Function prune_sealed_atif_blocking 

pub fn prune_sealed_atif_blocking(
    spool_dir: &Path,
    max_age: Duration,
) -> Result<usize>

Blocking core of the sealed-ATIF retention sweep. Removes sealed ATIF trajectories (and their .atif-auth provenance sidecars and digest-bound .close-complete markers) whose mtime is older than max_age. Idempotent; a missing file (already pruned) is silently skipped. Returns the number of (atif, sidecar) pairs removed so callers can log or bump a metric.

Callable without a running harness: avctl spool-prune drives it directly against atif_spool_dir, and the hourly in-process retention task wraps it via Finalizer::prune_sealed_atif.

Live sessions are protected by two properties:

• an in-flight session’s per-session lifecycle lock is held across close, and prune touches only files whose mtime satisfies age > max_age — a session that just closed still has fresh mtimes and is far outside the retention window;
• unpaired .json (no .atif-auth) files are LEFT ALONE — those are either the crash-torn transient state of an in-progress close or attacker-planted trajectories the reconciler’s own quarantine sweep handles. Retention is only for sealed evidence pairs; unsealed remnants stay for the reconciler.

Without retention the spool is append-only forever, and a restart re-adopts every closed session it finds there.