1c: W3 recon (incus/b1 RAM facts) while parked at Gate W2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL-1c.md

@@ -108,3 +108,19 @@ byte-identical there. cc-ci stays on its proven host-key decrypt path for now.
 
 **Next:** Gate W2 CLAIMED → await Adversary PASS on byte-identical + cert-in-git/TLS. Meanwhile prep W1
 (resize) / W3 (throwaway VM) — read the incus skill.
+
+## 2026-05-27 — W3 recon (read-only; while parked at Gate W2)
+
+Incus skill read. b1 = 100.117.251.31:8443, project terraform-ci, mTLS certs at
+/srv/incus-terraform-nix-vm-creator/terraform-secrets/{terraform.crt,terraform.key}. **b1 reachable
+via the EXISTING cc-ci proxy** (`curl --proxy socks5h://127.0.0.1:1055 --cert/--key -k …`) — no
+separate tailscaled needed (skill's own 1055 proxy would collide; reuse cc-ci's).
+
+terraform-ci instances + RAM:
+- cc-nix-test  Running  6GB  VM   ← this IS the live cc-ci; W1 resizes 6→4 (stop→set→start, hotplug times out)
+- lichen-staging Running 4GB container (leave alone)
+- kube-base / kube-base-test  Stopped 4GB VMs
+- release-runner Stopped 8GB VM
+Running total now = 10GB. After W1 + throwaway(4GB): 4+4+4 = 12GB ≤ 16 physical (phase-plan ~12GB
+doc-only guideline; terraform-ci has no enforced limits.memory). VM create = `projects/incus-base`
+Terraform template (NixOS base image, cloud-init+tailscale+nix flakes), set instance_name + limits.memory=4GB.