claim(2w): WC8 + WC9 (FINAL gates) — resource-safety consolidation + stale-warm prune + docs/warm.md + --quick rollback proof

WC8: canonical.prune_stale (drop de-enrolled warm data + volumes) wired into the
nightly sweep + df log; consolidated evidence (DRONE_RUNNER_CAPACITY=MAX_TESTS
serialize; autoPrune drops --volumes so warm vols survive; cold teardown sacred;
warm excluded from D8 — no nix source ref). +1 unit (72 pass). WC9: docs/warm.md
documents the full warm/quick model; --quick rollback proof already proven live
(W2 FAIL restores exact known-good; WC4 PASS byte-identical snapshot). On PASS,
all WC1-WC9 (incl WC1.1/WC1.2) verified → DONE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_canonical.py

@@ -74,3 +74,23 @@ def test_enrolled_recipes_scans_meta(tmp_path, monkeypatch):
         (d / "recipe_meta.py").write_text(body)
     (tmp_path / "tests" / "ddd").mkdir(parents=True)  # no recipe_meta.py at all
     assert canonical.enrolled_recipes() == ["aaa", "ccc"]
+
+
+def test_prune_stale_drops_deenrolled_only(tmp_path, monkeypatch):
+    # prune_stale removes <recipe>/ dirs that have a canonical.json but aren't enrolled; keeps
+    # enrolled canonicals, reconciler dirs (no canonical.json), and alerts/.
+    monkeypatch.setenv("CCCI_WARM_ROOT", str(tmp_path))
+    monkeypatch.setattr(canonical, "enrolled_recipes", lambda: ["keepme"])
+    monkeypatch.setattr(canonical.warmsnap, "stack_volumes", lambda d: [])  # no docker in unit
+    # enrolled canonical (keep), de-enrolled canonical (prune), reconciler dir (keep), alerts (keep)
+    for name in ("keepme", "gone"):
+        (tmp_path / name).mkdir()
+        (tmp_path / name / "canonical.json").write_text('{"recipe":"%s"}' % name)
+    (tmp_path / "keycloak").mkdir(); (tmp_path / "keycloak" / "last_good").write_text("v1")  # reconciler
+    (tmp_path / "alerts").mkdir()
+    pruned = canonical.prune_stale()
+    assert pruned == ["gone"]
+    assert not (tmp_path / "gone").exists()
+    assert (tmp_path / "keepme").exists()
+    assert (tmp_path / "keycloak").exists()   # no canonical.json → not a canonical → kept
+    assert (tmp_path / "alerts").exists()