Sub-ticket of PLUTO-185 verify live pg_cron appEvents-retention-prune allowlist includes category=malicious in the >=365d security class (commons documents it; malicious is brand-new to appEvents, audit could not confirm the job covers it) - if absent, rows from PLUTO-182 age out at default 90d; fix via migration if drift · pluto