Resolve all 46 low-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/IAuditLogRepository.cs

@@ -168,8 +168,8 @@ public interface IAuditLogRepository
     /// <para>
     /// <b>Bounded + idempotent.</b> Each batch is a <c>DELETE TOP (@batch)</c> so the
     /// transaction log and lock footprint stay bounded regardless of backlog. Re-running
-    /// the purge is a no-op once every eligible row is gone (the loop exits when a batch
-    /// deletes zero rows), so a crash mid-loop is recoverable by simply running again.
+    /// the purge resumes remaining backlog after reaching <paramref name="maxRows"/>;
+    /// an empty batch ends it sooner. A crash mid-loop is recoverable by running again.
     /// </para>
     /// </remarks>
     /// <param name="channel">Canonical channel name (the <c>Category</c> column value, e.g. <c>ApiOutbound</c>).</param>
@@ -183,13 +183,14 @@ public interface IAuditLogRepository
     /// by the ~30s ADO.NET default (arch-review 04, S2).
     /// </param>
     /// <param name="ct">Cancellation token.</param>
+    /// <param name="maxRows">Maximum total rows deleted in this call; remaining backlog is retained for a later tick.</param>
     /// <returns>A task that resolves to the total number of rows deleted across all batches.</returns>
     Task<long> PurgeChannelOlderThanAsync(
         string channel,
         DateTime threshold,
         int batchSize,
         TimeSpan? commandTimeout = null,
-        CancellationToken ct = default);
+        CancellationToken ct = default, int maxRows = 50_000);
 
     /// <summary>
     /// Returns the set of <c>pf_AuditLog_Month</c> partition lower-bound

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/ITemplateEngineRepository.cs

@@ -250,6 +250,10 @@ public interface ITemplateEngineRepository
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>A task that resolves to a read-only list of instances for the specified site.</returns>
     Task<IReadOnlyList<Instance>> GetInstancesBySiteIdAsync(int siteId, CancellationToken cancellationToken = default);
+
+    /// <summary>Reads one bounded, untracked page of topology instance rows for a site/area.</summary>
+    Task<IReadOnlyList<Instance>> GetTopologyInstancesAsync(int siteId, int? areaId, int skip, int take, CancellationToken cancellationToken = default);
+
     /// <summary>Retrieves an instance by unique name.</summary>
     /// <param name="uniqueName">The unique instance name.</param>
     /// <param name="cancellationToken">Cancellation token.</param>

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Services/IPullTraceEventsClient.cs

@@ -17,11 +17,12 @@ public interface IPullTraceEventsClient
     /// <param name="sinceUtc">Lower bound on <c>OccurredAtUtc</c> (the run's start is the natural choice).</param>
     /// <param name="maxEvents">Row cap (the site caps at 2000).</param>
     /// <param name="ct">Cancellation token.</param>
+    /// <param name="afterEventId">Optional exclusive EventId at sinceUtc for stable keyset paging.</param>
     /// <returns>The matching rows ordered <c>(OccurredAtUtc, EventId)</c>; empty on fault or unknown site.</returns>
     Task<IReadOnlyList<AuditEvent>> PullAsync(
         string siteId,
         IReadOnlyCollection<Guid> executionIds,
         DateTime sinceUtc,
         int maxEvents,
-        CancellationToken ct);
+        CancellationToken ct, string? afterEventId = null);
 }

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Services/ISiteAuditQueue.cs

@@ -232,5 +232,5 @@ public interface ISiteAuditQueue
     /// forwarding state — moves no cursor and flips nothing. At most 64 ids per call.
     /// </summary>
     Task<IReadOnlyList<AuditEvent>> ReadByExecutionIdsAsync(
-        IReadOnlyCollection<Guid> executionIds, DateTime sinceUtc, int limit, CancellationToken ct = default);
+        IReadOnlyCollection<Guid> executionIds, DateTime sinceUtc, int limit, CancellationToken ct = default, string? afterEventId = null);
 }