fix: stop ageing files out entirely, except staging folders

The strengthened race test earned its keep on the first run: the sweep deleted
an aged 'rejected upload' while a save was committing a reference to it, and the
accepted config came out pointing at nothing. The write lock serializes the two
but cannot help when the sweep goes first.

So the age rule is gone for plans and for marker folders. What remains is one
sentence: a file goes when an action says so — a plan replaced, an attachment
dropped from a device that still exists — plus a per-dialog staging folder after
an hour, which by construction can only hold an upload nobody saved.

Cost: an upload whose save failed sits there until someone removes it by hand.
That is the side of the trade the owner picked, and it is the side that cannot
lose data.

docs/ARCHITECTURE.md

@@ -225,11 +225,11 @@ was detached, under documentation promising the opposite (HP-1465-01).
 | Space in both, plan A → plan B | the user picked another image | removed immediately |
 | Space in both, plan → none | detached; one click undoes it | **kept** |
 | Space gone | deliberate, but the image was imported and may be nowhere else | **kept** |
-| Space has a plan, plus another file of its own | an upload whose save was rejected | `PLAN_ORPHAN_TTL_S` (1 h) |
+| Space has a plan, plus another file of its own | an upload whose save was rejected | **kept** — ageing these out raced the retry that referenced them |
 | Marker in both, attachment dropped from its list | a trash button, promising nothing | removed immediately |
 | Marker gone | same call as a deleted space's plan | **kept** |
 | Attachment in `up_*` | a dialog that was never saved; no device owns it | `PLAN_ORPHAN_TTL_S` (1 h) |
-| Marker there, file it never listed | a rejected upload | `SCHEDULED_GRACE_S` (30 d) |
+| Marker there, file it never listed | a rejected upload | **kept**, same reason |
 
 **Config writes are serialized** (HP-1454-03). `_writeConfig()` chains onto a
 single promise: one `config/set` in flight, each carrying the revision the

docs/CHANGELOG.md

@@ -14,6 +14,12 @@
 - **A plan whose space was deleted is kept**, rather than the thirty days
   v1.46.5 promised — thirty days measured from the file's age is meaningless
   anyway, since it was usually uploaded months earlier.
+- **Nothing is deleted for being old any more**, except a per-dialog staging
+  folder. The rule that aged out "rejected uploads" turned out to race a retry:
+  the cleanup removed the file from a failed save while the next attempt was
+  committing a reference to it. A rule that can delete a file somebody is about
+  to point at is not worth the disk it reclaims. Files therefore go when an
+  action says so, and otherwise stay.
 
 ## v1.46.5 — 2026-07-28 (audit of every automatic deletion)
 - **A detached plan is never deleted, at any age.** v1.46.4 gave it a month;

docs/CHANGELOG.ru.md

@@ -20,6 +20,12 @@
 - **План удалённого пространства сохраняется**, а не тридцать дней, как обещала
   v1.46.5: тридцать дней по возрасту файла всё равно бессмысленны — обычно он
   загружен месяцы назад.
+- **По возрасту больше не удаляется ничего**, кроме промежуточной папки диалога.
+  Правило, которое вычищало «отвергнутые загрузки», оказалось в гонке с
+  повторной попыткой: уборка удаляла файл неудавшегося сохранения ровно тогда,
+  когда следующая попытка коммитила ссылку на него. Правило, способное удалить
+  файл, на который кто-то вот-вот сошлётся, не стоит освобождаемого места.
+  Файлы уходят по действию, в остальных случаях остаются.
 
 ## v1.46.5 — 2026-07-28 (ревизия всех автоматических удалений)
 - **Отцеплённый план не удаляется никогда, ни в каком возрасте.** В v1.46.4 ему