fix(cloud): align planner configuration and records

docs/CLOUD_DEPLOYMENT.md

@@ -404,8 +404,11 @@ mode:
   sign in to `/console/` as an administrator and create an active entry under
   **LLM providers**. Provider API keys are encrypted in the database and are
   never returned by the API or Console. Edge Hosts do not hold Provider keys.
-  The Cloud API does not read `AI_PLANNER_PROVIDER`, `AI_PLANNER_MODEL`,
-  `AI_PLANNER_TIMEOUT_SECONDS`, `ANTHROPIC_API_KEY`, or `OPENAI_API_KEY`.
+  The profile's provider, model, base URL, and timeout (1 to 120 seconds) are
+  the authority for every Cloud-proxy call. The Cloud API does not read
+  `AI_PLANNER_PROVIDER`, `AI_PLANNER_MODEL`, `AI_PLANNER_TIMEOUT_SECONDS`,
+  `ANTHROPIC_API_KEY`, or `OPENAI_API_KEY`; those variables apply only to the
+  explicit `direct` transport.
 - **Profile types:** choose **Anthropic** for native Anthropic tool use, or
   **OpenAI-compatible** for the OpenAI Chat Completions tool-calling protocol.
   Both accept an optional absolute HTTP(S) Base URL; leave it blank for the
@@ -413,9 +416,9 @@ mode:
   provider's existing request schema and authentication; custom headers or
   incompatible parameter dialects are not supported by this path.
 - **Activation is immediate:** a newly activated enabled profile becomes the
-  Provider/model for the next Cloud-proxy planner decision. A Cloud-planner
-  request fails closed until one enabled profile is active; it never falls back
-  to a Cloud API environment credential.
+  Provider/model/timeout for the next Cloud-proxy planner decision. A
+  Cloud-planner request fails closed until one enabled profile is active; it
+  never falls back to a Cloud API environment credential.
 - **Trade-offs to accept before enabling:**
   - *Latency*: every planning step now makes a round trip to the Cloud API in
     addition to the LLM provider call.
@@ -423,10 +426,19 @@ mode:
     Cloud API outages via retry/backoff), a planning step fails immediately if
     the Cloud API or its configured provider is unreachable -- there is no
     fallback to the stub planner or to a local direct call.
-  - *Expanded data path*: goal/scene prompts and screenshots now transit the
-    Cloud API. The endpoint logs only metadata (host id, resolved tool name,
-    latency, error class) and never prompt text or screenshot bytes, but the
-    request bodies themselves do cross the network to the control plane.
+  - *Expanded data path and retained history*: goal/scene prompts and
+    screenshots transit the Cloud API. Application logs retain only metadata
+    (host id, resolved tool name, latency, error class), but every successful
+    Cloud-proxy decision with task context is also stored as system prompt,
+    user prompt, resolved tool name, arguments, and step index. The Cloud
+    Console task detail exposes that history to authorized task readers. The
+    decision log never stores screenshot bytes; direct-transport Hosts produce
+    no Cloud-side LLM history.
+  - *Retention*: `CLOUD_PLANNER_DECISION_LOG_RETENTION_DAYS` defaults to `7`.
+    The Cloud prunes a terminal task's decision rows after that window;
+    `CLOUD_PLANNER_DECISION_LOG_PRUNE_INTERVAL_SECONDS` defaults to `3600`.
+    Prompt retention is therefore a deliberate operational and data-handling
+    choice, not merely transient request processing.
 
 ### Direct transport (explicit opt-out)
 
@@ -443,7 +455,8 @@ ANTHROPIC_API_KEY=<secret manager reference>
 
 For OpenAI, set `AI_PLANNER_PROVIDER=openai` and provide `OPENAI_API_KEY`.
 Direct Hosts are not covered by Cloud token budgets or Cloud-side Provider key
-rotation.
+rotation. `AI_PLANNER_TIMEOUT_SECONDS` controls the provider call only in this
+direct mode.
 
 ### Host governance and Cloud-proxy token budgets
 
@@ -460,8 +473,10 @@ current UTC day. Set `CLOUD_PLANNER_TOKEN_RESERVATION_TTL_SECONDS` (default
 `300`) to bound an unknown-usage reservation after provider/transport failure.
 The daily Host budget must accommodate the reservation ceiling; otherwise the
 proxy rejects before calling the provider. On a provider response, the
-reservation is settled to reported usage and the Console retains only timestamp,
-provider/model, token counts, and optional task/attempt identifiers.
+reservation is settled to reported usage and the separate usage ledger retains
+only timestamp, provider/model, token counts, and optional task/attempt
+identifiers. This ledger is distinct from the bounded planner-decision history
+described above.
 
 Hosts reporting `AI_PLANNER_TRANSPORT=direct` are explicitly shown as
 **unmetered**. Cloud cannot enforce or verify their provider token use. Do not

docs/MACOS_IPHONE_SETUP.md

@@ -387,7 +387,9 @@ uv run --package device-host-agent device-host-agent setup
 
 Host Agent 的 Planner transport 默认是 `cloud`。启动前在 Cloud Console 创建并激活
 LLM Provider profile；Provider API key 只由 Cloud API 加密保存，边缘 Host 不需要也
-不应配置厂商 API key。
+不应配置厂商 API key。`cloud` transport 下的 provider、model、base URL 与 timeout
+均以激活 Profile 为准，Host 上的 `AI_PLANNER_*` Provider/model/timeout 配置不会覆盖
+云端 Profile。
 
 ```bash
 export HOST_AGENT_IDENTITY_PATH="tasks/host_identity.json"
@@ -402,6 +404,10 @@ uv run --package device-host-agent device-host-agent
 `AI_PLANNER_TRANSPORT=direct`，并在该 Host 上配置
 `AI_PLANNER_PROVIDER`、`AI_PLANNER_MODEL` 与对应的厂商 API key。
 
+Cloud transport 的成功规划决策会在云端按任务保存 system/user prompt、工具调用和步骤序号，
+供有任务读取权限的 Cloud Console 用户排障；截图不会写入该云端决策记录。默认在任务终态
+7 天后清理，具体配置和数据处理边界见 `docs/CLOUD_DEPLOYMENT.md` 的 Runtime AI Planner 一节。
+
 首次启动顺序为：持久化候选 Host secret、向云端换取 `host_id`、为每个本地设备
 换取 `device_id`、保存映射、连接 WDA、发送 heartbeat、开始 long-poll 领取任务。
 Host Agent 会在本机回环地址提供 Console。必须保留并保护 `tasks/host_identity.json` 和