fix(retention): reconcile due jobs without replacing occurrences

[rudycelekli]

What & why

Retention reconciliation raises TypeError for a persisted due policy: its enqueue_job_once call omits the required next_run_at. Simply supplying the argument would still let schedule_policy cancel the recovered occurrence and move the deadline to tomorrow.

Reconciliation now preserves active pending/processing retention jobs and recovers only a missing due occurrence, using the mirrored occurrence date and an immediate queue deadline. The existing enforcement handler owns next-day recurrence. Policy and mirror deadlines remain intact during bootstrap.

Type

• Bug fix

Verification

• Native public update_retention(RetentionUpdate) creates the policy, mirror and durable queue job. Persisted due pending/processing/missing cases: 3 failures before, future control passing.
• Native repeated bootstrap verifies one active occurrence and unchanged mirror/policy; actual QueueService claim verifies pending/recovered work is immediately available.
• Existing retention and scheduler modules: 10 passed.
• Exact signed full frozen backend selection: 1,882 passed, 131 skipped, 3 deselected, 2 unchanged baseline warnings (uv run --frozen pytest -q -m 'not live and not postgres'). Pristine baseline: 1,878 passed.
• Changed-file Ruff F and diff checks pass. Owned migrated SQLite environment; no PostgreSQL service run locally or live external service. Frontend gates are left to hosted CI.
• Fresh upstream/open files screened. fix(audiences): preserve due refresh jobs during reconciliation #48 preserves due audience occurrences in its separate scheduler; retention's broken queue call and full recurrence ownership are addressed together here. No overlapping retention patch found.

Checklist

• Commits are signed and signed off per DCO
• Backend tests pass in the frozen environment described
• Monorepo lint and build pass (hosted CI pending)
• I did not add scraping of paywalled / pirated / login-gated content
• Credentialed providers are opt-in and inert by default

Security-sensitive?

Ordinary queue reconciliation only; existing enabled/hold checks remain intact. No changes to deletion targets, auth, secrets, tenancy, transport or prompt handling.

AI assistance was used for implementation and native tests. The exact signed source packet received independent review before publication.