When your journal finishes processing a segment, it intentionally consumes the raw file and no longer keeps it on disk. The reconcile predicate read that as missing, so the segment re-uploaded on every pass and its local copy was never released. Treat processed as terminal proof only after the same submitted_name/name match and exact SHA-256 equality that make present honest; a processed entry that does not match the local byte still needs upload and is never deletable. This is additive within protocol v2; OBSERVER_PROTOCOL_VERSION stays 2. The needs-upload gate and cleanup delete gate continue to share _segment_proven_held. Bump to 0.4.5.