deploy/systemd/README.md

@@ -10,6 +10,7 @@ Systemd **user** units for clawstor.
 | `clawstor-fuse.service` | Phase 6 read-only FUSE mount at `~/clawstor-mount/`. Depends on `clawstor-cluster.service`. |
 | `clawstor-scrub.service` + `clawstor-scrub.timer` | Weekly (Sun 04:00) BLAKE3 verify every chunk against its manifest. Non-zero exit = integrity failure — surfaced by systemd status. |
 | `clawstor-gc.service` + `clawstor-gc.timer` | Nightly (03:30) orphan-chunk sweep. Override ExecStart via drop-in to add `--evict-to-gb N` for size-cap fleets. Sequenced before the Sunday scrub so scrub reads a fresh layout. |
+| `clawstor-ref-sweep.service` + `clawstor-ref-sweep.timer` | Nightly (03:15) Gitea live-refs poll + stale-fingerprint report. Set `GITEA_TOKEN` via a drop-in for private repos. Report-only (dry-run) — deletion is a follow-on. |
 
 ## Install `clawstor-fuse.service`
 

deploy/systemd/clawstor-ref-sweep.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Clawstor nightly ref sweep (Gitea live-refs → stale-fingerprint report)
+Documentation=https://git.redclaw.dev/clawverse/clawstor
+After=clawstor-cluster.service network-online.target
+
+[Service]
+Type=oneshot
+# Retarget with a drop-in when the Gitea URL or token differs.
+# Default 14-day retention window; use --retention-days N to override.
+Environment=CLAWSTOR_GITEA_URL=https://git.redclaw.dev
+# Set the Gitea token via ~/.config/systemd/user/clawstor-ref-sweep.service.d/token.conf:
+#   [Service]
+#   Environment=GITEA_TOKEN=xxx
+# or via `systemctl --user set-environment` before enabling.
+ExecStart=%h/clawstor-deploy/claw-store --config %h/clawstor-deploy/config.toml cluster-ref-sweep --gitea-url ${CLAWSTOR_GITEA_URL} --retention-days 14
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target

deploy/systemd/clawstor-ref-sweep.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=Nightly Clawstor ref-tracking sweep
+Documentation=https://git.redclaw.dev/clawverse/clawstor
+
+[Timer]
+# 03:15 local — ahead of GC 03:30 so operators see the stale set
+# before eviction lands. Both jobs are read-mostly; ordering is a
+# UX-not-safety consideration.
+OnCalendar=*-*-* 03:15:00
+Persistent=true
+Unit=clawstor-ref-sweep.service
+
+[Install]
+WantedBy=timers.target