feat(jobs): add admin call to purge jubs result

frontend/src/lib/api/endpoints/adminJobs.ts

@@ -114,6 +114,43 @@ export function listRuns(name: string, limit = 20): Promise<RunSummary[]> {
 	});
 }
 
+/** Envelope from `POST /api/admin/jobs/runs/purge`. `purged` is
+ *  the count of terminal-run rows deleted (findings cascade with
+ *  their parent run via the FK, no separate counter). */
+export interface PurgeResponse {
+	purged: number;
+	retention_days: number;
+}
+
+/**
+ * `POST /api/admin/jobs/runs/purge?days=N` — operator-triggered
+ * retention cleanup. Deletes terminal runs (`Completed`, `Failed`)
+ * with `completed_at` older than `days` days ago; associated
+ * `jobs.run_findings` rows drop with them via CASCADE. Non-terminal
+ * runs (`Running`, `Paused`, `CancelRequested`) are ALWAYS
+ * preserved regardless of age.
+ *
+ * Backend enforces a minimum of 1 day defensively.
+ */
+export async function purgeJobRuns(days = 30): Promise<PurgeResponse> {
+	const res = await apiFetch(`/api/admin/jobs/runs/purge?days=${days}`, {
+		method: 'POST',
+		credentials: 'same-origin',
+		headers: { ...JSON_HEADERS, ...getCsrfHeaders() }
+	});
+	if (!res.ok) {
+		let msg = `purge failed: ${res.status}`;
+		try {
+			const body = (await res.json()) as { error?: string; message?: string };
+			msg = body.error ?? body.message ?? msg;
+		} catch {
+			/* no JSON body */
+		}
+		throw new Error(msg);
+	}
+	return (await res.json()) as PurgeResponse;
+}
+
 /**
  * `GET /api/admin/jobs/{name}/runs/{id}/findings?limit=N&offset=M` —
  * paginated findings for a specific run. Empty list = clean run,

frontend/src/lib/components/AdminJobsPanel.svelte

@@ -20,6 +20,7 @@
 <script lang="ts">
 	import { SvelteSet } from 'svelte/reactivity';
 	import Icon from '$lib/icons/Icon.svelte';
+	import Modal from '$lib/components/Modal.svelte';
 	import { t } from '$lib/i18n/index.svelte';
 	import { errorMessage } from '$lib/utils/errors';
 	import { ui } from '$lib/stores/ui.svelte';
@@ -28,7 +29,8 @@
 		listRuns,
 		listFindings,
 		triggerJob,
-		cancelJob
+		cancelJob,
+		purgeJobRuns
 	} from '$lib/api/endpoints/adminJobs';
 	import type { Finding, JobSummary, RunSummary, RunStatus } from '$lib/api/types';
 
@@ -63,6 +65,40 @@
 		else busyKeys.delete(key);
 	}
 
+	// Purge-modal state. Null = closed; otherwise carries the
+	// draft retention days the operator's picking. Kept separate
+	// from the top-bar action state so mouse-away doesn't lose
+	// the value.
+	let purgeModal = $state<{ days: number } | null>(null);
+	function openPurge() {
+		purgeModal = { days: 30 };
+	}
+	function closePurge() {
+		purgeModal = null;
+	}
+	async function confirmPurge() {
+		if (!purgeModal) return;
+		const days = Math.max(1, Math.floor(purgeModal.days));
+		markBusy('purge', true);
+		try {
+			const res = await purgeJobRuns(days);
+			ui.notify(
+				t(
+					'admin.jobs.purge_done',
+					{ n: res.purged, days: res.retention_days },
+					'{{n}} old run(s) purged (retention {{days}} days)'
+				),
+				'success'
+			);
+			purgeModal = null;
+			await loadJobs();
+		} catch (e) {
+			ui.notify(errorMessage(e), 'error');
+		} finally {
+			markBusy('purge', false);
+		}
+	}
+
 	// ─── Loading + polling ─────────────────────────────────────────────
 
 	/**
@@ -459,8 +495,8 @@
 				)}
 			</p>
 		</div>
-		{#if hasBatch}
+		<div class="jobs-panel__header-actions">
-			<div class="jobs-panel__header-actions">
+			{#if hasBatch}
 				<button
 					class="jobs-panel__btn jobs-panel__btn--primary"
 					disabled={busyKeys.has('trigger:consistency_batch')}
@@ -481,8 +517,25 @@
 					<Icon name="play" />
 					{t('admin.jobs.run_deep', 'Run deep')}
 				</button>
-			</div>
+			{/if}
-		{/if}
+			<!-- Purge is orthogonal to consistency — it works even
+			     when the batch coordinator isn't registered, so it
+			     lives outside the {#if hasBatch}. Opens a modal so
+			     the operator picks a retention window with intent
+			     (no accidental delete-all). -->
+			<button
+				class="jobs-panel__btn"
+				title={t(
+					'admin.jobs.purge_hint',
+					'Delete completed and failed run history older than the chosen retention window. Findings drop with their parent runs. Non-terminal runs are always preserved.'
+				)}
+				onclick={openPurge}
+				disabled={busyKeys.has('purge')}
+			>
+				<Icon name="trash-alt" />
+				{t('admin.jobs.purge', 'Purge old runs')}
+			</button>
+		</div>
 	</header>
 
 	{#if loadError}
@@ -889,6 +942,58 @@
 	{/if}
 </section>
 
+<!-- Purge modal — pick a retention window, then confirm. -->
+<Modal
+	open={purgeModal !== null}
+	title={t('admin.jobs.purge_title', 'Purge old job history')}
+	onclose={closePurge}
+>
+	{#if purgeModal}
+		<form
+			class="jobs-panel__purge-form"
+			onsubmit={(e) => {
+				e.preventDefault();
+				void confirmPurge();
+			}}
+		>
+			<p>
+				{t(
+					'admin.jobs.purge_body',
+					'Delete completed and failed run history older than the chosen number of days. Findings drop with their parent runs. Non-terminal runs (running, paused, cancel-requested) are always preserved.'
+				)}
+			</p>
+			<label>
+				<span>{t('admin.jobs.purge_days_label', 'Retention (days)')}</span>
+				<input
+					type="number"
+					min="1"
+					step="1"
+					bind:value={purgeModal.days}
+					disabled={busyKeys.has('purge')}
+				/>
+			</label>
+			<div class="jobs-panel__purge-actions">
+				<button
+					type="button"
+					class="jobs-panel__btn"
+					onclick={closePurge}
+					disabled={busyKeys.has('purge')}
+				>
+					{t('common.cancel', 'Cancel')}
+				</button>
+				<button
+					type="submit"
+					class="jobs-panel__btn jobs-panel__btn--danger"
+					disabled={busyKeys.has('purge')}
+				>
+					<Icon name="trash-alt" />
+					{t('admin.jobs.purge_confirm', 'Purge')}
+				</button>
+			</div>
+		</form>
+	{/if}
+</Modal>
+
 <style>
 	.jobs-panel {
 		display: flex;
@@ -1192,6 +1297,28 @@
 		flex-wrap: wrap;
 	}
 
+	.jobs-panel__purge-form {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	.jobs-panel__purge-form label {
+		display: flex;
+		flex-direction: column;
+		gap: 0.25rem;
+	}
+
+	.jobs-panel__purge-form input {
+		max-width: 8rem;
+	}
+
+	.jobs-panel__purge-actions {
+		display: flex;
+		gap: 0.5rem;
+		justify-content: flex-end;
+	}
+
 	.jobs-panel__link {
 		display: inline-flex;
 		align-items: center;

frontend/static/locales/en.json

@@ -1241,6 +1241,13 @@
       "n_findings": "{{n}} findings",
       "n_notices": "{{n}} notices",
       "notices_present_tooltip": "Informational findings — no action required. Expand for detail.",
+      "purge": "Purge old runs",
+      "purge_hint": "Delete completed and failed run history older than the chosen retention window. Findings drop with their parent runs. Non-terminal runs are always preserved.",
+      "purge_title": "Purge old job history",
+      "purge_body": "Delete completed and failed run history older than the chosen number of days. Findings drop with their parent runs. Non-terminal runs (running, paused, cancel-requested) are always preserved.",
+      "purge_days_label": "Retention (days)",
+      "purge_confirm": "Purge",
+      "purge_done": "{{n}} old run(s) purged (retention {{days}} days)",
       "state_running": "running",
       "never": "never",
       "just_now": "just now",

src/infrastructure/scheduler/pg_job_store.rs

@@ -431,6 +431,30 @@ impl JobStoreProvider for PgJobStoreProvider {
             .collect())
     }
 
+    async fn purge_terminal_runs(&self, retention_days: i32) -> Result<u64, DomainError> {
+        // Defensive floor — zero would eat just-completed runs;
+        // negative would eat the whole terminal history.
+        let days = retention_days.max(1);
+        // `ON DELETE CASCADE` on jobs.run_findings.run_id
+        // (migration 20260930000001) drops findings with their
+        // parent run. Non-terminal statuses (Running / Paused /
+        // CancelRequested) explicitly excluded to protect
+        // in-flight work.
+        let result = sqlx::query(
+            r#"
+            DELETE FROM jobs.recoverable_runs
+             WHERE status IN ('Completed', 'Failed')
+               AND completed_at IS NOT NULL
+               AND completed_at < NOW() - ($1 || ' days')::interval
+            "#,
+        )
+        .bind(days.to_string())
+        .execute(self.pool.as_ref())
+        .await
+        .map_err(|e| map_sqlx_err("purge_terminal_runs", e))?;
+        Ok(result.rows_affected())
+    }
+
     async fn request_cancel(&self, job_name: &str) -> Result<Option<Uuid>, DomainError> {
         // Only Running → CancelRequested flips. `Paused` can be
         // cancelled by not resuming — no need for a state change.

src/infrastructure/scheduler/recoverable.rs

@@ -371,6 +371,29 @@ pub trait JobStoreProvider: Send + Sync {
         &self,
         run_id: Uuid,
     ) -> Result<Vec<(String, u64)>, DomainError>;
+
+    /// Operator-triggered retention cleanup. DELETEs every
+    /// TERMINAL run (`Completed`, `Failed`) whose `completed_at`
+    /// is older than `retention_days` days ago. Findings drop
+    /// alongside via the `ON DELETE CASCADE` FK on
+    /// `jobs.run_findings.run_id`.
+    ///
+    /// Non-terminal rows (`Running`, `Paused`, `CancelRequested`)
+    /// are ALWAYS preserved regardless of age — an in-flight or
+    /// paused run must not be reaped by retention.
+    ///
+    /// `retention_days` is treated as `max(1, retention_days)` at
+    /// the impl layer to defend against a zero/negative value
+    /// eating just-completed runs.
+    ///
+    /// Returns the number of run rows deleted (which equals
+    /// the number of finding rows deleted *transitively* via
+    /// CASCADE; callers wanting the finding count separately
+    /// should query it BEFORE calling this).
+    ///
+    /// Powers `POST /api/admin/jobs/runs/purge`. Not periodic — the
+    /// operator decides when to reclaim space.
+    async fn purge_terminal_runs(&self, retention_days: i32) -> Result<u64, DomainError>;
 }
 
 /// How a `RunProgress` fraction was derived. Lets the UI communicate
@@ -1094,6 +1117,25 @@ mod tests {
             Ok(counts.into_iter().collect())
         }
 
+        async fn purge_terminal_runs(&self, retention_days: i32) -> Result<u64, DomainError> {
+            // Test-double: no `completed_at` to compare against, so
+            // just drop every terminal-state store when
+            // `retention_days` > 0. Sufficient for the trait
+            // contract check; PG impl exercises the real
+            // `completed_at < NOW() - days` filter.
+            let days = retention_days.max(1);
+            if days == 0 {
+                return Ok(0);
+            }
+            let mut stores = self.stores.lock().unwrap();
+            let before = stores.len();
+            stores.retain(|s| {
+                let state = s.state.lock().unwrap();
+                !matches!(state.status, RunStatus::Completed | RunStatus::Failed)
+            });
+            Ok((before - stores.len()) as u64)
+        }
+
         async fn request_cancel(&self, _job_name: &str) -> Result<Option<Uuid>, DomainError> {
             let stores = self.stores.lock().unwrap();
             if let Some(s) = stores.last() {

src/interfaces/api/handlers/admin_handler.rs

@@ -164,6 +164,9 @@ pub fn admin_routes() -> Router<Arc<AppState>> {
             "/jobs/{name}/runs/{id}/findings",
             get(list_job_run_findings),
         )
+        // Retention cleanup — operator-triggered, not periodic.
+        // See `purge_job_runs` docstring for the semantics.
+        .route("/jobs/runs/purge", post(purge_job_runs))
         // Drives — admin-wide view (distinct from `/api/drives` which
         // is filtered to the caller's role grants).
         .route("/drives", get(list_all_drives))
@@ -2392,3 +2395,74 @@ pub async fn list_job_run_findings(
         Err(e) => AppError::internal_error(format!("list_findings failed: {e}")).into_response(),
     }
 }
+
+/// Query parameters for `POST /api/admin/jobs/runs/purge`.
+///
+/// `days` — retention window. Terminal runs (`Completed`, `Failed`)
+/// with `completed_at` older than this many days ago are deleted
+/// (with their findings via CASCADE). Default 30. Minimum enforced
+/// at 1 by the provider — zero would eat runs completed seconds
+/// ago. Non-terminal runs are ALWAYS preserved regardless of age.
+#[derive(serde::Deserialize)]
+pub struct PurgeJobRunsQuery {
+    #[serde(default = "default_purge_days")]
+    pub days: i32,
+}
+
+fn default_purge_days() -> i32 {
+    30
+}
+
+/// `POST /api/admin/jobs/runs/purge?days=N` — operator-triggered
+/// cleanup of old terminal runs + their findings. Not periodic;
+/// admins fire this when they want to reclaim `jobs.*` history
+/// space. Delegates entirely to
+/// `JobStoreProvider::purge_terminal_runs` — no SQL in the handler
+/// (see `AGENTS.md` § handler thinness).
+#[utoipa::path(
+    post,
+    path = "/api/admin/jobs/runs/purge",
+    params(
+        ("days" = Option<i32>, Query, description = "Retention window in days (default 30, minimum 1). Terminal runs older than this are deleted with their findings; non-terminal runs are always preserved."),
+    ),
+    responses(
+        (status = 200, description = "Purge complete"),
+        (status = 401, description = "Unauthorized"),
+        (status = 403, description = "Admin required"),
+        (status = 500, description = "DB error"),
+    ),
+    security(("bearerAuth" = [])),
+    tag = "admin"
+)]
+pub async fn purge_job_runs(
+    State(state): State<Arc<AppState>>,
+    axum::extract::Query(query): axum::extract::Query<PurgeJobRunsQuery>,
+) -> impl IntoResponse {
+    use crate::infrastructure::scheduler::JobStoreProvider as _;
+    let retention_days = query.days.max(1);
+    match state
+        .core
+        .job_store_provider
+        .purge_terminal_runs(retention_days)
+        .await
+    {
+        Ok(purged) => {
+            tracing::info!(
+                target: "audit",
+                event = "jobs.runs_purged",
+                purged = purged,
+                retention_days = retention_days,
+                "👮🏻‍♂️ admin purged {purged} terminal recoverable-run row(s) past {retention_days} day retention (findings cascaded)",
+            );
+            (
+                StatusCode::OK,
+                Json(serde_json::json!({
+                    "purged":         purged,
+                    "retention_days": retention_days,
+                })),
+            )
+                .into_response()
+        }
+        Err(e) => AppError::internal_error(format!("purge failed: {e}")).into_response(),
+    }
+}