journal(2w): W0.5 proven + WC8 disk reclaim (96%->62%); checkpoint before W0.6

machine-docs/JOURNAL-2w.md

@@ -117,3 +117,23 @@ safety-gated + rollback form (avoids reworking the reconciler twice). Current re
 skip-if-healthy) is INTERIM — keeps keycloak live-warm/healthy meanwhile; will be replaced. Also need
 to settle the **alert mechanism**: a bash systemd reconciler can't call the agent's PushNotification
 tool directly — decision needed (alert sentinel file the Builder loop reads + relays, or a webhook).
+
+## 2026-05-29 — W0.5 WC3 snapshot helper proven; disk reclaim (WC8 hygiene)
+
+W0.5 warmsnap.py landed + LIVE round-trip proven on warm keycloak (see STATUS-2w). Then settled the
+W0.6 reconciler approach (python entrypoint in nix store; deploy-by-tag; recipe-semver = pre-`+`
+component) in DECISIONS.
+
+**Disk reclaim.** After 3 nixos-rebuild switches + 3 keycloak deploy cycles (WC3 proof) + a 159M
+keycloak snapshot, `/` hit 96% (1.2G free) — a WC8 red flag before continuing. Reclaimed safely
+(reversibility is via the git-declared config, not old generations): `rm -rf /root/cc-ci.prev`;
+`nix-collect-garbage -d` (2553 paths, 3.38G); `docker image prune -f` dangling-only (3.32G, KEEPS the
+tagged pull-cache); pruned old abra deploy logs (keep last 5). Result: **62% (10G free)**. This
+GC+dangling-prune is the disk-management mechanism WC8 must formalize (run it in the nightly/W4, and
+keep one last-good snapshot per app bounded). NOTE for WC8: the WC3 keycloak snapshot is 159M; a
+warm-set of ~6 canonicals × (volume + 1 snapshot) is the disk budget to size.
+
+**State at checkpoint:** warm keycloak healthy (200), only infra+warm stacks, system running (0
+failed), disk 62%. W0.1-W0.5 done+proven+pushed (HEAD 67240dc). Next unit: W0.6 reconciler rewrite
+(unpin + WC1.2 safety gate + WC1.1 health-gated rollback), then W0.7/W0.8 (lasuite-docs race +
+headline WC1 e2e).