retention piece 1: immediate rotations for chat-history / job-log / followups (b67084660385)

- chat-history.jsonl rotates at 10MB or 7d -> logs/archive/*.jsonl.gz + .sha256
- job-log.jsonl rotates at 2MB or 14d -> same archive layout
- followups.json archives resolved>7d / escalated>30d -> followups.archive.jsonl (append-only)
- verify wrapper: sha256 -c, gzip -t, clean listing, spot-extract JSON + ts bounds
- driver + hourly systemd user timer (retention-rotations.timer)
- archive-only: nothing is ever deleted; thread backfill excluded (needs human-reviewed preview)
First run 2026-10-05 16:35Z: chat-history 29.7MB + job-log 4.7MB rotated and verified; followups 0 eligible of 163.

bin/retention-rotate-job-log.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# retention-rotate-job-log.sh — retention piece 1 (board bug b67084660385).
+# Rotates job-log.jsonl when it exceeds 2MB or is older than 14 days.
+#
+# Live-writer safety: all writers (bin/job-dispatch.py, bin/followup-sweeper.py)
+# open the file in append mode per write, so an atomic `mv` of the live file
+# is safe — the next write recreates a fresh file. We also `touch` the new
+# live file for tidiness.
+#
+# Archives land in logs/archive/job-log-YYYYMMDD-HHMMSS.jsonl.gz with a
+# sha256 sidecar. Nothing is ever deleted by this script.
+set -euo pipefail
+
+ROOT="${NETVM_ROOT:-/home/super/Projects/NetVM}"
+LIVE="$ROOT/job-log.jsonl"
+ARCHIVE_DIR="$ROOT/logs/archive"
+SIZE_LIMIT=$((2 * 1024 * 1024))    # 2MB
+AGE_LIMIT_DAYS=14
+TS="$(date -u +%Y%m%d-%H%M%S)"
+
+mkdir -p "$ARCHIVE_DIR"
+
+if [ ! -f "$LIVE" ]; then
+  echo "SKIP job-log: no live file at $LIVE"
+  exit 0
+fi
+
+size="$(stat -c %s "$LIVE")"
+age_days=$(( ( $(date +%s) - $(stat -c %Y "$LIVE") ) / 86400 ))
+
+if [ "$size" -lt "$SIZE_LIMIT" ] && [ "$age_days" -lt "$AGE_LIMIT_DAYS" ]; then
+  echo "SKIP job-log: ${size}B, ${age_days}d old (limits ${SIZE_LIMIT}B / ${AGE_LIMIT_DAYS}d)"
+  exit 0
+fi
+
+lines="$(wc -l < "$LIVE")"
+base="job-log-$TS"
+echo "ROTATE job-log: ${size}B / ${lines} lines (${age_days}d old) -> $ARCHIVE_DIR/$base.jsonl.gz"
+
+mv "$LIVE" "$ARCHIVE_DIR/$base.jsonl"
+gzip -9 "$ARCHIVE_DIR/$base.jsonl"
+( cd "$ARCHIVE_DIR" && sha256sum "$base.jsonl.gz" > "$base.jsonl.gz.sha256" )
+touch "$LIVE"
+
+echo "OK job-log: archived $base.jsonl.gz, live file recreated empty"