Pruning lifetimes, design only: a subcommand of the store's surface with a retention policy, never a lifecycle verb, never the current lifetime #930

Epic: #451 · Feature: #762 The writ lifecycle surface · Schedule: #916, lane 13, PR F · Waits on: #928 (lane 11), #929 (lane 12)

The ruling, 2026-09-23

A machine sees many lifetimes -- one per deploy (#922), and ended ones after decommission (#929) -- and the
store keeps them all. Pruning is housekeeping on the store, not a fifth verb: the four lifecycle operations act
on the current lifetime's record; pruning retires lifetimes that are no longer current and never touches the
current one. It is a subcommand of the store's own surface, with a retention policy to boot -- not a lifecycle
verb, and not something a deploy decides on the user's behalf.

This lane is design only

It writes the design into 5.1-reconciliation.md and 10-command-line-interface.md; the code is a later
schedule's. The design states:

1. What a non-current lifetime is: replaced (a later deploy opened a new one) or ended (a decommission closed
   it, decommission removes the record: the lifetime is ended, its receipts kept in the store for pruning, and reconcile is not-found until the next deploy #929). The current lifetime is never pruned.
2. What retiring one deletes: its receipts, their graph documents when no other lifetime references them, and
   its rows in the run index -- and what stays: nothing of it; a pruned lifetime is gone from the store.
3. The subcommand, on the store's surface (writ store prune, or whatever the store's group is named when
   the surface exists): explicit, reports what it would retire under --dry-run, retires it otherwise, and
   refuses to touch the current lifetime.
4. The retention policy, in config: keep the last N lifetimes, or lifetimes newer than a duration, or both;
   the subcommand applies it, and nothing applies it silently. A policy of none keeps everything, which is today.
5. What a reader loses: performance-over-time comparisons (A method receipt's UUIDv7 already stamps its commit; add the start, stamp the ledger capture and the run, and read performance over time from the store #910) read receipts; pruning bounds how far back
   they can look, and the design says so.

Acceptance

• the five points above are in 5.1-reconciliation.md, under the lifetime model, and the subcommand and the
  policy keys are in 10-command-line-interface.md and schema/defaults/writ.yaml as reserved, not implemented
• The writ lifecycle surface: reconcile, scopes, and the vocabulary settlement #762's plan carries the design as a requirement and names the later schedule that builds it
• no code changes

Plan and design documents

Revised 2026-09-28 (#847)

Pruning a lifetime removes its receipts, its refs/devlore/ refs and its snapshot worktrees (unlocked, then git worktree remove). It never removes the current lifetime, and never an unmerged retain/* branch: those are the maintainer's to toss or merge.