[runesleo]

Context

Follow-up to the two unresolved P2 review threads on #44:

• 90-calendar-day cutoff
• Retention after requests stop

Changes

• Align active storage and read_summary(days=90): the current UTC date plus the prior 89 dates, excluding the date exactly 90 days prior.
• Reuse ThreadingHTTPServer.serve_forever()'s existing service_actions() lifecycle to prune on startup and hourly without traffic; no new service, worker, timer or scheduler. SQLite maintenance uses a zero busy timeout and cannot break user requests.
• Add explicit --prune-expired --db PATH for operator cleanup after opt-out or shutdown, without creating a missing database. Turn on SQLite secure_delete for deletions.
• Correct hosted EN/ZH privacy notices and deployment documentation: an offline/disabled service cannot guarantee physical deletion by day 90; operators must clean the stored DB and any backups. No unconditional deletion claim remains.
• Add frozen-UTC-date tests for the 89/90/91-day boundary and midnight rollover; idle serving without traffic; explicit opt-out prune; missing-file and concurrent-removal no-create guarantees; locked SQLite fail-open. Public EN/ZH privacy copy has regression assertions.

Verification

• Verified CI PASS at latest head c39e4e1: workflow run 39082220343. Python 3.10: 369 tests, OK (2 skipped); Python 3.11: 369 tests, OK (1 skipped).
• Main and PR feat(web): opt-in private daily usage aggregates #44 were read at base 26333d39b992458475feb7940292aa9f89f5a7ba.
• Changed files (8) are limited to usage implementation, server lifecycle, regression tests, public privacy copy and deploy documentation. Added-line scan found no credential-like strings or trailing whitespace.
• Not a production rollout: does not enable X_READER_USAGE_DB, change a service drop-in, deploy, or merge.

Residual operating limit

On a stopped service, or after telemetry is disabled, no in-process work can run. Strict deletion while offline requires an already-governed external maintenance guarantee or explicit operator cleanup; do not claim a hard 90-day maximum from this PR alone.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T00:21:05.845876Z	c39e4e1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[runesleo]

@codex review

Please review the latest head, including the final existing-file-only mode=rw cleanup, UTC 90-calendar-date boundary, idle service_actions() behavior, and the explicitly qualified offline retention notices. No production configuration changes are intended.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: c39e4e1413

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".