It turns out that the culprit was apt, particularly the apt cache and apt lists
sudo apt-get clean rm /var/lib/apt/lists/*
Now there's room for an upgrade image. I didn't think that apt would write to the /root.dev/w/ overlay, I just assumed /var only existed as tmpfs but I guess I was wrong.
Now my possibly stupid question is, is it safe to rm -rf /root.dev/w/ the whole overlay. Will it still boot an regenerate the necessary files? Presumably as factory defaults?