A journald retention policy frees local logs while remote-forward queue spillover still fills the spool filesystem during collector outages during a failover rehearsal

Log retention seems tuned and the buffering path for remote resilience is where storage actually disappears. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.