diff --git a/src/main.py b/src/main.py
index ecdd43e..70c34cb 100644
--- a/src/main.py
+++ b/src/main.py
@@ -5,6 +5,7 @@ import logging
 import os
 import signal
 import sys
+from logging.handlers import RotatingFileHandler
 from pathlib import Path
 
 # Ensure project root is on sys.path so `src.*` imports work
@@ -39,26 +40,36 @@ def _stop_steering_registry(logger: logging.Logger) -> None:
 def setup_logging():
     LOG_DIR.mkdir(parents=True, exist_ok=True)
     fmt = "%(asctime)s [%(levelname)s] %(name)s: %(message)s"
+    # ponytail: RotatingFileHandler caps echo-core.log at 50MB x5 backups —
+    # stdlib, no logrotate/cron dependency. Raise maxBytes if 50MB rotates
+    # too often once volume is observed post-fix.
+    root_file_handler = RotatingFileHandler(
+        LOG_DIR / "echo-core.log", maxBytes=50 * 1024 * 1024, backupCount=5,
+    )
     logging.basicConfig(
         level=logging.INFO,
         format=fmt,
         handlers=[
-            logging.FileHandler(LOG_DIR / "echo-core.log"),
+            root_file_handler,
             logging.StreamHandler(sys.stderr),
         ],
     )
 
-    # Security log — separate file for unauthorized access attempts
+    # Security log — separate file for unauthorized access attempts.
+    # propagate=False: without it, every security event was ALSO written to
+    # echo-core.log via the root handler (double write) — one of the two
+    # causes of the 1.2GB log file found 2026-09-02.
     security_handler = logging.FileHandler(LOG_DIR / "security.log")
     security_handler.setFormatter(logging.Formatter(fmt))
     security_logger = logging.getLogger("echo-core.security")
     security_logger.addHandler(security_handler)
+    security_logger.propagate = False
 
-    # Invocation log — all Claude CLI calls
-    invoke_handler = logging.FileHandler(LOG_DIR / "echo-core.log")
-    invoke_handler.setFormatter(logging.Formatter(fmt))
-    invoke_logger = logging.getLogger("echo-core.invoke")
-    invoke_logger.addHandler(invoke_handler)
+    # Invocation log — all Claude CLI calls. Had its OWN FileHandler on
+    # echo-core.log *plus* propagation to the root handler on the same
+    # file — every invoke line was written twice, the main driver of the
+    # 1.2GB log file found 2026-09-02. No separate handler needed: default
+    # propagation already routes it through root_file_handler above.
 
 
 def main():