feat(state): expire stale agent devices with configurable retention

docs/config-durations.md

@@ -31,12 +31,25 @@ Reconnect scheduling retains its existing 100ms minimum backoff.
 command_timeout = "30s"
 enroll_token_ttl = "1d"
 history_retention = "30d"
+device_retention = "60d"
 ```
 
 All three settings must be positive. Enrollment TTL and history retention must
 resolve to whole seconds. Command timeout can use subsecond values.
 `history_retention` deletes old audit events and alert transitions, not device
-snapshots or saved identities. Device retention is a separate follow-up.
+snapshots or saved identities.
+
+`device_retention` expires agent-collected device rows and their child endpoints,
+addresses, names and facts. The default is `"60d"`; `"0d"` disables expiry.
+It must resolve to whole seconds. Age is measured from the last CC-received
+snapshot that included the device, not endpoint timestamps or online presence.
+An offline device included in new snapshots therefore stays retained. Saved
+devices and their manually attached identifiers are never deleted by this cleanup.
+Complete snapshots still remove devices omitted by that agent immediately;
+retention handles old rows left behind when an agent stops syncing.
+Expired rows are removed by the Unix daemon's existing maintenance loop every
+five minutes, including an initial tick at startup. Restart CC to apply changes
+to this setting; the state-only reload does not reload configuration.
 
 ## Legacy Files
 

docs/roadmap.md

@@ -36,7 +36,8 @@ of remembered identifiers based on observation expiry.
 
 ## Telemetry Follow-Ups
 
-- [x] Human-readable agent/CC config durations with unit-aware legacy loading, stderr deprecation warnings, and canonical init-config output. See [configuration durations](config-durations.md). History retention remains separate from future device expiry.
+- [x] Human-readable agent/CC config durations with unit-aware legacy loading, stderr deprecation warnings, and canonical init-config output. See [configuration durations](config-durations.md).
+- [x] CC device retention by last snapshot inclusion (`device_retention = "60d"`, zero disables), independent of audit history and preserving saved identities.
 
 - [x] Separate console, OTLP log, and trace filters using per-layer filtering. Explicit signal config overrides `RUST_LOG`, then CLI verbosity supplies defaults. Unconfigured defaults remain info-level; exporter-failure logs stay local. Live validation pending.
 - [ ] Record hostname-resolution success/failure without exporting hostnames or resolved addresses. Current spans show timing but do not explicitly classify the result.