Two honesty fixes: one in what the software says, one in what it leaves behind.
The RRD tools stopped calling a rolling window "today"
A reviewer asked an agent for "utilization charts for today" and got the last hour, then the last 24 hours, presented as today. The obvious read is model error. It wasn't.
pve_node_rrddata offers hour|day|week|month|year and described that only as "over the specified timeframe." Proxmox's RRD endpoint accepts no start/end at all. So the model picked a window ending at now and called it today — because nothing in the schema said the windows roll, and nothing said a calendar day was unavailable. The description authored the claim; the model only spoke it.
Every RRD tool now states, in the text a model actually reads, that the window rolls and ends at now, that day means the last ~24 hours and not the calendar day, that no date can be requested, and what to report instead: the real span, from the timestamps. Fixed across the whole class rather than the one reported site — pve_node_rrddata, pmg_node_rrddata, pbs_node_rrd, pbs_datastore_rrd, proximo_baseline — with the disclosure pinned by tests at all five.
Reported by meyergru on the Proxmox forum, whose earlier report shaped 0.26.0's context work.
proximo reap can clean up after dead sessions (opt-in)
Restoring the read-only key was always half the job. Nothing removed a dead session's token and lock files, so a session directory accretes one pair per session forever — a credential store nobody audits. The deployment that surfaced this had 167 files for zero live arms.
Set PROXIMO_REAP_UNLINK_DAYS=N and reap also unlinks session files that are proven read-only, unheld (kernel flock, the same liveness oracle reaping already uses), and idle past N days. The removal happens under the file's own exclusive lock, so it cannot race a session that is just starting. An ex-armed file is restored first, which stamps a fresh mtime, so it only becomes eligible after a further full TTL. Orphan lock files and dangling symlinks sweep on the same terms; any other unreadable file stays put and is reported.
Unset or garbled means no unlinking — deletion is the destructive verb, so a typo must not enable it. That is deliberately the opposite fallback direction from PROXIMO_REAP_GRACE, where a typo must not disable the race guard.
--dry-run runs the same probes and stops short of the unlink itself, so a preview cannot promise what the real run would refuse.
Unchanged
904 tools. No interface changes, no new dependencies. Fleet: 11,469 tests green.