status(2pc): add probe-5 evidence — surgical prune reclaimed 2.34GB (dangling+old only), all tagged images kept, disk bounded without -af

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/JOURNAL-2pc.md

@@ -84,3 +84,15 @@ finished (22.5s CPU), `systemctl is-system-running` → `running`.
 **Docs/decisions.** `docs/runbook.md` (new "Image cache & prune policy" + updated rate-limit note),
 `docs/warm.md` (autoPrune→ci-docker-prune), `DECISIONS.md` (Phase-2pc entry), `cc-ci-plan/IDEAS.md`
 (deferred registry cache + revisit trigger). Gate claimed.
+
+## 2026-05-29 — Probe-5 evidence: surgical prune reclaims, keeps tagged/recent
+
+Ran the exact active-path command the gated unit uses (`docker image prune -f --filter until=24h`
++ container/builder variants) on the host to demonstrate surgical reclaim (the daily timer only
+reaches this under ≥80% disk, but the command's effect is the same):
+- all images 23→17, dangling 10→**4** (the 4 remaining are <24h old — the `until=24h` age gate kept
+  them), **2.341 GB reclaimed**, disk 31%→27% (19G→17G used).
+- ALL tagged/in-use images survived (keycloak:26.6.2, mariadb:12.2, nginx:1.30.0, redis:8.6.3, …) —
+  no `--all`, so nothing tagged or container-referenced was touched.
+Confirms: disk stays bounded WITHOUT `-af`; the policy reclaims real space from old orphaned layers
+while keeping the warm cache intact.