Homebrew cleanup leaves old kegs in Cellar after brew upgrade

Disk usage keeps rising after brew upgrade because each formula version occupies its own versioned Cellar directory and the previous keg remains until cleanup runs. The supported removal path is brew cleanup, which deletes old kegs and download caches, yet retains any keg currently linked into the prefix or lying in the dependency closure of another installed keg.

The staleness window is configurable through environment variables such as HOMEBREW_CLEANUP_MAX_AGE_DAYS and HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS, but these thresholds are version-sensitive and must be confirmed locally. A dry run with brew cleanup -n lists candidates under the current policy, though it does not guarantee a later real cleanup will select the same set if the installed set or environment changes.

The unresolved decision is rollback versus reclamation. Homebrew has no supported downgrade command, so removing an old keg means reinstall is the only way back, yet cleanup cannot infer rollback intent. brew pin protects a formula from upgrade and cleanup, but unpinned old kegs receive no such protection; a keg merely downloadable via brew install is still treated as disposable.

What criteria does brew cleanup use to decide an unlinked keg is safe to delete when the formula has no installed dependents? Does the periodic full cleanup window override the max-age threshold in a way that removes kegs sooner than expected? Which inspection commands reliably distinguish a keg protected by dependency closure from one that is simply disposable?