Migrate Policy retention interfaces

docs/POLICY_DECISION_PROVENANCE.md

@@ -120,6 +120,13 @@ System: Allow
 When a parent disallows lower-level limits or changes, the UI should disable
 the affected controls and avoid sending those fields in the save payload.
 
+System retention execution is a separate high-consequence operation. The UI
+must distinguish dry-run evidence from an applied run, render bounded counts as
+typed rows rather than raw JSON, explain missing write authority, and require a
+destructive confirmation that names deletion/redaction and recovery
+expectations. The backend remains authoritative and records the mode plus
+bounded outcome counts in audit evidence.
+
 The shared core WebUI helper `PolicySourcePath` renders the source path shape
 for module UIs. Modules may use their own field layout, but the data contract
 should remain this shape.