What

Implements the (b1) + (c2) shapes from the §2.2.C cleanup-shape sketch (silas-dandelion-cult comment on #332).

Filed as DRAFT — figs has not yet ratified the contract shape. This PR opens the runway so byte-evidence is available when ratification lands; flip to ready-for-review only after the §2.2.C call.

Diff shape

5 files, +373/-1, no doc changes, no schema surface added.

(b1) Failed-record TTL prune

• New helper pruneFailedOlderThan(maxAgeMs, now, stateDir) in storage. Walks failed/ subdir, unlinks entries older than maxAgeMs by mtime. Best-effort (swallows ENOENT mid-walk).
• In-module lastGcAt watermark in recovery with 60 s amortization so high-tick-rate recovery loops do not readdir on every tick.
• Threaded as optional failedMaxAgeMs param through recoverPendingSessionDeliveries / drainPendingSessionDeliveries. Caller-side opt-in; zero new schema surface.
• DEFAULT_FAILED_MAX_AGE_MS = 14 d exposed for caller convenience (matches the sketch default).

(c2) queueDir.maxFiles soft-cap

• New helper countQueuedFiles(queueDir) returns top-level .json / .tmp / .delivered count (excludes failed/ subdir per the sketch's "directory-size soft-cap at enqueue" framing).
• enqueueSessionDelivery takes optional maxQueuedFiles; when count meets/exceeds cap, throws typed SessionDeliveryQueueOverflowError with .kind = 'session-delivery-queue-overflow' and .count / .maxFiles fields. Caller chooses how to handle.
• DEFAULT_QUEUE_DIR_MAX_FILES = 10_000.

Schema decision

Per workorder preference, no new schema surface added. Both knobs threaded as optional helper params. Rationale: figs has not ratified the contract shape; minimizing ratification surface keeps the door open for a different config-key naming or wiring decision without rewrite cost. If §2.2.C call lands on "wire through sessionDeliveryQueue config", that's a follow-up commit on this PR.

Tests

• storage: 13 tests pass (prune older/newer/missing dir; countQueuedFiles; enqueue overflow throw; custom maxFiles cap).
• recovery: 6 tests pass (watermark amortization: single tick / repeated tick / advanced clock past 60 s / disabled when failedMaxAgeMs == null).

 Test Files  2 passed (2)
      Tests  19 passed (19)

pnpm tsgo clean.

Shapes considered + rejected (from sketch)

• (b2) Fixed-cap LRU — requires sort-on-write or directory scan on overflow; heavier than (b1) for marginal benefit.
• (b3) Operator-driven only — real risk of unbounded growth on poison-message scenarios; sketch flagged.
• (c1) Per-session enqueue rate limit — requires per-session token-bucket state; deferred until concrete rogue-producer scenario surfaces (sketch deferred).

What this PR is NOT

• Not a final contract — DRAFT, awaiting figs §2.2.C ratify.
• Not a config-schema change — opt-in via param threading only.
• Not a docs change — docs/design/ untouched (PR docs(design): #332 Item B audit — post-compaction release seam (DRAFT) #343 territory).
• Not a substrate refactor — surgical helper additions on existing storage/recovery boundary.

Cross-refs

• Closes part of session-delivery-queue (#70780) integration: post-compaction delegate release on v2026.4.24 base #332 (Item C cleanup-impl slice).
• Sketch comment: silas-dandelion-cult on session-delivery-queue (#70780) integration: post-compaction delegate release on v2026.4.24 base #332 (4322831655).
• figs §2.2.C ratify pending: gates flip to ready-for-review.
• Base: cael/325-canonical2 at 57d0e61d76 (post-docs(tools-template): substrate-adoption convention for new tool descriptors (#336 lift) #339 merge).
• Substrate-doctrine alignment: substrate-default; this PR is additive substrate, not bespoke.

cc @karmaterminal/sprites