# STATUS — Phase 2pc (sane image-prune policy)

**SSOT:** `/srv/cc-ci/cc-ci-plan/plan-phase2pc-image-cache.md`
**Scope (operator correction 2026-05-29):** PC1 conservative prune + PC2/PC3 confirm-and-verify
local-store retention/auth. **Registry pull-through cache DROPPED** (deferred to IDEAS / Phase 2b).

## Phase: PC1 implemented, deploy+verify in flight (NOT yet claimed)

In flight: build the new prune module onto cc-ci via `nixos-rebuild switch`, then run the
deploy→teardown→redeploy layer-reuse proof. Gate will be CLAIMED once verified on the real host.

## What changed (the diff)

- `nix/modules/swarm.nix` — removed `virtualisation.docker.autoPrune` (it ran
  `docker system prune --force --all --filter until=24h` daily; `--all` evicts every image not used
  by a *running* container → wiped cached recipe base images → cold re-pull → Hub rate-limit churn).
- `nix/modules/docker-prune.nix` (NEW) — daily `systemd.timer` + oneshot `systemd.service`
  `docker-prune` running a surgical, triple-gated prune. Imported in `nix/hosts/cc-ci/configuration.nix`.
- Teardown (`runner/harness/lifecycle.py::teardown_app`) UNCHANGED — already removes only
  services/volumes/secrets/.env, never images (PC1 teardown requirement already held).

(Verification context — WHAT/HOW/EXPECTED/WHERE — will be filled in here at gate-claim time.)