fix(cloud): align planner configuration and records

docs/CLOUD_DEPLOYMENT.md

@@ -404,8 +404,11 @@ mode:
   sign in to `/console/` as an administrator and create an active entry under
   **LLM providers**. Provider API keys are encrypted in the database and are
   never returned by the API or Console. Edge Hosts do not hold Provider keys.
-  The Cloud API does not read `AI_PLANNER_PROVIDER`, `AI_PLANNER_MODEL`,
-  `AI_PLANNER_TIMEOUT_SECONDS`, `ANTHROPIC_API_KEY`, or `OPENAI_API_KEY`.
+  The profile's provider, model, base URL, and timeout (1 to 120 seconds) are
+  the authority for every Cloud-proxy call. The Cloud API does not read
+  `AI_PLANNER_PROVIDER`, `AI_PLANNER_MODEL`, `AI_PLANNER_TIMEOUT_SECONDS`,
+  `ANTHROPIC_API_KEY`, or `OPENAI_API_KEY`; those variables apply only to the
+  explicit `direct` transport.
 - **Profile types:** choose **Anthropic** for native Anthropic tool use, or
   **OpenAI-compatible** for the OpenAI Chat Completions tool-calling protocol.
   Both accept an optional absolute HTTP(S) Base URL; leave it blank for the
@@ -413,9 +416,9 @@ mode:
   provider's existing request schema and authentication; custom headers or
   incompatible parameter dialects are not supported by this path.
 - **Activation is immediate:** a newly activated enabled profile becomes the
-  Provider/model for the next Cloud-proxy planner decision. A Cloud-planner
-  request fails closed until one enabled profile is active; it never falls back
-  to a Cloud API environment credential.
+  Provider/model/timeout for the next Cloud-proxy planner decision. A
+  Cloud-planner request fails closed until one enabled profile is active; it
+  never falls back to a Cloud API environment credential.
 - **Trade-offs to accept before enabling:**
   - *Latency*: every planning step now makes a round trip to the Cloud API in
     addition to the LLM provider call.
@@ -423,10 +426,19 @@ mode:
     Cloud API outages via retry/backoff), a planning step fails immediately if
     the Cloud API or its configured provider is unreachable -- there is no
     fallback to the stub planner or to a local direct call.
-  - *Expanded data path*: goal/scene prompts and screenshots now transit the
-    Cloud API. The endpoint logs only metadata (host id, resolved tool name,
-    latency, error class) and never prompt text or screenshot bytes, but the
-    request bodies themselves do cross the network to the control plane.
+  - *Expanded data path and retained history*: goal/scene prompts and
+    screenshots transit the Cloud API. Application logs retain only metadata
+    (host id, resolved tool name, latency, error class), but every successful
+    Cloud-proxy decision with task context is also stored as system prompt,
+    user prompt, resolved tool name, arguments, and step index. The Cloud
+    Console task detail exposes that history to authorized task readers. The
+    decision log never stores screenshot bytes; direct-transport Hosts produce
+    no Cloud-side LLM history.
+  - *Retention*: `CLOUD_PLANNER_DECISION_LOG_RETENTION_DAYS` defaults to `7`.
+    The Cloud prunes a terminal task's decision rows after that window;
+    `CLOUD_PLANNER_DECISION_LOG_PRUNE_INTERVAL_SECONDS` defaults to `3600`.
+    Prompt retention is therefore a deliberate operational and data-handling
+    choice, not merely transient request processing.
 
 ### Direct transport (explicit opt-out)
 
@@ -443,7 +455,8 @@ ANTHROPIC_API_KEY=<secret manager reference>
 
 For OpenAI, set `AI_PLANNER_PROVIDER=openai` and provide `OPENAI_API_KEY`.
 Direct Hosts are not covered by Cloud token budgets or Cloud-side Provider key
-rotation.
+rotation. `AI_PLANNER_TIMEOUT_SECONDS` controls the provider call only in this
+direct mode.
 
 ### Host governance and Cloud-proxy token budgets
 
@@ -460,8 +473,10 @@ current UTC day. Set `CLOUD_PLANNER_TOKEN_RESERVATION_TTL_SECONDS` (default
 `300`) to bound an unknown-usage reservation after provider/transport failure.
 The daily Host budget must accommodate the reservation ceiling; otherwise the
 proxy rejects before calling the provider. On a provider response, the
-reservation is settled to reported usage and the Console retains only timestamp,
-provider/model, token counts, and optional task/attempt identifiers.
+reservation is settled to reported usage and the separate usage ledger retains
+only timestamp, provider/model, token counts, and optional task/attempt
+identifiers. This ledger is distinct from the bounded planner-decision history
+described above.
 
 Hosts reporting `AI_PLANNER_TRANSPORT=direct` are explicitly shown as
 **unmetered**. Cloud cannot enforce or verify their provider token use. Do not