_string(),
-                bytes: row.snapshot_above_base_bytes.unwrap_or(row.snapshot_bytes),
+                // The same figure the Snapshot column shows, so the
+                // confirmation and the table cannot quote different numbers for
+                // the same image.
+                bytes: row.snapshot_attributed_bytes,
                 blocked: blocked.clone(),
             });
         }
     }
-    for (project_id, project_name, tag, bytes) in live_pins {
+    for pin in live_pins {
         destructive.push(DestructiveItem {
             target: DestructiveTarget::RollbackPin {
-                project_id: project_id.clone(),
-                tag: tag.clone(),
+                project_id: pin.project_id.clone(),
+                tag: pin.tag.clone(),
             },
-            project_id,
-            project_name,
-            label: format!("Rollback pin {}", tag),
-            loses: "The only copy of this project's pre-migration system layer. Its migration is \
-                    still waiting to be confirmed or rolled back — delete this and rolling back \
-                    becomes impossible."
-                .to_string(),
-            bytes,
+            project_id: pin.project_id,
+            project_name: pin.project_name,
+            label: format!("Rollback pin {}", pin.tag),
+            loses: pin.loses,
+            bytes: pin.bytes,
             blocked: None,
         });
     }
@@ -1929,14 +2180,83 @@ fn compaction_ceiling_for(unique_bytes: i64, shared_bytes: i64, commit_layers: u
     superseded_ceiling.min(after_base_penalty).max(0)
 }
 
-/// Rollback pins, split into the ones nothing claims and the ones a live
-/// migration still needs.
+/// What this module may do with one `pre-migration-*` tag.
 ///
-/// Returns `(ownerless_bytes, ownerless_count, live_pins)` where each live pin
-/// is `(project_id, project_name, tag, bytes)`.
-async fn survey_rollback_pins(
-    projects: &[Project],
-) -> (i64, usize, Vec<(String, String, String, i64)>) {
+/// The single rule behind both the survey and the reclaim, so the count on the
+/// button and the work the button does cannot disagree — and so the guards can
+/// be tested without a daemon. Before this existed the two paths applied
+/// *different* rules and the reclaim's was the weaker one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PinDisposition {
+    /// Not a tag `migration::rollback_tag` produced. Never touched, never
+    /// offered, never given a tombstone — a hand-made `pre-migration-keepme` is
+    /// somebody's deliberate pin.
+    NotOurs,
+    /// Nothing claims it and its grace period has expired.
+    Reapable,
+    /// A migration record still claims it. The only copy of a rollback target
+    /// that is still awaiting a decision.
+    Claimed,
+    /// Nothing claims it, but the grace period that starts when a pin loses its
+    /// record has not run out — including the case where no reaper has recorded
+    /// a sighting yet, which is where the clock starts rather than where it
+    /// ends.
+    WithinGrace,
+}
+
+/// Classify one rollback pin. Pure; see [`PinDisposition`].
+pub fn pin_disposition(
+    tag: &str,
+    has_record: bool,
+    ownerless_since: Option<chrono::DateTime<chrono::Utc>>,
+    now: &chrono::DateTime<chrono::Utc>,
+) -> PinDisposition {
+    if migration::parse_rollback_tag(tag).is_none() {
+        return PinDisposition::NotOurs;
+    }
+    if has_record {
+        return PinDisposition::Claimed;
+    }
+    if migration::pin_is_reapable(tag, has_record, ownerless_since, now) {
+        PinDisposition::Reapable
+    } else {
+        PinDisposition::WithinGrace
+    }
+}
+
+/// One rollback pin this panel will not collect on its own, with the reason.
+struct RetainedPin {
+    project_id: String,
+    project_name: String,
+    tag: String,
+    /// The image's own size, charged **once per image** — see
+    /// [`survey_rollback_pins`].
+    bytes: i64,
+    /// The sentence the destructive confirmation shows.
+    loses: String,
+}
+
+/// Rollback pins, split into the ones the reaper may drop and the ones it may
+/// not.
+///
+/// ## Two things this used to get wrong
+///
+/// * **It applied no guard but `has_record`.** `reap_stale_migration_pins`
+///   requires `parse_rollback_tag` *and* `pin_is_reapable`, and `destroy`'s
+///   `RollbackPin` arm requires `parse_rollback_tag` with a comment explaining
+///   why. This offered anything whose repo matched `triple-c-snapshot-*` and
+///   whose tag merely began `pre-migration-` — a hand-made pin included — with
+///   no age gate at all, under `Safety::Safe`, i.e. one button and no
+///   confirmation.
+/// * **It double-counted.** The loop is over `repo_tags`, so an image answering
+///   to two `pre-migration-*` tags added its full size twice.
+///
+/// The survey only ever *peeks* at the ownerless clock. Starting one is a
+/// reaper's job — [`reclaim_migration_pins`] and
+/// `migration::reap_stale_migration_pins` — because a function whose job is to
+/// describe the world should not be the thing that makes a pin collectable
+/// fourteen days later.
+async fn survey_rollback_pins(projects: &[Project]) -> (i64, usize, Vec<RetainedPin>) {
     let Ok(docker) = get_docker() else {
         return (0, 0, Vec::new());
     };
@@ -1957,10 +2277,18 @@ async fn survey_rollback_pins(
         .await
         .unwrap_or_default();
 
-    let mut ownerless_bytes = 0;
-    let mut ownerless_count = 0;
-    let mut live = Vec::new();
+    let now = chrono::Utc::now();
+    let mut reapable_bytes = 0;
+    let mut reapable_count = 0;
+    let mut retained = Vec::new();
     for image in images {
+        // Per *image*, not per tag: two `pre-migration-*` tags on one image are
+        // two names for the same layers, and removing both frees them once.
+        let mut image_is_reapable = false;
+        // Set once the image's bytes have been charged to one of its retained
+        // tags, so a second tag on the same image is listed but not counted.
+        let mut image_bytes_charged = false;
+
         for reference in &image.repo_tags {
             let Some((project_id, tag)) = migration::parse_snapshot_reference(reference) else {
                 continue;
@@ -1969,19 +2297,53 @@ async fn survey_rollback_pins(
             // must still count as "somebody may want this back". Same rule the
             // pin reaper uses, for the same reason.
             let has_record = migration_store::has_record(&project_id).unwrap_or(true);
-            if has_record {
-                let name = names
-                    .get(project_id.as_str())
-                    .map(|n| (*n).to_string())
-                    .unwrap_or_else(|| project_id.clone());
-                live.push((project_id, name, tag, image.size));
-            } else {
-                ownerless_bytes += image.size;
-                ownerless_count += 1;
+            let ownerless_since = migration_store::peek_ownerless_since(&project_id, &tag);
+            let disposition = pin_disposition(&tag, has_record, ownerless_since, &now);
+            match disposition {
+                // Never offered anywhere, at any safety level — the same
+                // refusal `destroy` makes.
+                PinDisposition::NotOurs => continue,
+                PinDisposition::Reapable => {
+                    image_is_reapable = true;
+                    continue;
+                }
+                PinDisposition::Claimed | PinDisposition::WithinGrace => {}
             }
+            let name = names
+                .get(project_id.as_str())
+                .map(|n| (*n).to_string())
+                .unwrap_or_else(|| project_id.clone());
+            let loses = if disposition == PinDisposition::Claimed {
+                "The only copy of this project's pre-migration system layer. Its migration is \
+                 still waiting to be confirmed or rolled back — delete this and rolling back \
+                 becomes impossible."
+                    .to_string()
+            } else {
+                format!(
+                    "The only copy of this project's pre-migration system layer. Nothing claims \
+                     it any more, but it is still inside the {}-day grace period that starts \
+                     when a pin loses its migration record — it is collected automatically after \
+                     that. Delete it here only if you are sure you will never roll that \
+                     migration back.",
+                    migration::STALE_PIN_MAX_AGE_DAYS
+                )
+            };
+            retained.push(RetainedPin {
+                project_id,
+                project_name: name,
+                tag,
+                bytes: if image_bytes_charged { 0 } else { image.size },
+                loses,
+            });
+            image_bytes_charged = true;
+        }
+
+        if image_is_reapable {
+            reapable_bytes += image.size;
+            reapable_count += 1;
         }
     }
-    (ownerless_bytes, ownerless_count, live)
+    (reapable_bytes, reapable_count, retained)
 }
 
 /// Total bytes of `*-payload.tar` staging files no migration record claims.
@@ -2036,10 +2398,54 @@ fn is_migration_probe(summary: &ContainerSummary) -> bool {
         == Some(migration::PROBE_LABEL_MIGRATION)
 }
 
-/// A scratch container from an interrupted secret rewrite.
+/// A migration probe this bucket is allowed to force-remove.
+///
+/// The label is daemon-wide, and this target's `project_id()` is `None` — so
+/// `reclaim`'s per-project guard never fires for it and a tick here reaches
+/// *every* probe on the daemon, including a live one belonging to another
+/// instance's migration or to a migration this process started a second ago.
+/// The same age gate `migration::reap_probe_containers` applies is the only
+/// discriminator there is; a probe is a short `df`, `find` or `apt-get update`,
+/// so nothing legitimate is older than it.
+fn is_reapable_migration_probe(summary: &ContainerSummary) -> bool {
+    if !is_migration_probe(summary) {
+        return false;
+    }
+    match summary.created {
+        Some(created) => {
+            chrono::Utc::now().timestamp() - created >= migration::PROBE_REAP_MIN_AGE_SECS
+        }
+        // Unknown is never permission — the same rule the volume ref count and
+        // the scratch containers follow.
+        None => false,
+    }
+}
+
+/// A scratch container from an **interrupted** secret rewrite.
 ///
 /// **Docker's `name` filter is a substring match**, so it also returns a user's
 /// own `my-triple-c-scrub-notes`. The full name is what decides.
+///
+/// ## The age gate is not tidiness, it is the point of the whole function
+///
+/// `triple-c-scrub-*` is not a dead name. It is the **live** name
+/// `container::rewrite_image_without_secrets` creates its scratch container
+/// under, and that is still reachable today from `clear_claude_token`. Between
+/// the `create` and the `commit` there is a window in which this bucket —
+/// `Safety::Safe`, one button, no confirmation, and `force: true` on the
+/// removal — destroys the container the commit is about to run against. The
+/// rewrite then fails, the superseded image is *not* removed, and a revoked
+/// OAuth token stays baked into that snapshot's `Config.Env`: precisely the
+/// condition `scrub_secrets_from_snapshots` exists to remove, produced by the
+/// panel that offers to clean up after it.
+///
+/// The right discriminator would be a label — the scrub containers carry none,
+/// and this module cannot add one without editing `container.rs`. Age is the
+/// discriminator available from here. A scrub container is created, committed
+/// and removed within one function with no I/O between the steps but a
+/// `docker commit`; anything older than [`SCRATCH_CONTAINER_MIN_AGE_SECS`] is
+/// therefore a leftover, and anything younger is assumed to belong to a live
+/// rewrite — this process's or another instance's.
 fn is_scrub_container(summary: &ContainerSummary) -> bool {
     summary
         .names
@@ -2049,6 +2455,33 @@ fn is_scrub_container(summary: &ContainerSummary) -> bool {
         .any(|name| name.trim_start_matches('/').starts_with("triple-c-scrub-"))
 }
 
+/// A scrub container this module is allowed to force-remove: ours *and* old
+/// enough not to be a live rewrite. This is the predicate the survey and the
+/// reclaim both use; [`is_scrub_container`] answers only "is this name ours".
+fn is_reapable_scrub_container(summary: &ContainerSummary) -> bool {
+    is_scrub_container(summary) && is_stale_scratch(summary)
+}
+
+/// How old a `triple-c-scrub-*` / `triple-c-compact-*` scratch container must be
+/// before anything here will force-remove it.
+///
+/// Both names are used by live code, neither carries a label to tell a leftover
+/// from a live one, and the removals are unconditional `force: true`. See
+/// [`is_scrub_container`]. Fifteen minutes is far longer than either scratch
+/// container's real lifetime (a `create`, a `commit`, a `rm`) and far shorter
+/// than "until the user notices".
+pub const SCRATCH_CONTAINER_MIN_AGE_SECS: i64 = 15 * 60;
+
+/// Whether a scratch container is old enough to be a leftover rather than a
+/// live one. A summary with no creation time is treated as young: unknown is
+/// never permission, the same rule the volume ref count follows.
+fn is_stale_scratch(summary: &ContainerSummary) -> bool {
+    match summary.created {
+        Some(created) => chrono::Utc::now().timestamp() - created >= SCRATCH_CONTAINER_MIN_AGE_SECS,
+        None => false,
+    }
+}
+
 /// `(writable_bytes, count)` for containers matching a filter *and* a predicate
 /// re-checked on each summary. See [`is_migration_probe`] and
 /// [`is_scrub_container`] for why the second check is not redundant.
@@ -2094,14 +2527,16 @@ pub async fn reclaim(targets: &[ReclaimTarget], projects: &[Project]) -> Reclaim
     let mut outcome = ReclaimOutcome::default();
     for target in targets {
         // Anything that stops, removes or rewrites a project's container or
-        // image consults `is_migrating` first — the same rule the rest of the
-        // app obeys. Checked once here so a new project-scoped target cannot
-        // be added without it; the executors re-check for their own callers.
+        // image consults the project's lock first — the same rule the rest of
+        // the app obeys. Checked once here so a new project-scoped target
+        // cannot be added without it, and so a busy project is reported per
+        // item rather than failing the whole batch; the executors *acquire*
+        // for their own callers, which is the check that actually holds.
         if let Some(project_id) = target.project_id() {
-            if crate::commands::migration_commands::is_migrating(project_id) {
+            if let Some(holder) = crate::project_lock::held(project_id) {
                 let result = failed(
                     target.clone(),
-                    "A base-image migration is in flight for this project.".to_string(),
+                    format!("{}. Nothing was done for it.", holder.describe()),
                 );
                 outcome.results.push(result);
                 continue;
@@ -2113,7 +2548,20 @@ pub async fn reclaim(targets: &[ReclaimTarget], projects: &[Project]) -> Reclaim
             }
             ReclaimTarget::BuildCache { all } => reclaim_build_cache(*all).await,
             ReclaimTarget::MigrationPins => reclaim_migration_pins().await,
-            ReclaimTarget::MigrationStaging => reclaim_migration_staging(projects),
+            ReclaimTarget::MigrationStaging => {
+                // `std::fs` over a directory of multi-gigabyte tars, from an
+                // async worker. `spawn_blocking` or the whole runtime thread
+                // stalls behind it.
+                let owned: Vec<Project> = projects.to_vec();
+                tokio::task::spawn_blocking(move || reclaim_migration_staging(&owned))
+                    .await
+                    .unwrap_or_else(|e| {
+                        failed(
+                            ReclaimTarget::MigrationStaging,
+                            format!("The staging cleanup task did not finish: {}", e),
+                        )
+                    })
+            }
             ReclaimTarget::ProbeContainers => {
                 reclaim_containers(
                     HashMap::from([(
@@ -2124,7 +2572,7 @@ pub async fn reclaim(targets: &[ReclaimTarget], projects: &[Project]) -> Reclaim
                             migration::PROBE_LABEL_MIGRATION
                         )],
                     )]),
-                    is_migration_probe,
+                    is_reapable_migration_probe,
                     ReclaimTarget::ProbeContainers,
                 )
                 .await
@@ -2132,12 +2580,11 @@ pub async fn reclaim(targets: &[ReclaimTarget], projects: &[Project]) -> Reclaim
             ReclaimTarget::ScrubContainers => {
                 reclaim_containers(
                     HashMap::from([("name".to_string(), vec!["triple-c-scrub-".to_string()])]),
-                    is_scrub_container,
+                    is_reapable_scrub_container,
                     ReclaimTarget::ScrubContainers,
                 )
                 .await
             }
-            ReclaimTarget::OrphanVolume { name } => reclaim_orphan_volume(name, projects).await,
             ReclaimTarget::CompactSnapshot { project_id } => {
                 match find_project(projects, project_id) {
                     Ok(project) => compact_snapshot(project).await,
@@ -2277,7 +2724,7 @@ async fn reclaim_build_cache(all: bool) -> ReclaimResult {
         args.push("--filter");
         args.push(&filter);
     }
-    match docker_cli(&args).await {
+    match docker_cli_with_timeout(&args, DOCKER_PRUNE_TIMEOUT_SECS).await {
         Ok(output) => ReclaimResult {
             target: Some(target),
             destroyed: None,
@@ -2300,7 +2747,32 @@ async fn reclaim_build_cache(all: bool) -> ReclaimResult {
     }
 }
 
-/// Untag the rollback pins nothing claims.
+/// Untag the rollback pins nothing claims *and* that are past their grace
+/// period.
+///
+/// ## The guards this was missing
+///
+/// It used to discard the tag entirely (`let Some((project_id, _tag)) = …`) and
+/// untag on `has_record` alone. Everything else that touches a pin applies two
+/// more conditions: `migration::parse_rollback_tag`, which is the only thing
+/// separating `pre-migration-20260101-101500` from a hand-made
+/// `pre-migration-keepme` somebody pinned deliberately, and the fourteen-day
+/// grace period in `migration::pin_is_reapable`. `reap_stale_migration_pins`
+/// requires both, and `destroy`'s `RollbackPin` arm requires the first with a
+/// comment explaining exactly this hazard.
+///
+/// The gap mattered more here than anywhere else, because this path has none of
+/// the brakes the others do: it is `Safety::Safe`, so one button with no
+/// confirmation reaches it; its `ReclaimTarget::project_id()` is `None`, so
+/// `reclaim`'s `is_migrating` guard never fires for it; and
+/// `sweep_orphaned_snapshots` four lines below turns the untag into a deletion
+/// on the same pass. A record that had merely gone missing for a minute was
+/// enough to lose the only copy of a project's pre-migration system layer.
+///
+/// Unlike [`survey_rollback_pins`] this **starts** the ownerless clock for pins
+/// nothing has sighted yet — it is a reaper, and that is a reaper's job. Those
+/// pins are not dropped on this pass; they become collectable fourteen days
+/// later.
 ///
 /// Untag only, never `rmi`: dropping the tag makes the image dangling, and it
 /// already carries `triple-c.managed=true` because `docker commit` created it,
@@ -2327,18 +2799,36 @@ async fn reclaim_migration_pins() -> ReclaimResult {
         Err(e) => return failed(target, format!("Could not list rollback pins: {}", e)),
     };
 
+    let now = chrono::Utc::now();
     let mut freed = 0i64;
     let mut dropped = 0usize;
+    let mut held_back = 0usize;
     for image in images {
         for reference in &image.repo_tags {
-            let Some((project_id, _tag)) = migration::parse_snapshot_reference(reference) else {
+            let Some((project_id, tag)) = migration::parse_snapshot_reference(reference) else {
                 continue;
             };
-            if migration_store::has_record(&project_id).unwrap_or(true) {
+            if migration::parse_rollback_tag(&tag).is_none() {
+                continue;
+            }
+            let has_record = migration_store::has_record(&project_id).unwrap_or(true);
+            if has_record {
+                migration_store::clear_ownerless(&project_id, &tag);
+                held_back += 1;
+                continue;
+            }
+            // Starts the clock when nothing has sighted this pin before, which
+            // is what makes the first pass a no-op for it.
+            let ownerless_since =
+                migration_store::note_ownerless_since(&project_id, &tag, &now);
+            if pin_disposition(&tag, has_record, ownerless_since, &now) != PinDisposition::Reapable
+            {
+                held_back += 1;
                 continue;
             }
             match migration::untag_image(reference).await {
                 Ok(()) => {
+                    migration_store::clear_ownerless(&project_id, &tag);
                     freed += image.size;
                     dropped += 1;
                 }
@@ -2365,15 +2855,30 @@ async fn reclaim_migration_pins() -> ReclaimResult {
         ok: true,
         freed_bytes: sweep.reclaimed_bytes,
         projected_bytes: None,
-        message: format!(
-            "Dropped {} ownerless pin(s) and swept {} image(s).",
-            dropped,
-            sweep.removed.len()
-        ),
+        message: {
+            let mut message = format!(
+                "Dropped {} ownerless pin(s) and swept {} image(s).",
+                dropped,
+                sweep.removed.len()
+            );
+            if held_back > 0 {
+                message.push_str(&format!(
+                    " {} pin(s) were left alone — still claimed by a migration record, or inside \
+                     the {}-day grace period that starts when a pin loses one.",
+                    held_back,
+                    migration::STALE_PIN_MAX_AGE_DAYS
+                ));
+            }
+            message
+        },
     }
 }
 
 /// Delete ownerless `*-payload.tar` staging files.
+///
+/// Blocking `std::fs` throughout — `read_dir`, `metadata` and `remove_file` on
+/// what can be multi-gigabyte tars — so [`reclaim`] calls it through
+/// `spawn_blocking` rather than on the async worker it is running on.
 fn reclaim_migration_staging(projects: &[Project]) -> ReclaimResult {
     let target = ReclaimTarget::MigrationStaging;
     let dir = match migration_store::migrations_dir() {
@@ -2387,6 +2892,7 @@ fn reclaim_migration_staging(projects: &[Project]) -> ReclaimResult {
 
     let mut freed = 0i64;
     let mut removed = 0usize;
+    let mut errors = 0usize;
     for entry in entries.flatten() {
         let name = entry.file_name().to_string_lossy().to_string();
         let Some(project_id) = name.strip_suffix("-payload.tar") else {
@@ -2407,16 +2913,23 @@ fn reclaim_migration_staging(projects: &[Project]) -> ReclaimResult {
                 freed += size;
                 removed += 1;
             }
-            Err(e) => log::warn!("Could not remove {}: {}", entry.path().display(), e),
+            Err(e) => {
+                log::warn!("Could not remove {}: {}", entry.path().display(), e);
+                errors += 1;
+            }
         }
     }
+    let mut message = format!("Removed {} staging file(s).", removed);
+    if errors > 0 {
+        message.push_str(&format!(" {} could not be removed; see the log.", errors));
+    }
     ReclaimResult {
         target: Some(target),
         destroyed: None,
-        ok: true,
+        ok: errors == 0,
         freed_bytes: freed,
         projected_bytes: None,
-        message: format!("Removed {} staging file(s).", removed),
+        message,
     }
 }
 
@@ -2466,74 +2979,76 @@ async fn reclaim_containers(
             }
         }
     }
+    // **The failures have to be in the message.** `ok: false` alone was not
+    // enough: a partially failed run returned "Removed 2 container(s)." with
+    // three more that could not be touched, and the panel renders that string
+    // under a success headline. The count belongs in the sentence the user
+    // actually reads.
+    let mut message = format!("Removed {} container(s).", removed);
+    if errors > 0 {
+        message.push_str(&format!(
+            " {} could not be removed; see the log.",
+            errors
+        ));
+    }
     ReclaimResult {
         target: Some(target),
         destroyed: None,
         ok: errors == 0,
         freed_bytes: freed,
         projected_bytes: None,
-        message: format!("Removed {} container(s).", removed),
+        message,
     }
 }
 
 /// Remove one orphaned volume, re-checking every safety condition first.
 ///
 /// The plan that offered this was computed against a `df()` from some seconds
-/// ago. A project could have been added since, and a container could have
-/// attached. So the name is re-parsed, the store is re-consulted and the live
-/// ref count is re-read here — the tick is permission to act, not a promise
-/// that the world stood still.
-async fn reclaim_orphan_volume(name: &str, projects: &[Project]) -> ReclaimResult {
-    let target = ReclaimTarget::OrphanVolume {
-        name: name.to_string(),
-    };
-    let docker = match get_docker() {
-        Ok(d) => d,
-        Err(e) => return failed(target, e),
-    };
+/// ago. A project could have been added since — by this app or by a second copy
+/// of it — and a container could have attached. So the store is re-consulted
+/// *from disk*, the name is re-parsed and the live ref count is re-read here:
+/// the typed confirmation is permission to act, not a promise that the world
+/// stood still. Both of those re-checks predate the move to the destructive
+/// path and are deliberately unchanged.
+async fn destroy_orphan_volume(name: &str, projects: &[Project]) -> Result<ReclaimResult, String> {
+    let docker = get_docker()?;
 
-    let (json_exists, json_parsed) = projects_json_health();
-    let known = match project_store_trust(projects, json_exists, json_parsed) {
-        Ok(known) => known,
-        Err(reason) => return failed(target, reason),
-    };
+    let (json_exists, json_ids) = projects_json_snapshot_async().await;
+    let known = project_store_trust(projects, json_exists, json_ids.as_deref())?;
 
-    let usage = match docker.df().await {
-        Ok(usage) => usage,
-        Err(e) => return failed(target, format!("Could not re-check volume usage: {}", e)),
-    };
+    let usage = docker
+        .df()
+        .await
+        .map_err(|e| format!("Could not re-check volume usage: {}", e))?;
     let volumes = usage.volumes.unwrap_or_default();
     let facts: Vec<VolumeFacts> = volumes.iter().map(volume_facts).collect();
     let still_orphaned = orphan_volumes(&facts, &known, true)
         .into_iter()
         .find(|v| v.name == name);
     let Some(volume) = still_orphaned else {
-        return failed(
-            target,
-            format!(
-                "{} now matches a project in your project list, or a container has attached to \
-                 it, so it is no longer unclaimed. Nothing was removed.",
-                name
-            ),
-        );
+        return Err(format!(
+            "{} now matches a project in your project list, or a container has attached to it, \
+             so it is no longer unclaimed. Nothing was removed.",
+            name
+        ));
     };
 
-    match docker.remove_volume(name, None).await {
-        Ok(()) => ReclaimResult {
-            target: Some(target),
-            destroyed: None,
-            ok: true,
-            freed_bytes: volume.bytes,
-            projected_bytes: None,
-            message: format!("Removed volume {}.", name),
-        },
-        Err(e) => failed(
-            ReclaimTarget::OrphanVolume {
-                name: name.to_string(),
-            },
-            format!("Could not remove volume {}: {}", name, e),
-        ),
-    }
+    docker
+        .remove_volume(name, None)
+        .await
+        .map_err(|e| format!("Could not remove volume {}: {}", name, e))?;
+    log::info!("Removed orphaned volume {} on explicit confirmation", name);
+    Ok(ReclaimResult {
+        target: None,
+        destroyed: Some(DestructiveTarget::OrphanVolume {
+            name: name.to_string(),
+            project_id: volume.project_id.clone(),
+        }),
+        ok: true,
+        freed_bytes: volume.bytes,
+        projected_bytes: None,
+        message: format!("Removed volume {}.", name),
+    })
 }
 
 /// Rewrite a project's stacked commit layers into a single layer.
@@ -2567,12 +3082,22 @@ pub async fn compact_snapshot(project: &Project) -> ReclaimResult {
     let target = ReclaimTarget::CompactSnapshot {
         project_id: project.id.clone(),
     };
-    if crate::commands::migration_commands::is_migrating(&project.id) {
-        return failed(
-            target,
-            "A base-image migration is in flight for this project.".to_string(),
-        );
-    }
+
+    // **Acquired, and held for the whole rewrite.** This is the operation the
+    // per-project lock was written for. Compaction resolves
+    // `triple-c-snapshot-{id}:latest` when its build starts and commits back
+    // over that same tag minutes later, and the Settings panel is a sidebar
+    // rather than a modal, so Project Home stays live with Start, Reset and
+    // Migrate clickable the whole time. A one-shot `is_migrating` read at the
+    // door — which is all this used to have — covered none of that: it could
+    // not see a Start, a Reset or a second compaction at all, and it could not
+    // see a migration that began *after* the check.
+    let _guard =
+        match crate::project_lock::try_acquire(&project.id, crate::project_lock::ProjectOp::Compaction)
+        {
+            Ok(guard) => guard,
+            Err(reason) => return failed(target, reason),
+        };
 
     let docker = match get_docker() {
         Ok(d) => d,
@@ -2580,6 +3105,14 @@ pub async fn compact_snapshot(project: &Project) -> ReclaimResult {
     };
     let snapshot_ref = get_snapshot_image_name(project);
 
+    // Before anything is created, so a leftover from a previous run's crash is
+    // gone and nothing this run creates can be mistaken for one. The guard
+    // above is already held, which is why this passes the project id: the sweep
+    // excludes this compaction's own claim rather than seeing it and skipping.
+    // See [`remove_stale_compaction_containers`] for why it moved here from the
+    // end of `restore_image_config`.
+    reap_stale_compaction_artifacts_for(&project.id).await;
+
     // The container must be stopped: this rewrites the image it is running
     // from, and a running container also means the writable layer holds work
     // that has not been committed and would be stranded.
@@ -2643,11 +3176,10 @@ pub async fn compact_snapshot(project: &Project) -> ReclaimResult {
     };
 
     // `:compacting` rather than `:latest`. Nothing starts from this tag, and it
-    // is removed on every exit path below.
-    let staging_ref = format!(
-        "triple-c-snapshot-{}:compacting",
-        project.id
-    );
+    // is removed on every exit path below — every *in-process* one. A process
+    // that dies mid-build leaves it behind, which is what
+    // [`reap_stale_compaction_artifacts`] exists to collect.
+    let staging_ref = compaction_staging_ref(&project.id);
     let dockerfile = compaction_dockerfile(&snapshot_ref, &container::snapshot_scrub_script());
 
     if let Err(e) = build_from_dockerfile(&dockerfile, &staging_ref).await {
@@ -2729,14 +3261,25 @@ pub async fn compact_snapshot(project: &Project) -> ReclaimResult {
 /// Base 1000, matching `docker system df` and the frontend's `formatBytes` —
 /// a message saying 4.4 GiB beside a table saying 4.7 GB would read as two
 /// different numbers for the same thing.
-fn human(bytes: i64) -> String {
-    const UNITS: [&str; 5] = ["B", "KB", "MB", "GB", "TB"];
+pub(crate) fn human(bytes: i64) -> String {
+    const UNITS: [&str; 6] = ["B", "KB", "MB", "GB", "TB", "PB"];
     let mut value = bytes as f64;
     let mut unit = 0;
     while value.abs() >= 1000.0 && unit < UNITS.len() - 1 {
         value /= 1000.0;
         unit += 1;
     }
+    // **The rounding has to be applied before the unit is settled.** 999,999
+    // divides to 999.999 KB, which is under the loop's threshold, and then
+    // `{:.1}` rounds it up to "1000.0 KB" — a unit the ladder is supposed to
+    // make impossible. That is the exact bug `formatBytes.ts` was written to
+    // fix on the frontend, and this function's output is rendered on the same
+    // line as `formatBytes`' in a reclaim message, so the two disagreeing about
+    // it is visible in one sentence.
+    if unit > 0 && (value.abs() * 10.0).round() / 10.0 >= 1000.0 && unit < UNITS.len() - 1 {
+        value /= 1000.0;
+        unit += 1;
+    }
     if unit == 0 {
         format!("{} {}", bytes, UNITS[0])
     } else {
@@ -2795,12 +3338,148 @@ async fn build_from_dockerfile(dockerfile: &str, tag: &str) -> Result<(), String
 /// [`restore_image_config`].
 const COMPACTION_CONTAINER_PREFIX: &str = "triple-c-compact-";
 
+/// The tag a compaction builds to before it commits back over `:latest`.
+pub fn compaction_staging_ref(project_id: &str) -> String {
+    format!("triple-c-snapshot-{}:compacting", project_id)
+}
+
+/// Collect what a **crashed** compaction leaves on the daemon.
+///
+/// ## The stranded image nothing could find
+///
+/// `triple-c-snapshot-{id}:compacting` is dropped on every exit path inside
+/// [`compact_snapshot`] — every path that runs *in this process*. Kill the app
+/// mid-build and the tag survives, holding a whole flattened copy of a
+/// multi-gigabyte snapshot, and it was invisible to every single reclaim path
+/// in this module:
+///
+/// * the startup sweep filters `dangling=true`, and a tagged image is not
+///   dangling;
+/// * the pin reaper matches `:pre-migration-*`;
+/// * the per-project scan joins on `:latest`, so the row does not mention it;
+/// * `list_reclaimable` has no bucket that names it.
+///
+/// So it sat there forever with nothing in the UI that would ever say why the
+/// daemon was several gigabytes larger than the panel's own total. The same is
+/// true of a leftover `triple-c-compact-*` container, which is worse: it also
+/// *pins* the flattened image, so even untagging would not let the sweep
+/// collect it.
+///
+/// ## What it will not touch
+///
+/// A `:compacting` tag belonging to a compaction that is still running. In this
+/// process that is the project lock; in another instance of the app there is no
+/// lock to consult, so the image's own age is the brake — the tag exists for
+/// the few seconds to minutes between the build finishing and the commit, and
+/// [`SCRATCH_CONTAINER_MIN_AGE_SECS`] is far longer than that.
+pub async fn reap_stale_compaction_artifacts() -> usize {
+    reap_stale_compaction_artifacts_for("").await
+}
+
+/// [`reap_stale_compaction_artifacts`], ignoring `owner_project_id`'s own claim
+/// and its own staging tag age.
+///
+/// Called at the top of [`compact_snapshot`], which is already holding that
+/// project's lock: without the exclusion the sweep would see its own claim and
+/// skip, and the leftovers it is there to clear would survive the very run that
+/// went looking for them.
+async fn reap_stale_compaction_artifacts_for(owner_project_id: &str) -> usize {
+    remove_stale_compaction_containers(owner_project_id).await;
+
+    let Ok(docker) = get_docker() else {
+        return 0;
+    };
+    let images = docker
+        .list_images(Some(ListImagesOptions {
+            all: false,
+            filters: HashMap::from([(
+                "reference".to_string(),
+                vec!["triple-c-snapshot-*:compacting".to_string()],
+            )]),
+            ..Default::default()
+        }))
+        .await
+        .unwrap_or_default();
+
+    let now = chrono::Utc::now().timestamp();
+    let mut dropped = 0usize;
+    for image in images {
+        for reference in &image.repo_tags {
+            let Some((project_id, tag)) = migration::parse_snapshot_reference(reference) else {
+                continue;
+            };
+            if tag != "compacting" {
+                continue;
+            }
+            let is_owner = project_id == owner_project_id;
+            if !is_owner
+                && crate::project_lock::is_held_by(
+                    &project_id,
+                    crate::project_lock::ProjectOp::Compaction,
+                )
+            {
+                continue;
+            }
+            // Age is the only thing that can see another instance's live
+            // compaction, so it applies to the owner's own tag too.
+            if now - image.created < SCRATCH_CONTAINER_MIN_AGE_SECS {
+                log::info!(
+                    "Leaving {} alone — it was built less than {} minutes ago and may belong to \
+                     a compaction that is still running",
+                    reference,
+                    SCRATCH_CONTAINER_MIN_AGE_SECS / 60
+                );
+                continue;
+            }
+            match migration::untag_image(reference).await {
+                Ok(()) => {
+                    log::info!(
+                        "Dropped stranded compaction staging tag {} ({:.2} GB) — the compaction \
+                         that built it never finished",
+                        reference,
+                        image.size as f64 / 1_073_741_824.0
+                    );
+                    dropped += 1;
+                }
+                Err(e) => log::warn!("Could not drop {}: {}", reference, e),
+            }
+        }
+    }
+    dropped
+}
+
 /// Remove any container left behind by an interrupted compaction.
 ///
-/// Runs at the start of a compaction rather than from a reclaim bucket, so
-/// nothing can ever remove the container of a compaction that is still running:
-/// by the time this is called, this task owns the compaction path.
-async fn remove_stale_compaction_containers() {
+/// ## It was called from the wrong end of the compaction
+///
+/// The doc used to say "runs at the start of a compaction … by the time this is
+/// called, this task owns the compaction path". It did not: the only call was
+/// from inside [`restore_image_config`], which is the *last* step of a
+/// compaction. So it ran at the end, and it force-removed every
+/// `triple-c-compact-*` container on the daemon — including the one a second,
+/// concurrent compaction had just created and was about to commit. The claim in
+/// the comment is now true because the call moved to the top of
+/// [`compact_snapshot`], before anything is created.
+///
+/// Two brakes on top of the move, because the name carries a random uuid rather
+/// than a project id and so cannot be attributed to an owner:
+///
+/// * [`crate::project_lock::any_held_excluding`] — if this process is compacting anything
+///   at all, every `triple-c-compact-*` container might be that compaction's,
+///   and none is touched.
+/// * [`SCRATCH_CONTAINER_MIN_AGE_SECS`] — the same age gate the scrub bucket
+///   uses, which is the only thing that can see *another instance's* live
+///   compaction.
+async fn remove_stale_compaction_containers(owner_project_id: &str) {
+    if crate::project_lock::any_held_excluding(
+        crate::project_lock::ProjectOp::Compaction,
+        owner_project_id,
+    ) {
+        log::debug!(
+            "Skipping the compaction-container sweep: a compaction is in flight in this process"
+        );
+        return;
+    }
     let Ok(docker) = get_docker() else {
         return;
     };
@@ -2821,6 +3500,15 @@ async fn remove_stale_compaction_containers() {
         if !is_compaction_container(&summary) {
             continue;
         }
+        if !is_stale_scratch(&summary) {
+            log::info!(
+                "Leaving compaction container {} alone — it is younger than {} minutes, so it \
+                 may belong to another Triple-C instance's live compaction",
+                summary.id.as_deref().unwrap_or("<unknown>"),
+                SCRATCH_CONTAINER_MIN_AGE_SECS / 60
+            );
+            continue;
+        }
         if let Some(id) = summary.id.as_deref() {
             match container::remove_container(id).await {
                 Ok(()) => log::info!("Removed stale compaction container {}", id),
@@ -2874,10 +3562,10 @@ async fn restore_image_config(
     // container the commit is about to run against. Sequential execution inside
     // one `reclaim` call is not a guarantee when two can be in flight.
     //
-    // Stale ones are instead swept here, at the start of the next compaction —
-    // a created-but-never-started container has no writable layer, so a
-    // leftover costs almost nothing until then.
-    remove_stale_compaction_containers().await;
+    // Stale ones are instead swept at the *start* of the next compaction. That
+    // call used to be right here — i.e. at the end of a compaction, contradicting
+    // its own doc comment — where it force-removed a concurrent compaction's
+    // live container. It now sits at the top of `compact_snapshot`.
     let scratch_name = format!("{}{}", COMPACTION_CONTAINER_PREFIX, uuid::Uuid::new_v4().simple());
 
     // `image` is the flat build; everything else is copied from the original so
@@ -2966,12 +3654,16 @@ pub async fn clear_caches(project: &Project, include_rustup: bool) -> ReclaimRes
         project_id: project.id.clone(),
         include_rustup,
     };
-    if crate::commands::migration_commands::is_migrating(&project.id) {
-        return failed(
-            target,
-            "A base-image migration is in flight for this project.".to_string(),
-        );
-    }
+    // Held rather than polled, for the same reason as everything else here: a
+    // Reset removes both volumes, and an exec `rm -rf`-ing paths inside one of
+    // them while it is being deleted is not a race worth having.
+    let _guard = match crate::project_lock::try_acquire(
+        &project.id,
+        crate::project_lock::ProjectOp::CacheClear,
+    ) {
+        Ok(guard) => guard,
+        Err(reason) => return failed(target, reason),
+    };
 
     let container_id = match container::find_existing_container(project).await {
         Ok(Some(id)) => id,
@@ -3041,6 +3733,20 @@ pub async fn destroy(
     confirmation: &str,
     projects: &[Project],
 ) -> Result<ReclaimResult, String> {
+    // **The orphan arm comes first, because it has no project to find.** Its id
+    // is parsed out of a volume name and matches nothing in the store — that is
+    // its definition — so `find_project` would refuse it and the typed subject
+    // is the volume's own name.
+    if let DestructiveTarget::OrphanVolume { name, .. } = target {
+        if !confirmation_matches(name, confirmation) {
+            return Err(format!(
+                "Type the volume name ({}) exactly to confirm. Nothing was removed.",
+                name
+            ));
+        }
+        return destroy_orphan_volume(name, projects).await;
+    }
+
     let project = find_project(projects, target.project_id())?;
     if !confirmation_matches(&project.name, confirmation) {
         return Err(format!(
@@ -3048,12 +3754,13 @@ pub async fn destroy(
             project.name
         ));
     }
-    if crate::commands::migration_commands::is_migrating(&project.id) {
-        return Err(
-            "A base-image migration is in flight for this project. Finish or roll it back first."
-                .to_string(),
-        );
-    }
+    // **Held for the whole removal, not polled at the door.** The old check was
+    // a single `is_migrating` read, so a compaction that had already resolved
+    // `:latest` could commit its flattened result back over a snapshot this
+    // function had just deleted, resurrecting the layer the user typed a
+    // project name to be rid of.
+    let _guard =
+        crate::project_lock::try_acquire(&project.id, crate::project_lock::ProjectOp::Destroy)?;
 
     let docker = get_docker()?;
 
@@ -3136,6 +3843,12 @@ pub async fn destroy(
                 ),
             })
         }
+        DestructiveTarget::OrphanVolume { .. } => {
+            // Handled above, before the project lookup that this arm's siblings
+            // all depend on. Unreachable, and an `unreachable!()` here would be
+            // a panic in a function that deletes things.
+            Err("An orphaned volume is not a project object.".to_string())
+        }
         DestructiveTarget::RollbackPin { tag, .. } => {
             // **The one destructive variant carrying a free-form string.**
             // Every other arm builds its target from constants; this one takes
@@ -3152,6 +3865,10 @@ pub async fn destroy(
             }
             let reference = format!("triple-c-snapshot-{}:{}", project.id, tag);
             migration::untag_image(&reference).await?;
+            // The grace clock this pin may have had is meaningless once the tag
+            // is gone; leaving the marker would keep a dead file in the
+            // migrations directory forever.
+            migration_store::clear_ownerless(&project.id, tag);
             // Untagging only makes the image dangling. Whatever came back came
             // back through the sweep, under its own refusal rules.
             let sweep = container::sweep_orphaned_snapshots().await;
diff --git a/app/src-tauri/src/docker/disk_tests.rs b/app/src-tauri/src/docker/disk_tests.rs
index 8ec636a..4622ba3 100644
--- a/app/src-tauri/src/docker/disk_tests.rs
+++ b/app/src-tauri/src/docker/disk_tests.rs
@@ -26,9 +26,6 @@ fn all_reclaim_targets() -> Vec<ReclaimTarget> {
         ReclaimTarget::MigrationStaging,
         ReclaimTarget::ProbeContainers,
         ReclaimTarget::ScrubContainers,
-        ReclaimTarget::OrphanVolume {
-            name: "triple-c-home-gone".to_string(),
-        },
         ReclaimTarget::CompactSnapshot {
             project_id: "p1".to_string(),
         },
@@ -54,7 +51,7 @@ fn every_variant_is_covered_by_the_safety_walk() {
         .collect();
     assert_eq!(
         discriminants.len(),
-        10,
+        9,
         "a ReclaimTarget variant was added or removed; update all_reclaim_targets() and check its \
          safety: {:?}",
         discriminants
@@ -358,6 +355,44 @@ fn a_compaction_container_is_never_matched_by_the_scrub_bucket() {
     assert!(!is_compaction_container(&summary(&["/my-triple-c-compact-notes"], &[])));
 }
 
+#[test]
+fn the_daemon_wide_buckets_leave_a_young_container_alone() {
+    // Both of these buckets are `Safety::Safe` — one tick, no confirmation —
+    // and both reach *every* matching container on the daemon, because a label
+    // and a name prefix are daemon-wide and `ReclaimTarget::project_id()` is
+    // `None` for them. So a second app instance's live migration probe, and a
+    // live secret rewrite's scratch container, are both in range. Age is the
+    // only discriminator available from this side of the process boundary, and
+    // a container the daemon gave no creation time for is treated as young.
+    let now = chrono::Utc::now().timestamp();
+
+    let mut young_probe = summary(&["/nervous_curie"], &[(migration::LABEL_PROBE, "migration")]);
+    young_probe.created = Some(now - 30);
+    assert!(is_migration_probe(&young_probe));
+    assert!(!is_reapable_migration_probe(&young_probe));
+
+    let mut old_probe = young_probe.clone();
+    old_probe.created = Some(now - migration::PROBE_REAP_MIN_AGE_SECS - 1);
+    assert!(is_reapable_migration_probe(&old_probe));
+
+    let mut undated_probe = young_probe.clone();
+    undated_probe.created = None;
+    assert!(!is_reapable_migration_probe(&undated_probe));
+
+    // `triple-c-scrub-*` is a **live** name: `rewrite_image_without_secrets`
+    // creates its scratch container under it, and killing that between the
+    // create and the commit leaves a revoked OAuth token baked into the
+    // snapshot's Config.Env — the exact thing that function exists to remove.
+    let mut young_scrub = summary(&["/triple-c-scrub-abc123"], &[]);
+    young_scrub.created = Some(now - 5);
+    assert!(is_scrub_container(&young_scrub));
+    assert!(!is_reapable_scrub_container(&young_scrub));
+
+    let mut old_scrub = young_scrub.clone();
+    old_scrub.created = Some(now - SCRATCH_CONTAINER_MIN_AGE_SECS - 1);
+    assert!(is_reapable_scrub_container(&old_scrub));
+}
+
 #[test]
 fn a_probe_container_is_matched_on_its_label_not_on_the_daemons_filter() {
     // The `label=triple-c.probe=migration` filter is an exact match and would
@@ -393,7 +428,7 @@ fn project(id: &str, name: &str) -> Project {
 
 #[test]
 fn an_unreadable_projects_json_is_never_trusted() {
-    let err = project_store_trust(&[project("a", "api")], true, false).unwrap_err();
+    let err = project_store_trust(&[project("a", "api")], true, None).unwrap_err();
     assert!(err.contains("could not be read"), "{}", err);
 }
 
@@ -403,20 +438,44 @@ fn an_empty_list_from_an_existing_file_is_treated_as_a_failed_load() {
     // up and starts empty. That is right for the app and catastrophic here, so
     // the combination "empty list + file present" is refused rather than read as
     // "the user has no projects".
-    let err = project_store_trust(&[], true, true).unwrap_err();
+    let err = project_store_trust(&[], true, Some(&[])).unwrap_err();
     assert!(err.contains("suppressed"), "{}", err);
 
     // No file at all is a genuine fresh install, and there is nothing on the
     // daemon to mis-attribute in that state.
-    assert!(project_store_trust(&[], false, true).unwrap().is_empty());
+    assert!(project_store_trust(&[], false, Some(&[])).unwrap().is_empty());
 }
 
 #[test]
 fn a_healthy_store_yields_its_ids() {
-    let ids = project_store_trust(&[project("a", "api"), project("b", "web")], true, true).unwrap();
+    let ids =
+        project_store_trust(&[project("a", "api"), project("b", "web")], true, Some(&[])).unwrap();
     assert_eq!(ids, HashSet::from(["a".to_string(), "b".to_string()]));
 }
 
+#[test]
+fn a_project_only_the_file_knows_about_still_counts_as_live() {
+    // M6: `projects` is this process's in-memory list. A project added by a
+    // *second* copy of the app is in `projects.json` and not in that list, and
+    // its live home and config volumes then matched "no project claims this".
+    // The union is what closes the gap; the file is authoritative for
+    // everything this instance has not heard about.
+    let ids = project_store_trust(
+        &[project("a", "api")],
+        true,
+        Some(&["a".to_string(), "b-from-the-other-window".to_string()]),
+    )
+    .unwrap();
+    assert!(
+        ids.contains("b-from-the-other-window"),
+        "a project only the file knows about must not look orphaned: {:?}",
+        ids
+    );
+    // And the reverse: a project this instance just added is live whether or
+    // not the file has caught up.
+    assert!(ids.contains("a"), "{:?}", ids);
+}
+
 // ---------------------------------------------------------------------------
 // Layer accounting — the number the whole UI exists to show
 // ---------------------------------------------------------------------------
@@ -647,6 +706,94 @@ fn the_compaction_dockerfile_reuses_the_one_scrub_list() {
     assert!(!run_lines[0].contains('\n'));
 }
 
+#[test]
+fn the_compaction_run_carries_the_scrub_script_byte_for_byte() {
+    // **This is the assertion the old one should have been.** The previous
+    // version checked only that the `RUN` was a single line — which the broken
+    // space-fold satisfied perfectly, while producing
+    // `… for p in …; do [ -e "$p" ] || continue sz=$(…) …`, i.e. shell that
+    // `sh` refuses to parse. Every compaction ever attempted failed on the
+    // build's first stage.
+    //
+    // Nothing is folded now: the script goes into the JSON exec form verbatim,
+    // so the strong statement is available — what reaches `/bin/sh -c` is
+    // exactly what `snapshot_scrub_script()` returned, newlines included.
+    let script = container::snapshot_scrub_script();
+    let df = compaction_dockerfile("triple-c-snapshot-p1:latest", &script);
+    let run = df
+        .lines()
+        .find(|l| l.starts_with("RUN "))
+        .expect("no RUN line");
+    let recovered = script_from_run_line(run).expect("the RUN is not a parseable exec form");
+    assert_eq!(
+        recovered, script,
+        "the compaction must run the scrub script unmodified"
+    );
+    // The exec form names the shell itself, because `RUN [...]` does not go
+    // through one.
+    let argv: Vec<String> = serde_json::from_str(run.trim_start_matches("RUN ")).unwrap();
+    assert_eq!(argv[0], "/bin/sh");
+    assert_eq!(argv[1], "-c");
+}
+
+#[test]
+fn the_compaction_run_is_valid_shell() {
+    // The test that would have caught H1, and the only kind that can: hand the
+    // exact program the daemon will execute to a real shell and ask it to
+    // parse. `sh -n` reads and parses without running anything.
+    //
+    // It is run against the live `snapshot_scrub_script()` rather than a fixture
+    // precisely because that script is not this module's to own — it is free to
+    // grow a `case`, an `if` or a function, and this must keep holding when it
+    // does.
+    let df = compaction_dockerfile("triple-c-snapshot-p1:latest", &container::snapshot_scrub_script());
+    let run = df.lines().find(|l| l.starts_with("RUN ")).unwrap();
+    let script = script_from_run_line(run).unwrap();
+    assert_shell_parses(&script, "the compaction scrub");
+}
+
+#[test]
+fn a_multi_line_script_with_blocks_survives_the_run_encoding() {
+    // The property the old fold did not have, stated directly: a script with a
+    // `for`/`do`, an `if`/`then`, a `case` and a quote-heavy line has to survive
+    // whatever this module does to it. Joining lines with a space breaks the
+    // first three; joining with `;` breaks `if x; then; y`. Encoding the string
+    // breaks none of them.
+    let awkward = "total=0\n                   for p in /tmp/a* /tmp/b*; do\n                   \t[ -e \"$p\" ] || continue\n                   \tcase \"$p\" in\n                   \t\t*.keep) continue ;;\n                   \tesac\n                   \tif [ -d \"$p\" ]; then\n                   \t\trm -rf -- \"$p\"\n                   \tfi\n                   done\n                   echo \"done: $total\"\n";
+    let df = compaction_dockerfile("x:latest", awkward);
+    let run = df.lines().find(|l| l.starts_with("RUN ")).unwrap();
+    assert!(!run.contains('\n'), "the RUN must still be one Dockerfile line");
+    assert_eq!(script_from_run_line(run).unwrap(), awkward);
+    assert_shell_parses(awkward, "an awkward but legal script");
+}
+
+/// Run `sh -n` over a program and fail with the shell's own diagnostic.
+///
+/// Skipped, loudly, on a host with no `/bin/sh` — which is not a case any
+/// developer machine or CI image this repo targets is in, but a silent pass
+/// would be worse than a skipped test.
+fn assert_shell_parses(script: &str, what: &str) {
+    let output = match std::process::Command::new("/bin/sh")
+        .arg("-n")
+        .arg("-c")
+        .arg(script)
+        .output()
+    {
+        Ok(output) => output,
+        Err(e) => {
+            eprintln!("skipping the shell syntax check for {}: {}", what, e);
+            return;
+        }
+    };
+    assert!(
+        output.status.success(),
+        "{} is not valid shell:\n{}\n--- script ---\n{}",
+        what,
+        String::from_utf8_lossy(&output.stderr),
+        script
+    );
+}
+
 #[test]
 fn the_compaction_build_is_labelled_so_the_sweep_can_collect_it() {
     // Everything that cleans up after this build — the discard path when the
@@ -672,6 +819,13 @@ fn the_compaction_dockerfile_never_reaches_a_bind_mount() {
     // directories, mounted from the host. Nothing in a scrub may name one, and
     // the two read-only host mounts under /tmp are dot-prefixed so no glob
     // reaches them either.
+    //
+    // **Necessary, not sufficient, and do not read it as coverage.** A path not
+    // appearing as a literal says nothing about where a glob or a symlink
+    // resolves to at runtime; the containment property itself is tested in
+    // `container.rs`, which owns the path list and the script. This assertion
+    // is kept because a literal `/workspace` appearing here would be an
+    // unambiguous mistake, and that is all it detects.
     assert!(!df.contains("/workspace"), "{}", df);
     assert!(!df.contains(".host-ca"), "{}", df);
     assert!(!df.contains(".host-aws"), "{}", df);
@@ -936,3 +1090,406 @@ fn the_report_serialises_as_snake_case_like_every_other_ipc_struct() {
     // type is `number | null`, matching every other optional in `types.ts`.
     assert!(json["projects"][0]["snapshot_above_base_bytes"].is_null());
 }
+
+// ---------------------------------------------------------------------------
+// Rollback pins — the guards the safe bucket was missing
+// ---------------------------------------------------------------------------
+
+fn moment(y: i32, m: u32, d: u32) -> chrono::DateTime<chrono::Utc> {
+    chrono::NaiveDate::from_ymd_opt(y, m, d)
+        .unwrap()
+        .and_hms_opt(12, 0, 0)
+        .unwrap()
+        .and_utc()
+}
+
+#[test]
+fn the_safe_pin_bucket_applies_every_guard_the_other_paths_do() {
+    let now = moment(2026, 8, 23);
+    let ours = migration::rollback_tag(&moment(2026, 1, 1));
+
+    // 1. A tag that merely *starts* `pre-migration-`. `destroy` refuses it with
+    //    a comment explaining that `tag: "latest"` would otherwise name the
+    //    project's live snapshot; the safe bucket used to accept anything.
+    assert_eq!(
+        pin_disposition("pre-migration-keepme", false, Some(moment(2020, 1, 1)), &now),
+        PinDisposition::NotOurs
+    );
+    assert_eq!(
+        pin_disposition("latest", false, Some(moment(2020, 1, 1)), &now),
+        PinDisposition::NotOurs
+    );
+
+    // 2. A record still claims it. Never reaped at any age, and this is the one
+    //    guard the old code did have.
+    assert_eq!(
+        pin_disposition(&ours, true, Some(moment(2020, 1, 1)), &now),
+        PinDisposition::Claimed
+    );
+
+    // 3. Ownerless but inside the grace period — including "no reaper has seen
+    //    it yet", which is where the clock starts. The old code untagged this
+    //    immediately, and `sweep_orphaned_snapshots` four lines later turned
+    //    the untag into a deletion.
+    assert_eq!(
+        pin_disposition(&ours, false, None, &now),
+        PinDisposition::WithinGrace
+    );
+    assert_eq!(
+        pin_disposition(&ours, false, Some(now - chrono::Duration::days(1)), &now),
+        PinDisposition::WithinGrace
+    );
+
+    // 4. Ownerless and past its grace period. The only case that is collectable
+    //    without a typed confirmation.
+    assert_eq!(
+        pin_disposition(
+            &ours,
+            false,
+            Some(now - chrono::Duration::days(migration::STALE_PIN_MAX_AGE_DAYS)),
+            &now
+        ),
+        PinDisposition::Reapable
+    );
+}
+
+#[test]
+fn the_safe_bucket_and_the_startup_reaper_cannot_disagree() {
+    // Both go through `migration::pin_is_reapable`. The bug was that the safe
+    // bucket did not: `reap_stale_migration_pins` required a parseable tag and
+    // an age, the reclaim button required neither, and the button is the path
+    // with no confirmation in front of it.
+    let now = moment(2026, 8, 23);
+    let ours = migration::rollback_tag(&moment(2026, 1, 1));
+    for since in [
+        None,
+        Some(now - chrono::Duration::days(1)),
+        Some(now - chrono::Duration::days(migration::STALE_PIN_MAX_AGE_DAYS)),
+    ] {
+        for has_record in [true, false] {
+            assert_eq!(
+                pin_disposition(&ours, has_record, since, &now) == PinDisposition::Reapable,
+                migration::pin_is_reapable(&ours, has_record, since, &now),
+                "disposition and the reaper's own predicate disagreed for {:?}/{}",
+                since,
+                has_record
+            );
+        }
+    }
+}
+
+#[test]
+fn an_orphaned_volume_cannot_be_reached_without_a_typed_confirmation() {
+    // M5: it was a `ReclaimTarget` at `Safety::Safe` — a tick and the group
+    // button. `reclaim` cannot be handed a `DestructiveTarget` at all, which is
+    // the type-level half of the guarantee; this pins the other half, that no
+    // reclaim variant names a volume any more.
+    for target in all_reclaim_targets() {
+        let wire = serde_json::to_value(&target).unwrap();
+        let kind = wire["kind"].as_str().unwrap();
+        assert!(
+            !kind.contains("volume"),
+            "{} can reach a volume from the safe path",
+            kind
+        );
+    }
+
+    // And the confirmation subject is the *volume* name, because an orphan has
+    // no project in the store whose name could be typed.
+    let target = DestructiveTarget::OrphanVolume {
+        name: "triple-c-claude-config-gone".to_string(),
+        project_id: "gone".to_string(),
+    };
+    assert!(confirmation_matches(
+        "triple-c-claude-config-gone",
+        " triple-c-claude-config-gone "
+    ));
+    assert!(!confirmation_matches("triple-c-claude-config-gone", "gone"));
+    assert_eq!(target.project_id(), "gone");
+}
+
+// ---------------------------------------------------------------------------
+// The numbers, which the user reads as facts
+// ---------------------------------------------------------------------------
+
+#[test]
+fn the_snapshot_column_and_the_total_come_from_one_rule() {
+    // Case 1: the daemon measured the sharing. Its figure wins.
+    assert_eq!(snapshot_attribution(5_000_000_000, 4_700_000_000, Some(1)), 300_000_000);
+
+    // Case 2: no shared size, but the lineage is known. The layer arithmetic is
+    // the honest answer, and it is what the Snapshot column already showed —
+    // while `total_bytes` used `size - shared` (i.e. the whole image, base
+    // included) and `triple_c_total_bytes` then added the base again as its own
+    // row. That double count is the exact thing the comment beside the
+    // subtraction says it prevents.
+    assert_eq!(snapshot_attribution(5_000_000_000, 0, Some(300_000_000)), 300_000_000);
+
+    // Case 3: nothing known. The full size, not zero — an image that shares
+    // nothing measurable really does cost all of it, and a flattened snapshot
+    // is exactly that shape.
+    assert_eq!(snapshot_attribution(5_000_000_000, 0, None), 5_000_000_000);
+
+    // A daemon that reports `-1` for "not computed" must not be read as a
+    // 1-byte saving, and a negative result is never returned.
+    assert_eq!(snapshot_attribution(1_000, -1, None), 1_000);
+    assert_eq!(snapshot_attribution(1_000, 4_000, Some(0)), 0);
+}
+
+#[test]
+fn a_row_adds_up() {
+    // The property the fix exists for, stated arithmetically: whatever the
+    // Snapshot column shows is what the Total is built from.
+    for (size, shared, above) in [
+        (5_000_000_000i64, 4_700_000_000i64, Some(1i64)),
+        (5_000_000_000, 0, Some(300_000_000)),
+        (5_000_000_000, 0, None),
+        (0, 0, None),
+    ] {
+        let snapshot = snapshot_attribution(size, shared, above);
+        let (writable, home, config) = (10i64, 20i64, 30i64);
+        let total = snapshot + writable + home + config;
+        assert_eq!(
+            total - (writable + home + config),
+            snapshot,
+            "the Total column has to reconcile with the Snapshot column"
+        );
+    }
+}
+
+#[test]
+fn human_never_prints_a_unit_the_ladder_forbids() {
+    // The 999,999 → "1000.0 KB" bug, which is the one `formatBytes.ts` was
+    // written to fix on the frontend. This function's output is rendered on the
+    // same line as `formatBytes`' in a compaction message, so the two
+    // disagreeing is visible in a single sentence.
+    assert_eq!(human(999_999), "1.0 MB");
+    assert_eq!(human(999_999_999), "1.0 GB");
+    assert_eq!(human(999_999_999_999), "1.0 TB");
+
+    // The ordinary cases still read the way `docker system df` prints them,
+    // base 1000.
+    assert_eq!(human(0), "0 B");
+    assert_eq!(human(999), "999 B");
+    assert_eq!(human(1_000), "1.0 KB");
+    assert_eq!(human(1_500_000), "1.5 MB");
+    assert_eq!(human(4_700_000_000), "4.7 GB");
+    // Rounding that does *not* cross the boundary is untouched.
+    assert_eq!(human(999_400), "999.4 KB");
+}
+
+#[test]
+fn no_output_of_human_is_ever_a_four_digit_mantissa() {
+    // A sweep rather than a handful of cases: every power-of-ten boundary and
+    // its neighbours, which is where the bug lived.
+    let mut value = 1i64;
+    for _ in 0..19 {
+        for candidate in [value - 1, value, value + 1] {
+            if candidate < 0 {
+                continue;
+            }
+            let rendered = human(candidate);
+            let mantissa = rendered.split(' ').next().unwrap();
+            let numeric: f64 = mantissa.parse().unwrap();
+            assert!(
+                numeric < 1000.0 || rendered.ends_with(" PB"),
+                "{} rendered as {}, which the unit ladder is supposed to make impossible",
+                candidate,
+                rendered
+            );
+        }
+        value = match value.checked_mul(10) {
+            Some(v) => v,
+            None => break,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// End-to-end compaction, against a real daemon
+// ---------------------------------------------------------------------------
+
+/// The whole compaction mechanism, run for real.
+///
+/// `#[ignore]` because it needs a Docker daemon, pulls `busybox`, and takes
+/// tens of seconds — `cargo test` has to stay daemon-free. Run it with
+/// `cargo test -- --ignored compaction_end_to_end`.
+///
+/// It exists because H1 was invisible to every unit test in this file: the
+/// generated Dockerfile looked right, the `RUN` was one line as asserted, and
+/// the build failed on `/bin/sh: line 0: syntax error: unexpected "do"` every
+/// single time. The only test that could have caught it is one that hands the
+/// Dockerfile to a daemon.
+///
+/// It exercises the production functions — [`compaction_dockerfile`],
+/// [`build_from_dockerfile`], [`restore_image_config`] — rather than
+/// [`compact_snapshot`] itself, so it never has to create a
+/// `triple-c-snapshot-*` tag that the app's own sweeps might reach.
+#[tokio::test]
+#[ignore]
+async fn compaction_end_to_end_against_a_real_image() {
+    let stem = format!("compaction-e2e-{}", uuid::Uuid::new_v4().simple());
+    let source = format!("{}:source", stem);
+    let staging = format!("{}:compacting", stem);
+    let final_ref = format!("{}:latest", stem);
+
+    // A snapshot-shaped source: four stacked layers, each superseding the last,
+    // plus the scrub's own targets and a setuid bit that `COPY --from` has to
+    // preserve. The env var carries a newline and a double quote, which is what
+    // `restore_image_config` exists for.
+    let source_dockerfile = format!(
+        "FROM busybox:1.36\n\
+         RUN mkdir -p /tmp/claude-1000 /var/cache/apt/archives /var/log/apt /var/lib/apt/lists && \
+         dd if=/dev/urandom of=/big-a bs=1M count=40 2>/dev/null\n\
+         RUN dd if=/dev/urandom of=/big-b bs=1M count=40 2>/dev/null && rm -f /big-a\n\
+         RUN dd if=/dev/urandom of=/tmp/claude-1000/scratch bs=1M count=25 2>/dev/null && \
+         dd if=/dev/urandom of=/var/cache/apt/archives/x.deb bs=1M count=15 2>/dev/null && \
+         touch /var/log/dpkg.log\n\
+         RUN dd if=/dev/urandom of=/big-c bs=1M count=30 2>/dev/null && rm -f /big-b && \
+         touch /keepme && chmod 4755 /keepme\n\
+         LABEL {LABEL_MANAGED}=true\n\
+         WORKDIR /keep-this-dir\n"
+    );
+
+    // Force, unlike anything in production: `untag_image` is deliberately
+    // unforced because it runs against a user's images, and here the leftovers
+    // are this test's own and must not be left on the developer's daemon
+    // whatever refuses them.
+    async fn cleanup(refs: Vec<String>) {
+        let Ok(docker) = get_docker() else {
+            return;
+        };
+        for r in refs {
+            if let Err(e) = docker
+                .remove_image(
+                    &r,
+                    Some(RemoveImageOptions {
+                        force: true,
+                        noprune: false,
+                    }),
+                    None,
+                )
+                .await
+            {
+                eprintln!("could not clean up {}: {}", r, e);
+            }
+        }
+    }
+
+    build_from_dockerfile(&source_dockerfile, &source)
+        .await
+        .expect("could not build the throwaway source image");
+
+    let docker = get_docker().expect("no docker");
+    let before = docker.inspect_image(&source).await.expect("inspect source");
+    let before_size = before.size.unwrap_or(0);
+    let mut config = before.config.clone().expect("source has no config");
+    // A genuinely multi-line env var, injected here rather than through the
+    // Dockerfile because `ENV` cannot express a literal newline. This is the
+    // case `restore_image_config` exists for: it is why the config is replayed
+    // through a create-and-commit instead of being rendered back into
+    // Dockerfile instructions, where a newline and a `"` would not survive.
+    config
+        .env
+        .get_or_insert_with(Vec::new)
+        .push("E2E_MULTILINE=first\nsecond \"quoted\"".to_string());
+
+    // --- the thing under test ------------------------------------------------
+    let dockerfile = compaction_dockerfile(&source, &container::snapshot_scrub_script());
+    let built = build_from_dockerfile(&dockerfile, &staging).await;
+    assert!(
+        built.is_ok(),
+        "the compaction build failed, which is exactly the H1 regression: {:?}\n{}",
+        built,
+        dockerfile
+    );
+
+    restore_image_config(&staging, &final_ref, config)
+        .await
+        .expect("could not replay the image config");
+
+    let after = docker
+        .inspect_image(&final_ref)
+        .await
+        .expect("inspect compacted");
+    let after_size = after.size.unwrap_or(0);
+    let history = docker.image_history(&final_ref).await.expect("history");
+    let after_config = after.config.clone().expect("no config after");
+
+    // The scrub actually ran — the assertion H1 made impossible. `sh -c` inside
+    // the compacted image, so the answer comes from the filesystem rather than
+    // from the build log.
+    let probe = migration::run_throwaway(
+        &final_ref,
+        "ls /keepme >/dev/null 2>&1 && echo KEEP-OK\n\
+         [ -e /tmp/claude-1000/scratch ] && echo SCRATCH-LEFT\n\
+         [ -e /var/cache/apt/archives/x.deb ] && echo DEB-LEFT\n\
+         [ -e /var/log/dpkg.log ] && echo DPKGLOG-LEFT\n\
+         [ -e /big-a ] && echo BIGA-LEFT\n\
+         [ -e /big-c ] || echo BIGC-MISSING\n\
+         ls -l /keepme\n\
+         echo PROBE-END\n\
+         exit 0\n",
+    )
+    .await
+    .expect("could not probe the compacted image");
+
+    // **Everything is measured before anything is asserted**, so a failing
+    // assertion below does not leave several hundred megabytes of throwaway
+    // images on the developer's daemon.
+    cleanup(vec![final_ref, staging, source]).await;
+
+    // 1. It is smaller. The three superseded 30–40 MB layers and the ~40 MB of
+    //    scrub targets are the whole point.
+    assert!(
+        after_size < before_size,
+        "compaction did not shrink the image: {} -> {}",
+        before_size,
+        after_size
+    );
+
+    // 2. One layer of content.
+    let content_layers = history.iter().filter(|e| e.size > 0).count();
+    assert_eq!(content_layers, 1, "expected one content layer: {:?}", history);
+
+    // 3. The config round-tripped, newline and quote included.
+    let env = after_config.env.clone().unwrap_or_default();
+    assert!(
+        env.iter()
+            .any(|e| e == "E2E_MULTILINE=first\nsecond \"quoted\""),
+        "the multi-line env var did not survive: {:?}",
+        env
+    );
+    assert_eq!(after_config.working_dir.as_deref(), Some("/keep-this-dir"));
+
+    // 4. The scrub actually ran.
+    assert!(probe.stdout.contains("PROBE-END"), "{}", probe.stdout);
+    assert!(probe.stdout.contains("KEEP-OK"), "{}", probe.stdout);
+    assert!(
+        !probe.stdout.contains("SCRATCH-LEFT"),
+        "the agent scratchpad survived the scrub:\n{}",
+        probe.stdout
+    );
+    assert!(
+        !probe.stdout.contains("DEB-LEFT"),
+        "apt archives survived the scrub:\n{}",
+        probe.stdout
+    );
+    assert!(
+        !probe.stdout.contains("DPKGLOG-LEFT"),
+        "dpkg.log survived the scrub:\n{}",
+        probe.stdout
+    );
+    assert!(
+        !probe.stdout.contains("BIGC-MISSING"),
+        "the live payload was lost, which is worse than not compacting:\n{}",
+        probe.stdout
+    );
+    // `COPY --from` has to keep the setuid bit; a compaction that dropped it
+    // would break sudo inside every migrated project.
+    assert!(
+        probe.stdout.contains("-rwsr-xr-x"),
+        "the setuid bit did not survive the flatten:\n{}",
+        probe.stdout
+    );
+}
diff --git a/app/src-tauri/src/docker/migration.rs b/app/src-tauri/src/docker/migration.rs
index 323d346..65b08b8 100644
--- a/app/src-tauri/src/docker/migration.rs
+++ b/app/src-tauri/src/docker/migration.rs
@@ -754,9 +754,16 @@ impl ProbeContainerGuard {
         &self.id
     }
 
+    /// **Disarm after the await, never before it.** Clearing `armed` first
+    /// looked equivalent and was the exact inverse of this guard's purpose: on
+    /// the one path it exists for — this future being dropped part-way through
+    /// the removal — `Drop` then saw a disarmed guard and did nothing, so the
+    /// container survived with no background removal queued behind it. Setting
+    /// it afterwards means a cancelled `remove_now` falls back to `Drop`'s
+    /// detached removal, and only a removal that actually completed disarms.
     async fn remove_now(mut self) {
-        self.armed = false;
         remove_probe_container(&self.id).await;
+        self.armed = false;
     }
 }
 
@@ -810,6 +817,17 @@ async fn remove_probe_container(id: &str) {
 /// and no volumes, owned entirely by a `run_throwaway` call. If one is running
 /// right now it belongs to this process — and this runs before any migration
 /// can be started, so there is none to interrupt.
+///
+/// **Except that "belongs to this process" is not something this can know.**
+/// The filter is a label, and labels are daemon-wide: a second copy of the app
+/// migrating a project on the same daemon has probe containers carrying exactly
+/// this label, and force-removing one mid-manifest-capture fails that
+/// migration. In-process state cannot see the other instance, so the only
+/// available brake is age — [`PROBE_REAP_MIN_AGE_SECS`]. A probe runs a `df`, an
+/// `apt-get update` or a `find` over a root filesystem; none of those is a
+/// multi-minute job, so anything younger than the gate is far more likely to be
+/// someone's live probe than a leftover, and a leftover simply waits for the
+/// next start.
 pub async fn reap_probe_containers() {
     let Ok(docker) = get_docker() else {
         return;
@@ -835,7 +853,23 @@ pub async fn reap_probe_containers() {
         }
     };
 
+    let now = chrono::Utc::now().timestamp();
     for c in containers {
+        // `created` is a unix timestamp; a summary without one is treated as
+        // too young to touch, because unknown is never permission.
+        let age = c.created.map(|created| now - created);
+        match age {
+            Some(age) if age >= PROBE_REAP_MIN_AGE_SECS => {}
+            _ => {
+                log::info!(
+                    "Leaving migration probe container {} alone — it is younger than {} minutes, \
+                     so it may belong to another Triple-C instance's live migration",
+                    c.id.as_deref().unwrap_or("<unknown>"),
+                    PROBE_REAP_MIN_AGE_SECS / 60
+                );
+                continue;
+            }
+        }
         if let Some(id) = c.id {
             log::info!("Removing leftover migration probe container {}", id);
             remove_probe_container(&id).await;
@@ -843,6 +877,16 @@ pub async fn reap_probe_containers() {
     }
 }
 
+/// How old a `triple-c.probe=migration` container must be before
+/// [`reap_probe_containers`] will force-remove it, in seconds.
+///
+/// The label is daemon-wide and this process cannot tell its own leftovers from
+/// another instance's live probe, so this is the whole guard. Generous against
+/// the longest probe there is (an `apt-get update` inside a throwaway container
+/// on a slow link) and still short enough that a crashed run's probe stops
+/// pinning a multi-gigabyte base image within the hour.
+pub const PROBE_REAP_MIN_AGE_SECS: i64 = 30 * 60;
+
 async fn run_throwaway_inner(id: &str) -> Result<ThrowawayResult, String> {
     let docker = get_docker()?;
 
@@ -1025,6 +1069,10 @@ pub fn rollback_tag(now: &chrono::DateTime<chrono::Utc>) -> String {
 ///
 /// Two weeks, chosen to be far longer than anyone deliberates over a base
 /// update and far shorter than "forever", which is what it was.
+///
+/// **Measured from when the record went missing, not from the tag.** See
+/// [`pin_is_reapable`] and
+/// [`crate::storage::migration_store::note_ownerless_since`].
 pub const STALE_PIN_MAX_AGE_DAYS: i64 = 14;
 
 /// Recover the timestamp encoded in a tag produced by [`rollback_tag`].
@@ -1051,26 +1099,59 @@ pub fn parse_snapshot_reference(reference: &str) -> Option<(String, String)> {
     Some((project_id, tag))
 }
 
-/// Whether a rollback pin is safe to drop, given how old it is and whether the
-/// project it belongs to still has a migration record.
+/// Whether a rollback pin is safe to drop, given whether the project it belongs
+/// to still has a migration record and how long it has been without one.
 ///
-/// Pure so the decision can be tested without a daemon. The order of the two
+/// Pure so the decision can be tested without a daemon. The order of the
 /// conditions is the point: **a pin whose migration is still awaiting
 /// confirmation is never reaped at any age**, because it is the only copy of
 /// the rollback target and the user has not yet said they are happy with the
 /// new base.
+///
+/// ## `ownerless_since`, and why it is not the tag's timestamp
+///
+/// This used to compute the age from `parse_rollback_tag(tag)` — the instant
+/// the migration *started*. A migration is allowed to sit at
+/// `awaiting-confirmation` for as long as the user likes; that is what
+/// `keep_rollback` is for. A project parked there for a month whose record is
+/// then lost had a tag a month old, so the pin was reapable on the very next
+/// check and the startup sweep deleted the image immediately after. The
+/// fourteen days were nominal: the real grace period for the case the constant
+/// was written for was zero.
+///
+/// So the clock starts when the claim was lost, which is recorded by
+/// [`crate::storage::migration_store::note_ownerless_since`] the first time a
+/// reaper notices. `None` means no reaper has recorded a sighting yet, and that
+/// is **not** "sighted now": returning false there is what gives a pin its
+/// first full fourteen days instead of none.
+///
+/// ## Clock skew
+///
+/// A `now` earlier than `ownerless_since` — a host clock that ran fast and was
+/// corrected, or a data directory carried between machines — yields a negative
+/// elapsed time. That is treated as not reapable, and the marker writer
+/// re-anchors it, rather than letting a negative `num_days()` mean "never" or
+/// an inflated one mean "immediately".
 pub fn pin_is_reapable(
     tag: &str,
     has_migration_record: bool,
+    ownerless_since: Option<chrono::DateTime<chrono::Utc>>,
     now: &chrono::DateTime<chrono::Utc>,
 ) -> bool {
     if has_migration_record {
         return false;
     }
-    let Some(created) = parse_rollback_tag(tag) else {
+    // Still required: the tag has to be one of ours. A hand-made
+    // `pre-migration-keepme` is somebody's deliberate pin and is never guessed
+    // at, whatever a marker beside it says.
+    if parse_rollback_tag(tag).is_none() {
+        return false;
+    }
+    let Some(since) = ownerless_since else {
         return false;
     };
-    (*now - created).num_days() >= STALE_PIN_MAX_AGE_DAYS
+    let elapsed = *now - since;
+    elapsed >= chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS)
 }
 
 /// Drop `triple-c-snapshot-*:pre-migration-*` tags that no migration record
@@ -1138,15 +1219,35 @@ pub async fn reap_stale_migration_pins() -> usize {
             // still count as "somebody may want this back".
             let has_record =
                 crate::storage::migration_store::has_record(&project_id).unwrap_or(true);
-            if !pin_is_reapable(&tag, has_record, &now) {
+            if has_record {
+                // Owned again (or still owned): throw away any grace clock a
+                // previous pass started, so a pin that loses its record twice
+                // gets a fresh fourteen days rather than inheriting a stale one.
+                crate::storage::migration_store::clear_ownerless(&project_id, &tag);
+                continue;
+            }
+            // Only a *well-formed* pin gets a marker written for it — a tag
+            // that is not one of ours is left entirely alone, files included.
+            if parse_rollback_tag(&tag).is_none() {
+                continue;
+            }
+            // Records the first sighting when there is none, which is why this
+            // returns `None` on that pass and the pin survives it.
+            let ownerless_since =
+                crate::storage::migration_store::note_ownerless_since(&project_id, &tag, &now);
+            if !pin_is_reapable(&tag, has_record, ownerless_since, &now) {
                 continue;
             }
             match untag_image(reference).await {
                 Ok(()) => {
+                    crate::storage::migration_store::clear_ownerless(&project_id, &tag);
                     log::info!(
-                        "Dropped stale rollback pin {} ({:.2} GB) — no migration record has claimed it for {} days",
+                        "Dropped stale rollback pin {} ({:.2} GB) — no migration record has claimed it since {}, more than {} days",
                         reference,
                         summary.size as f64 / 1_073_741_824.0,
+                        ownerless_since
+                            .map(|t| t.to_rfc3339())
+                            .unwrap_or_else(|| "unknown".to_string()),
                         STALE_PIN_MAX_AGE_DAYS,
                     );
                     reaped += 1;
@@ -1915,29 +2016,93 @@ mod tests {
         // image is the only copy of the rollback target and the user has not
         // yet said they are happy on the new base.
         let ancient = rollback_tag(&at(2020, 1, 1));
-        assert!(!pin_is_reapable(&ancient, true, &at(2026, 8, 23)));
+        assert!(!pin_is_reapable(
+            &ancient,
+            true,
+            Some(at(2020, 1, 1)),
+            &at(2026, 8, 23)
+        ));
     }
 
     #[test]
     fn an_unclaimed_pin_is_reaped_only_once_it_is_old() {
-        let made = at(2026, 8, 1);
-        let tag = rollback_tag(&made);
-        assert!(!pin_is_reapable(&tag, false, &at(2026, 8, 2)));
+        let tag = rollback_tag(&at(2026, 8, 1));
+        // The clock runs from when the record went missing, which here is well
+        // after the migration started.
+        let lost = at(2026, 8, 10);
+        assert!(!pin_is_reapable(&tag, false, Some(lost), &at(2026, 8, 11)));
         assert!(!pin_is_reapable(
             &tag,
             false,
-            &(made + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS - 1))
+            Some(lost),
+            &(lost + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS) - chrono::Duration::seconds(1))
         ));
         assert!(pin_is_reapable(
             &tag,
             false,
-            &(made + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS))
+            Some(lost),
+            &(lost + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS))
         ));
     }
 
+    #[test]
+    fn the_grace_period_runs_from_the_lost_record_not_from_the_tag() {
+        // The bug this replaced, stated as a test. A migration parked at
+        // `awaiting-confirmation` for a month — supported, that is what
+        // `keep_rollback` is for — whose record is then lost had a
+        // month-old tag, so the old rule made its pin reapable on the very
+        // next app start with the startup sweep deleting the image two lines
+        // later. Zero grace, on the one case the fourteen days exist for.
+        let started = at(2026, 6, 1);
+        let tag = rollback_tag(&started);
+        let record_lost = at(2026, 7, 1);
+        let noticed_immediately_after = record_lost + chrono::Duration::minutes(5);
+        assert!(
+            !pin_is_reapable(&tag, false, Some(record_lost), &noticed_immediately_after),
+            "a tag a month old must still get its full grace period once orphaned"
+        );
+    }
+
+    #[test]
+    fn an_unsighted_pin_is_never_reaped_on_the_pass_that_first_sees_it() {
+        // `None` means no reaper has recorded a sighting. Treating that as
+        // "sighted now" would be harmless; treating it as "sighted long ago"
+        // would not, and neither is what it means — the marker is written on
+        // this pass and the pin becomes reapable fourteen days later.
+        let tag = rollback_tag(&at(2020, 1, 1));
+        assert!(!pin_is_reapable(&tag, false, None, &at(2026, 8, 23)));
+    }
+
+    #[test]
+    fn a_clock_that_ran_backwards_neither_reaps_nor_strands() {
+        // A marker dated after `now`: the host clock was fast and got
+        // corrected, or the data directory came from another machine. A
+        // negative elapsed time must read as "not yet", not as a huge age.
+        let tag = rollback_tag(&at(2026, 1, 1));
+        let marker = at(2026, 9, 1);
+        assert!(!pin_is_reapable(&tag, false, Some(marker), &at(2026, 8, 1)));
+        // The other direction is bounded by the marker rather than by the tag:
+        // a wildly future `now` can only expire a clock that was actually
+        // started, and a pin with no marker (the case above) still cannot be
+        // reaped at all — which is what stops a fast host clock from making
+        // *every* pin on the daemon instantly collectable.
+        assert!(pin_is_reapable(
+            &tag,
+            false,
+            Some(at(2026, 8, 20)),
+            &at(2030, 1, 1)
+        ));
+        assert!(!pin_is_reapable(&tag, false, None, &at(2030, 1, 1)));
+    }
+
     #[test]
     fn a_tag_we_cannot_date_is_left_alone() {
-        assert!(!pin_is_reapable("pre-migration-handmade", false, &at(2026, 8, 23)));
-        assert!(!pin_is_reapable("latest", false, &at(2026, 8, 23)));
+        // Even with an ancient ownerless marker sitting beside it: a tag that
+        // merely *starts* `pre-migration-` is somebody's deliberate pin, and
+        // the reaper never writes a marker for one in the first place.
+        let ancient = Some(at(2020, 1, 1));
+        let now = at(2026, 8, 23);
+        assert!(!pin_is_reapable("pre-migration-handmade", false, ancient, &now));
+        assert!(!pin_is_reapable("latest", false, ancient, &now));
     }
 }
diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs
index 6661d2a..14df6a3 100644
--- a/app/src-tauri/src/lib.rs
+++ b/app/src-tauri/src/lib.rs
@@ -5,6 +5,7 @@ mod docker;
 mod install_helper;
 mod logging;
 mod models;
+mod project_lock;
 mod storage;
 pub mod web_terminal;
 
@@ -263,6 +264,19 @@ pub fn run() {
             let drag_temp_dir = app.path().temp_dir().ok();
             tauri::async_runtime::spawn(async move {
                 crate::docker::reap_probe_containers().await;
+                // Before the sweep, and for the same reason the pins are:
+                // `triple-c-snapshot-*:compacting` is a *tagged* image, so the
+                // sweep's `dangling=true` filter cannot see it, and the
+                // `triple-c-compact-*` container a crashed compaction leaves
+                // behind pins that image open. Untagging first is what turns
+                // both into something the sweep can collect on the same pass.
+                let stranded = crate::docker::disk::reap_stale_compaction_artifacts().await;
+                if stranded > 0 {
+                    log::info!(
+                        "Startup housekeeping dropped {} stranded compaction staging tag(s)",
+                        stranded
+                    );
+                }
                 let reaped = crate::docker::reap_stale_migration_pins().await;
                 if reaped > 0 {
                     log::info!("Startup housekeeping dropped {} stale rollback pin(s)", reaped);
diff --git a/app/src-tauri/src/project_lock.rs b/app/src-tauri/src/project_lock.rs
new file mode 100644
index 0000000..685acb0
--- /dev/null
+++ b/app/src-tauri/src/project_lock.rs
@@ -0,0 +1,338 @@
+//! Per-project mutual exclusion for everything that rewrites a project's
+//! container or its snapshot image.
+//!
+//! ## Why polling was not enough
+//!
+//! Until this module existed the app had exactly one mutual-exclusion
+//! primitive — the `ACTIVE_MIGRATIONS` set behind
+//! `migration_commands::is_migrating` — and it was **one-way**. A migration
+//! took a guard for its whole run; everything else merely *asked once, at
+//! entry*, whether a migration was in flight and then proceeded with no claim
+//! of its own. Two non-migration operations on the same project could not see
+//! each other at all, and a migration could start underneath one that was
+//! already halfway through.
+//!
+//! That is not a theoretical gap. Compaction resolves
+//! `triple-c-snapshot-{id}:latest` when its build starts and commits back over
+//! that same tag minutes later, and the Settings panel is a sidebar rather than
+//! a modal — so Project Home stays live with Start, Stop, Reset and Migrate all
+//! clickable while a compaction runs. Three interleavings were reproduced:
+//!
+//! * Compaction commits `flat(A)` over `:latest` after a migration has already
+//!   moved that tag to a new lineage. The migration is silently reverted, the
+//!   config replay lands twice, and the migration record says
+//!   `awaiting-confirmation` against a base the tag no longer points at.
+//! * Compaction resolves A, the user starts the project and works for an hour,
+//!   a recreate commits D over `:latest`, and the compaction then overwrites it
+//!   with `flat(A)` — orphaning an hour of system-layer work while reporting
+//!   success and a byte saving.
+//! * Compaction resurrects the system layer a Reset had just destroyed.
+//!
+//! Every one of those is "two writers of `:latest`, neither holding anything".
+//! So this registry replaces the polling with an actual claim: an operation
+//! **acquires** a [`ProjectGuard`] and holds it for its whole run, and a second
+//! operation on the same project is refused with a message naming the holder.
+//!
+//! ## What this does NOT protect against, stated plainly
+//!
+//! **This is in-process state.** Two copies of the app pointed at the same
+//! Docker daemon share nothing here: instance A's compaction and instance B's
+//! migration will both acquire happily and then race exactly as before.
+//! `reap_probe_containers` and the `triple-c-compact-*` / `triple-c-scrub-*`
+//! sweeps are worse than that — they are daemon-wide force-removals driven by
+//! a name or a label, so instance B can destroy a container instance A is
+//! mid-commit against.
+//!
+//! A daemon-visible lock was considered and rejected for now, and the reasoning
+//! is recorded here so it is not re-derived from scratch:
+//!
+//! * A **lock container** would work — container names are unique daemon-wide
+//!   and `create` fails atomically on a name conflict — but a container has to
+//!   be created *from an image*, and that pins the image. A lock on
+//!   `triple-c-snapshot-{id}` would block the very `rmi`/sweep paths it guards,
+//!   and a leaked lock container would pin multiple gigabytes forever.
+//! * A **named volume** is not usable: `create_volume` on an existing name
+//!   returns the existing volume rather than failing, so it cannot be a
+//!   test-and-set.
+//! * A **label on the snapshot image** is not atomic — read/modify/commit has
+//!   the same race it would be trying to close.
+//!
+//! So the cross-process case is **documented, not solved**. What this module
+//! does do about it is bound the damage: [`any_held_excluding`] lets the daemon-wide
+//! reapers skip work while this process is mid-operation, and the reapers
+//! themselves gained age gates so a young container belonging to somebody else
+//! is left alone (see `docker::disk::reap_stale_compaction_artifacts` and
+//! `docker::migration::reap_probe_containers`).
+//!
+//! ## Refuse, do not queue
+//!
+//! [`try_acquire`] never waits. Every caller is a user-initiated action behind
+//! a button, and a button that blocks for the four minutes a compaction takes
+//! is worse than one that says what is running. The refusal string is written
+//! for the user and names the holder.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock};
+
+/// The operations that claim a project.
+///
+/// One variant per *class of writer*, not per command: `Recreate` covers Start
+/// as well, because Start's create-and-commit path is the same writer of
+/// `triple-c-snapshot-{id}:latest` that a recreate is.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProjectOp {
+    /// `migrate_project_to_base`, `resume_migration`, `rollback_migration`,
+    /// `confirm_migration`.
+    Migration,
+    /// `disk::compact_snapshot` — the long one, and the reason this exists.
+    Compaction,
+    /// Start / stop / recreate. Anything in `start_project_container`'s path.
+    Recreate,
+    /// `rebuild_project_container` — deletes both volumes and the snapshot.
+    Reset,
+    /// `disk::destroy` — a volume, a snapshot image, or a rollback pin.
+    Destroy,
+    /// `disk::clear_caches` — an exec into the live container. It does not
+    /// write `:latest`, but it must not run while the container is being
+    /// removed out from under it.
+    CacheClear,
+}
+
+impl ProjectOp {
+    /// What is happening, phrased for the message a user reads.
+    pub fn describe(self) -> &'static str {
+        match self {
+            ProjectOp::Migration => "A container base update is running for this project",
+            ProjectOp::Compaction => "This project's snapshot is being compacted",
+            ProjectOp::Recreate => "This project's container is being started or recreated",
+            ProjectOp::Reset => "This project is being reset",
+            ProjectOp::Destroy => "Something of this project's is being deleted",
+            ProjectOp::CacheClear => "This project's caches are being cleared",
+        }
+    }
+
+    /// What the *refused* caller was trying to do, for the tail of the message.
+    fn blocked_action(self) -> &'static str {
+        match self {
+            ProjectOp::Migration => "starting a base update",
+            ProjectOp::Compaction => "compacting its snapshot",
+            ProjectOp::Recreate => "starting or recreating its container",
+            ProjectOp::Reset => "resetting it",
+            ProjectOp::Destroy => "deleting anything of its",
+            ProjectOp::CacheClear => "clearing its caches",
+        }
+    }
+}
+
+/// Project id → the operation currently holding it.
+///
+/// A `std::sync::Mutex` rather than a `tokio` one on purpose: it is only ever
+/// held for the length of a `HashMap` insert or remove, never across an await,
+/// and [`is_held_by`] has to be callable from the synchronous helpers in
+/// `disk.rs` that already ask this question.
+static HOLDERS: OnceLock<Mutex<HashMap<String, ProjectOp>>> = OnceLock::new();
+
+fn holders() -> &'static Mutex<HashMap<String, ProjectOp>> {
+    HOLDERS.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+/// A claim on one project, released on drop.
+///
+/// RAII rather than an explicit release for the reason [`ProjectOp::Migration`]'s
+/// predecessor already learned: a plain release statement is skipped by an
+/// early `?`, by a panic, and by the future simply being dropped. A guard is
+/// not.
+#[derive(Debug)]
+pub struct ProjectGuard {
+    project_id: String,
+}
+
+impl Drop for ProjectGuard {
+    fn drop(&mut self) {
+        // `into_inner` on a poisoned lock: a panic while some other thread held
+        // this map for the duration of one insert cannot have left it
+        // inconsistent, and refusing to release afterwards would strand the
+        // project as permanently busy.
+        holders()
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .remove(&self.project_id);
+    }
+}
+
+/// Claim a project for `op`, or say who has it.
+///
+/// The error is user-facing copy, not a debug string — it goes straight back
+/// over IPC to a toast.
+pub fn try_acquire(project_id: &str, op: ProjectOp) -> Result<ProjectGuard, String> {
+    let mut map = holders().lock().unwrap_or_else(|e| e.into_inner());
+    if let Some(holder) = map.get(project_id).copied() {
+        return Err(format!(
+            "{}. Wait for it to finish before {}.",
+            holder.describe(),
+            op.blocked_action()
+        ));
+    }
+    map.insert(project_id.to_string(), op);
+    Ok(ProjectGuard {
+        project_id: project_id.to_string(),
+    })
+}
+
+/// Which operation holds this project, if any.
+pub fn held(project_id: &str) -> Option<ProjectOp> {
+    holders()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(project_id)
+        .copied()
+}
+
+/// Whether this project is held by exactly `op`.
+///
+/// `migration_commands::is_migrating` is this, specialised — which is the whole
+/// point of folding `ACTIVE_MIGRATIONS` into this registry: there is now one
+/// answer to "is something happening to this project", not two that can
+/// disagree.
+pub fn is_held_by(project_id: &str, op: ProjectOp) -> bool {
+    held(project_id) == Some(op)
+}
+
+/// Whether any project **other than** `exclude_project_id` is currently held by
+/// `op`. Pass an empty id to ask about every project.
+///
+/// Used by the daemon-wide reapers, which cannot tell which project a
+/// `triple-c-compact-*` container belongs to — the name carries a random uuid,
+/// not a project id — so "is this process compacting anything right now" is the
+/// only in-process question they can ask before force-removing one. The
+/// exclusion is for the reaper that runs *inside* a compaction, which is
+/// already holding a claim of its own and would otherwise see it and skip.
+pub fn any_held_excluding(op: ProjectOp, exclude_project_id: &str) -> bool {
+    holders()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .iter()
+        .any(|(project_id, held)| *held == op && project_id != exclude_project_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Ids are namespaced per test: the registry is process-global, and
+    /// `cargo test` runs these on several threads at once.
+    fn id(name: &str) -> String {
+        format!("project-lock-test-{}", name)
+    }
+
+    #[test]
+    fn a_second_acquire_on_the_same_project_is_refused() {
+        let p = id("second-acquire");
+        let first = try_acquire(&p, ProjectOp::Compaction).expect("first claim");
+        let second = try_acquire(&p, ProjectOp::Recreate);
+        let err = second.expect_err("a second claim must be refused, not queued");
+        // The refusal has to name the holder — "busy" alone leaves the user
+        // with nothing to wait for.
+        assert!(err.contains("snapshot is being compacted"), "{}", err);
+        assert!(err.contains("starting or recreating"), "{}", err);
+        drop(first);
+        // And it has to be retakeable the moment the holder goes away.
+        try_acquire(&p, ProjectOp::Recreate).expect("released on drop");
+    }
+
+    #[test]
+    fn the_guard_releases_on_an_early_return() {
+        let p = id("early-return");
+        fn bails(project_id: &str) -> Result<(), String> {
+            let _guard = try_acquire(project_id, ProjectOp::Reset)?;
+            Err("something failed".to_string())
+        }
+        assert!(bails(&p).is_err());
+        assert_eq!(held(&p), None, "an early `?` must not strand the claim");
+    }
+
+    #[test]
+    fn the_guard_releases_on_a_panic() {
+        let p = id("panic");
+        let result = std::panic::catch_unwind(|| {
+            let _guard = try_acquire(&id("panic"), ProjectOp::Migration).unwrap();
+            panic!("boom");
+        });
+        assert!(result.is_err());
+        assert_eq!(held(&p), None, "a panic must not strand the claim either");
+    }
+
+    #[test]
+    fn two_projects_do_not_block_each_other() {
+        let a = id("independent-a");
+        let b = id("independent-b");
+        let _one = try_acquire(&a, ProjectOp::Compaction).expect("a");
+        let _two = try_acquire(&b, ProjectOp::Compaction).expect("b");
+        assert!(is_held_by(&a, ProjectOp::Compaction));
+        assert!(is_held_by(&b, ProjectOp::Compaction));
+    }
+
+    #[test]
+    fn is_held_by_distinguishes_the_operation() {
+        let p = id("which-op");
+        let _guard = try_acquire(&p, ProjectOp::Compaction).unwrap();
+        assert!(is_held_by(&p, ProjectOp::Compaction));
+        assert!(
+            !is_held_by(&p, ProjectOp::Migration),
+            "a compaction is not a migration — `is_migrating` is built on this"
+        );
+    }
+
+    #[test]
+    fn any_held_sees_across_projects() {
+        let p = id("any-held");
+        assert!(!any_held_excluding(ProjectOp::Destroy, ""));
+        let _guard = try_acquire(&p, ProjectOp::Destroy).unwrap();
+        assert!(any_held_excluding(ProjectOp::Destroy, ""));
+        // …and a holder can ask the question without its own claim answering
+        // it, which is what lets a compaction sweep leftovers before it starts.
+        assert!(!any_held_excluding(ProjectOp::Destroy, &p));
+    }
+
+    /// Concurrency, not just sequencing: N threads racing for one project must
+    /// produce exactly one winner.
+    #[test]
+    fn exactly_one_of_many_racing_threads_wins() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        use std::sync::Arc;
+
+        let p = id("race");
+        let start = Arc::new(std::sync::Barrier::new(8));
+        // The second barrier is what makes this deterministic rather than
+        // merely likely: no winner releases until every thread has had its
+        // turn, so "only one got in" cannot be an artefact of a loser arriving
+        // after the winner already left.
+        let attempted = Arc::new(std::sync::Barrier::new(8));
+        let won = Arc::new(AtomicUsize::new(0));
+        let mut handles = Vec::new();
+        for _ in 0..8 {
+            let start = Arc::clone(&start);
+            let attempted = Arc::clone(&attempted);
+            let won = Arc::clone(&won);
+            let p = p.clone();
+            handles.push(std::thread::spawn(move || {
+                start.wait();
+                let claim = try_acquire(&p, ProjectOp::Compaction);
+                if claim.is_ok() {
+                    won.fetch_add(1, Ordering::SeqCst);
+                }
+                attempted.wait();
+                drop(claim);
+            }));
+        }
+        for handle in handles {
+            handle.join().unwrap();
+        }
+        assert_eq!(
+            won.load(Ordering::SeqCst),
+            1,
+            "eight threads raced for one project and more than one got in"
+        );
+        assert_eq!(held(&p), None);
+    }
+}
diff --git a/app/src-tauri/src/storage/migration_store.rs b/app/src-tauri/src/storage/migration_store.rs
index 859d916..7a7e03d 100644
--- a/app/src-tauri/src/storage/migration_store.rs
+++ b/app/src-tauri/src/storage/migration_store.rs
@@ -50,15 +50,28 @@ fn sanitize(project_id: &str) -> String {
 /// flight; an unparseable file is treated the same way (and logged) rather than
 /// blocking every future migration on a corrupt record.
 ///
-/// **A corrupt record is moved aside, not merely ignored.** Reporting "absent"
-/// while leaving the file in place strands the rollback pin it describes: the
-/// `:pre-migration-*` tag holding a 4–12 GB image stays on disk, no code path
-/// can find it again (every one of them starts here and is told there is no
-/// migration), and the leftover file goes on making the project look like it
-/// has a migration in flight to anything that checks for the file rather than
-/// parsing it — including [`has_record`], which the pin reaper relies on.
-/// Renaming to `.bak` follows the same convention as `projects.json`: the
-/// user's bytes are kept, but they stop pinning gigabytes.
+/// **A corrupt record is copied aside and left in place.** An earlier version
+/// *renamed* it to `.bak`, on the reasoning that a file nothing can parse
+/// should stop making the project look busy. That destroyed the one signal
+/// [`has_record`] exists to carry. The chain, in order:
+///
+/// 1. The rename makes the file vanish, so `has_record` — pure filesystem
+///    presence — flips to false.
+/// 2. `reconcile_migration` calls this, gets `Ok(None)`, and returns. An
+///    in-flight or interrupted migration becomes invisible: no resume offer, no
+///    rollback offer, and the phase is never normalised.
+/// 3. Both pin reapers use `has_record` as their conservative guard, so the
+///    project's `:pre-migration-*` tag — the only copy of its pre-migration
+///    system layer — is now "ownerless" to both of them, and the startup sweep
+///    turns the untag into a deletion.
+///
+/// A record that cannot be parsed is exactly the case where the *most*
+/// conservative answer is wanted, not the least. So the bytes are copied to a
+/// **uniquely named** backup (a fixed `.bak` meant a second corruption silently
+/// overwrote the first, and nothing ever read either back) and the original
+/// stays where it is. The pin it describes then ages out through the ownerless
+/// tombstone in `docker::migration::reap_stale_migration_pins` rather than
+/// being reaped on the next app start.
 pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
     let path = state_path(project_id)?;
     if !path.exists() {
@@ -69,15 +82,22 @@ pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
     match serde_json::from_str::<MigrationState>(&data) {
         Ok(state) => Ok(Some(state)),
         Err(e) => {
-            let backup = path.with_extension("json.bak");
-            let moved = fs::rename(&path, &backup);
+            let backup = corrupt_backup_path(&path, &chrono::Utc::now());
+            let copied = if backup.exists() {
+                // Already kept a copy of this exact corruption this second;
+                // nothing to add.
+                Ok(())
+            } else {
+                fs::copy(&path, &backup).map(|_| ())
+            };
             log::error!(
-                "Failed to parse migration state for project {}: {} — treating as absent{}",
+                "Failed to parse migration state for project {}: {} — treating as absent, but \
+                 the record is left in place so `has_record` still protects its rollback pin{}",
                 project_id,
                 e,
-                match moved {
-                    Ok(()) => format!(" and moved the record to {}", backup.display()),
-                    Err(ref e) => format!(" (could not move the record aside: {})", e),
+                match copied {
+                    Ok(()) => format!(" (a copy was kept at {})", backup.display()),
+                    Err(ref e) => format!(" (could not keep a copy: {})", e),
                 }
             );
             Ok(None)
@@ -85,6 +105,15 @@ pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
     }
 }
 
+/// Where a copy of an unparseable record is kept.
+///
+/// Timestamped rather than a fixed `.bak`: a second corruption used to
+/// overwrite the first, so the one case where the user's bytes matter most was
+/// the case where they were most likely to be gone.
+fn corrupt_backup_path(path: &std::path::Path, now: &chrono::DateTime<chrono::Utc>) -> PathBuf {
+    path.with_extension(format!("json.corrupt-{}.bak", now.format("%Y%m%d-%H%M%S")))
+}
+
 /// Whether a project has a migration record on disk *at all*, without parsing
 /// it.
 ///
@@ -97,17 +126,195 @@ pub fn has_record(project_id: &str) -> Result<bool, String> {
     Ok(state_path(project_id)?.exists())
 }
 
-/// Atomically write a project's migration state.
+/// Atomically **and durably** write a project's migration state.
+///
+/// Write-temp-then-rename alone is only half of it, and the missing half is the
+/// half this record exists for. `fs::write` returns once the bytes are in the
+/// page cache; a rename over them is atomic *with respect to other readers*,
+/// not with respect to power loss. Losing power in that window leaves the
+/// rename applied and the data not yet written — i.e. a 0-byte or truncated
+/// `{id}.json` — which is precisely the corrupt-record case above, produced by
+/// the code whose job is to make that case impossible.
+///
+/// So: fsync the file before the rename, and fsync the *directory* after it,
+/// because the rename itself is directory metadata and is not durable until the
+/// directory is synced. A sync that fails is reported rather than swallowed —
+/// this is the crash record, and "probably written" is not a state it may be
+/// in.
 pub fn save(project_id: &str, state: &MigrationState) -> Result<(), String> {
     let path = state_path(project_id)?;
     let data = serde_json::to_string_pretty(state)
         .map_err(|e| format!("Failed to serialize migration state: {}", e))?;
     let tmp = path.with_extension("json.tmp");
-    fs::write(&tmp, data).map_err(|e| format!("Failed to write migration state: {}", e))?;
+
+    {
+        use std::io::Write;
+        let mut file = fs::File::create(&tmp)
+            .map_err(|e| format!("Failed to write migration state: {}", e))?;
+        file.write_all(data.as_bytes())
+            .map_err(|e| format!("Failed to write migration state: {}", e))?;
+        file.sync_all()
+            .map_err(|e| format!("Failed to flush migration state to disk: {}", e))?;
+    }
+
     fs::rename(&tmp, &path).map_err(|e| format!("Failed to commit migration state: {}", e))?;
+    sync_dir(&path);
+    // A project with a record is not ownerless, whatever a reaper concluded
+    // before this write — so the grace clock is thrown away rather than left to
+    // expire against a pin that now has an owner again.
+    clear_ownerless_for_project(project_id);
     Ok(())
 }
 
+/// fsync the directory holding `path`, so a rename into it survives power loss.
+///
+/// Best effort *only* on the platforms where it is meaningless: Windows has no
+/// directory handle to sync and returns an error for the attempt, so a failure
+/// is logged rather than propagated. The file's own `sync_all` above is the
+/// part that carries the data, and it is not best effort.
+fn sync_dir(path: &std::path::Path) {
+    let Some(dir) = path.parent() else {
+        return;
+    };
+    match fs::File::open(dir).and_then(|d| d.sync_all()) {
+        Ok(()) => {}
+        Err(e) => log::debug!(
+            "Could not fsync the migrations directory {}: {} — the record itself was flushed",
+            dir.display(),
+            e
+        ),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Ownerless-pin tombstones
+// ---------------------------------------------------------------------------
+
+/// Marker recording **when a rollback pin was first seen with no record behind
+/// it**.
+///
+/// ## Why the grace period cannot be measured from the tag
+///
+/// `docker::migration::pin_is_reapable` used to date a pin from the timestamp
+/// encoded in `pre-migration-<YYYYmmdd-HHMMSS>` — i.e. from when the migration
+/// *started*. That is the wrong epoch by a whole feature. A migration is
+/// allowed to sit at `awaiting-confirmation` indefinitely; `keep_rollback`
+/// exists precisely so a user can run on the new base for a month before
+/// deciding. If that project's record is then lost — a corrupt file, a deleted
+/// state file, a half-restored data directory — the pin is fourteen days old on
+/// the very first check, so it is untagged on the next app start and the
+/// startup sweep deletes the image two lines later. The fourteen-day grace
+/// period the constant promises is zero in the only situation it was written
+/// for.
+///
+/// The clock has to start when the *claim* was lost, and nothing on the daemon
+/// records that moment. So it is written down here, the first time a reaper
+/// notices, and the age is measured from the marker.
+///
+/// One file per `(project_id, tag)` in the migrations directory, holding an
+/// RFC3339 instant. Tiny, and losing one costs a fresh fourteen days rather
+/// than a deletion — the failure direction that keeps somebody's only rollback
+/// copy.
+fn ownerless_marker_path(project_id: &str, tag: &str) -> Result<PathBuf, String> {
+    Ok(migrations_dir()?.join(format!(
+        "{}.{}.ownerless",
+        sanitize(project_id),
+        sanitize(tag)
+    )))
+}
+
+/// When this pin was first observed ownerless, **without recording anything**.
+///
+/// For the survey paths, which describe the world and must not change it.
+/// `None` means "no reaper has seen it yet", which is not the same as "seen
+/// just now" and must not be treated as a start date.
+pub fn peek_ownerless_since(
+    project_id: &str,
+    tag: &str,
+) -> Option<chrono::DateTime<chrono::Utc>> {
+    let path = ownerless_marker_path(project_id, tag).ok()?;
+    let raw = fs::read_to_string(path).ok()?;
+    chrono::DateTime::parse_from_rfc3339(raw.trim())
+        .ok()
+        .map(|t| t.with_timezone(&chrono::Utc))
+}
+
+/// Read the first-observed instant for a pin, creating the marker if this is
+/// the first sighting. Returns `None` when the clock has not started yet.
+///
+/// **Clock skew is handled here rather than at the comparison.** A host clock
+/// that was running fast when the marker was written leaves a timestamp in the
+/// future; measured naively that is a negative age, which a `num_days() >= 14`
+/// test reads as "never reapable" — a pin that can never be collected, forever.
+/// A marker dated after `now` is therefore rewritten to `now`, restarting the
+/// grace period. The other direction — a clock jumping forward — cannot shorten
+/// the period below what has actually elapsed on the *marker's* terms, because
+/// there is nothing to compare against but wall time; what it cannot do any
+/// more is make every pin instantly reapable, which dating from the tag did.
+pub fn note_ownerless_since(
+    project_id: &str,
+    tag: &str,
+    now: &chrono::DateTime<chrono::Utc>,
+) -> Option<chrono::DateTime<chrono::Utc>> {
+    let path = ownerless_marker_path(project_id, tag).ok()?;
+    let existing = fs::read_to_string(&path).ok().and_then(|raw| {
+        chrono::DateTime::parse_from_rfc3339(raw.trim())
+            .ok()
+            .map(|t| t.with_timezone(&chrono::Utc))
+    });
+    match existing {
+        Some(seen) if seen <= *now => Some(seen),
+        // Absent, unparseable, or dated in the future: (re)start the clock.
+        _ => {
+            if let Err(e) = fs::write(&path, now.to_rfc3339()) {
+                log::warn!(
+                    "Could not record that rollback pin {}:{} is ownerless: {} — its grace \
+                     period restarts on the next check",
+                    project_id,
+                    tag,
+                    e
+                );
+            }
+            None
+        }
+    }
+}
+
+/// Forget a pin's ownerless marker. Missing is success.
+///
+/// Called when the pin is untagged, and when a record reappears for the
+/// project — a re-migrated project must not inherit the previous run's clock.
+pub fn clear_ownerless(project_id: &str, tag: &str) {
+    let Ok(path) = ownerless_marker_path(project_id, tag) else {
+        return;
+    };
+    match fs::remove_file(&path) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => log::warn!("Could not remove {}: {}", path.display(), e),
+    }
+}
+
+/// Drop every ownerless marker belonging to one project.
+///
+/// A project that has a record again is by definition not ownerless, whatever
+/// a reaper concluded before.
+pub fn clear_ownerless_for_project(project_id: &str) {
+    let Ok(dir) = migrations_dir() else {
+        return;
+    };
+    let prefix = format!("{}.", sanitize(project_id));
+    let Ok(entries) = fs::read_dir(&dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name().to_string_lossy().to_string();
+        if name.starts_with(&prefix) && name.ends_with(".ownerless") {
+            let _ = fs::remove_file(entry.path());
+        }
+    }
+}
+
 /// Remove a project's migration state file. Missing is success.
 pub fn clear(project_id: &str) -> Result<(), String> {
     let path = state_path(project_id)?;