docs(agent): file #128 — auto-prune NixOS gens (30d, keep ≥3 past)

Policy: remove system generations older than 30 days only when they are
also beyond the three most recent past gens, so rare rebuilds never lose
rollback depth. Notes existing 14d nix.gc has no count floor.

agent/BACKLOG.md

@@ -78,6 +78,41 @@ cable leaves. Capture steps in HARDWARE-QUEUE.
 
 ## NEXT
 
+### 128. Auto-prune NixOS generations: >30 days, but keep ≥3 past
+
+Bernardo 2026-07-15: automatic cleanup of **NixOS** (system) generations
+so the boot menu and store do not grow without bound, with a safety floor:
+
+1. **Age:** candidates older than **30 days** may be removed.
+2. **Count floor:** always keep the **current** generation and at least
+   **3 past** generations — even if those three are older than 30 days.
+3. Combined: delete only gens that are **both** older than 30 days **and**
+   older than the third-most-recent past generation. Gens within 30 days
+   stay regardless of how many there are (until they age out).
+
+**Why this shape:** pure age GC (`--delete-older-than`) can wipe a machine
+that is rarely rebuilt down to one generation and remove useful rollback
+targets; pure count limits (`configurationLimit`) drop recent work just
+because the user iterates a lot. Age + floor keeps travel-laptop machines
+safe and busy desktops tidy.
+
+**Today:** `nix.gc` is already weekly with `--delete-older-than 14d`
+(`modules/nixos/default.nix`) — store GC, no min-generation floor, and
+14d not 30d. This item should replace/refine that policy (or add a
+dedicated generation pruner if stock GC cannot express the floor).
+
+**Scope (settle if needed):** system profile only vs also Home Manager
+user generations (desktop rollback in Recovery). Bootloader list
+(`boot.loader.systemd-boot.configurationLimit`) may need to stay in
+sync so removed profiles do not leave dead boot entries.
+
+Pass = weekly (or post-rebuild) cleanup enforces 30d + keep ≥3 past on
+system generations; a machine with only old gens never goes below
+current+3; docs/RECOVERY still matches the boot-menu story; doctor or a
+check asserts the timer/unit exists and the prune script's dry-run
+logic. V3: run on a box with many gens and confirm boot menu +
+`nix-env -p /nix/var/nix/profiles/system --list-generations`.
+
 ### 120. A netinstall ISO, next to the fat offline one
 
 Bernardo 2026-07-14, after seeing the measured size: **keep the current ISO

agent/JOURNAL.md

@@ -19,6 +19,15 @@ Template:
 
 ---
 
+## 2026-07-15 — File #128 generation auto-prune policy (no code)
+- **Task:** Bernardo: auto-clean NixOS gens older than 30 days but always
+  keep ≥3 past generations.
+- **Did:** NEXT **#128**. Policy restated; noted existing `nix.gc` weekly
+  `--delete-older-than 14d` has no min-generation floor.
+- **Verified:** V0 (docs/agent only).
+- **Pending:** implement when picked; optional HM gens scope.
+- **Next suggestion:** implement #128, or human #115/#120.
+
 ## 2026-07-15 — #111 Recovery + #105 System IA + #110 retire Control Center
 - **Task:** Scope-first Recovery, System submenu IA, retire Control Center.
 - **Did:** System → Connectivity / Devices / Recovery / Preferences. Recovery: