feat(nixos): prune system+HM gens after 14d, keep ≥3 past (#128)

Weekly nomarchy-gen-prune deletes only generations that are both older
than 14 days and beyond the three most recent past gens (current always
kept), for system and Home Manager profiles. Stock nix.gc no longer uses
--delete-older-than. checks.gen-prune covers selection self-test and
unit wiring; doctor points at the new tool when disk is tight.

agent/BACKLOG.md

@@ -78,44 +78,6 @@ cable leaves. Capture steps in HARDWARE-QUEUE.
 
 ## NEXT
 
-### 128. Auto-prune system + HM generations: >14 days, but keep ≥3 past
-
-Bernardo 2026-07-15 (refined same day): automatic cleanup of **both**
-NixOS (system) and Home Manager (per-user) generations so boot menu,
-desktop rollback, and store do not grow without bound, with a safety floor:
-
-1. **Age:** candidates older than **14 days** may be removed.
-2. **Count floor:** always keep the **current** generation and at least
-   **3 past** generations — even if those three are older than 14 days.
-3. Combined: delete only gens that are **both** older than 14 days **and**
-   older than the third-most-recent past generation. Gens within 14 days
-   stay regardless of how many there are (until they age out).
-4. **Apply the same rule independently** to the system profile and to each
-   user's Home Manager profile (desktop rollback in Recovery › Desktop).
-
-**Why this shape:** pure age GC (`--delete-older-than`) can wipe a machine
-that is rarely rebuilt down to one generation and remove useful rollback
-targets; pure count limits (`configurationLimit`) drop recent work just
-because the user iterates a lot. Age + floor keeps travel-laptop machines
-safe and busy desktops tidy. 14d matches the existing store GC cadence
-rather than a longer 30d hold.
-
-**Today:** `nix.gc` is already weekly with `--delete-older-than 14d`
-(`modules/nixos/default.nix`) — store GC, **no** min-generation floor, and
-it is not framed as an explicit dual system+HM policy. This item should
-replace/refine that (or add a dedicated pruner if stock GC cannot express
-the floor on both profiles). Bootloader list
-(`boot.loader.systemd-boot.configurationLimit`) may need to stay in sync
-so removed system profiles do not leave dead boot entries.
-
-Pass = weekly (or post-rebuild) cleanup enforces 14d + keep ≥3 past on
-**system and HM** generations; a machine with only old gens never goes
-below current+3 on either profile; docs/RECOVERY still matches boot-menu
-and desktop rollback; doctor or a check asserts the timer/unit exists and
-the prune script's dry-run logic. V3: box with many gens — boot menu +
-`nix-env -p /nix/var/nix/profiles/system --list-generations` +
-`home-manager generations` after a prune.
-
 ### 120. A netinstall ISO, next to the fat offline one
 
 Bernardo 2026-07-14, after seeing the measured size: **keep the current ISO

agent/JOURNAL.md

@@ -19,6 +19,17 @@ Template:
 
 ---
 
+## 2026-07-15 — #128 generation prune (14d + keep ≥3 past, system+HM)
+- **Task:** Implement auto-prune for system and Home Manager generations.
+- **Did:** `pkgs/nomarchy-gen-prune` + `modules/nixos/gen-prune.nix` weekly
+  timer; pure select (current + 3 past always; else drop if age>14d); store
+  GC without `--delete-older-than`; bootloader refresh after system prune.
+  Doctor fix + RECOVERY note. Closed #128.
+- **Verified:** V0/V1 — `checks.gen-prune` (self-test + dry-run + timer
+  assert + no age-only gc options). V3: run on a multi-gen box.
+- **Pending:** V3 on real machine with many gens.
+- **Next suggestion:** human #115/#120, or hardware queue.
+
 ## 2026-07-15 — File #128 generation auto-prune policy (no code)
 - **Task:** Bernardo: auto-clean gens older than N days but always keep
   ≥3 past; include HM; prefer 14d over 30d.