Expire retained file bodies and reclaim SQLite storage

docs/settings.md

@@ -47,7 +47,8 @@ minimum count as well as versions younger than the age threshold.
 | Telemetry diagnostics | 7 days; 200 per server; 10,000 overall |
 | Completed/interrupted matches | Indefinite |
 | Closed betas and test evidence | Indefinite |
-| Campaign file bodies and closed beta snapshots | No separate expiry |
+| Campaign file bodies and closed beta snapshots | 30 days |
+| Completed launch and command file bodies | 30 days |
 | Unused artifact versions | No automatic expiry; no minimum count |
 | Unused game files | No grace period; keep latest 1 version per game |
 | Incomplete browser uploads | Indefinite |
@@ -83,6 +84,18 @@ state and rollback requests fail explicitly. Active beta rollback images stay
 protected. Expiring matches removes their player participation rows and changes
 leaderboard/player totals; lifetime aggregates are not retained separately.
 
+Completed launch recipes and command receipts also retain their metadata when
+their file bodies expire. Unfinished workflows, unreconciled commands, unresolved
+failures and explicit holds preserve the bytes they need. Shared file bytes are
+deleted only after their final reference expires; library versions can keep a file
+available longer. Previously saved retention choices are preserved on upgrade.
+
+The database upgrade normalizes retention clocks to UTC and enables incremental
+vacuum. An existing database without a vacuum page map is rebuilt once at startup;
+allow time for this rebuild and free disk space up to twice the database size.
+Normal cleanup releases unused file blobs in bounded batches and incrementally
+returns free pages to disk after larger prunes.
+
 Game-file minimums apply per game. Grace starts when a version is superseded.
 Live, stopped, rebuilding and provisioning instances pin their files; unresolved
 operations and offline host copies also prevent controller deletion. Controller