decisions(canon): record M2.7 warm-volume disk budget — 38G free, all-enrolled sustainable, no recipe dropped

machine-docs/DECISIONS.md

@@ -1550,3 +1550,19 @@ information; never weaken a test to make a recipe promote"). The sweep correctly
   sweep keeps offering to advance it (correct: it should retry in case the recipe is fixed). No
   promoted-at-latest recipe is ever needlessly re-tested. "Skip every recipe" is the all-promoted ideal;
   the demonstrated property is "no promoted-at-latest recipe re-runs", which is the operative no-op.
+
+## Phase canon (2026-06-17) — warm-volume disk budget (§2.B / M2.7)
+
+All-enrolled is sustainable on the single node; the warm-volume budget is NOT the binding constraint,
+so the fallback (decouple version-record from retained volume) is NOT needed. Measured 2026-06-17 (read
+-only, `ssh cc-ci`):
+- Root fs `/`: 150G total, 107G used, **38G free, 74% used**.
+- `du -sh /var/lib/ci-warm` (registry metadata + small content) = **1.1G**; largest per-recipe dir
+  `immich` 307M, `ghost` 208M, `plausible` 114M; most <50M.
+- `docker system df`: Local Volumes 47 total, **2.024GB**, 929MB (45%) reclaimable; ~50 `warm-*` data
+  volumes (16 retained canonicals + warm-keycloak infra + per-run residue the WC8 `ci-docker-prune`
+  reclaims).
+- 16 retained canonicals total ~2G of volumes + 1.1G metadata against 38G free → ample headroom even
+  at the full 20-enrolled set. WC8 disk-hygiene (`ci-docker-prune`) keeps residue bounded.
+Conclusion: keep all-enrolled with retained volumes; revisit only if `/` free drops below a single
+recipe's largest restore (~1–2G working set). No recipe dropped for disk.