feat(governance): unify durable event retention

docs/rules/05-architecture.md

@@ -453,6 +453,11 @@ Durable post-commit side effects have a separate boundary:
 - The dispatcher claims an intent with a lease, executes the topic handler, and
   records retry/dead-letter state. Handlers must be idempotent and must not rely
   on a live request object.
+- Terminal history is part of the shared data-maintenance policy and is cleaned
+  in bounded daily batches only when that policy is enabled. Completed intents
+  default to 30-day retention and dead letters to 90 days; both values are
+  user-configurable and `0` disables that status cleanup. Pending or processing
+  intents must never be removed by retention cleanup.
 - `app/runtime/tasks.py` is only the in-process TaskRegistry boundary. It owns
   cancellation and bounded shutdown waiting, but it is not a durable queue and
   must not replace an Outbox or persistent task table.

docs/rules/10-data-and-persistent.md

@@ -140,10 +140,31 @@ startup composition supplies the repository, transaction scope and topic
 handlers.
 
 The dispatcher claims an intent with a lease, executes an idempotent handler,
-and records bounded retries or dead-letter state. The `app/runtime/tasks.py`
+and records bounded retries or dead-letter state. The shared data-maintenance
+policy controls bounded terminal-history cleanup, with user-configurable 30-day
+completed and 90-day dead-letter defaults; `0` disables either cleanup. It must
+not delete pending or leased processing rows. The `app/runtime/tasks.py`
 TaskRegistry is only the owner for in-process work and bounded shutdown waiting;
 it is not a durable queue or a replacement for an Outbox/persistent task table.
 
+All append-only or snapshot history owned by the host must participate in the
+shared `DATA_CLEANUP_ENABLE` policy when it has a safe time boundary:
+
+- `message`, `downloadhistory` and orphaned `downloadfiles`, `siteuserdata`,
+  `transferhistory`, `downloadfailure`, and `subscribehistory` use their own
+  user-configurable retention periods.
+- `agentchat` removes only expired sessions not referenced by an `agenttask`;
+  `agenttaskrun` removes only expired terminal runs that are neither running nor
+  the task's current `last_run_id`.
+- `outboxmessage` has separate completed and dead-letter retention periods;
+  pending and processing intents are recovery state and are never age-deleted.
+
+`transferpending` and `plugininstallation` are recovery queues/journals rather
+than history. Their age is not proof that they are disposable, so generic
+retention cleanup must not delete them. Current-state tables keyed by a user,
+site, plugin, workflow, passkey, or media-library item are likewise outside
+time-based cleanup; their owning mutation lifecycle must replace or delete them.
+
 Run `./.venv/bin/python scripts/architecture/baseline.py --check-host` after
 persistence changes. A deliberate debt reduction may refresh the low-water mark
 with `--write-host`; never refresh it to accept newly introduced debt.