fix(audit-log): explicit long CommandTimeout on partition-switch and per-channel purge maintenance paths

src/ZB.MOM.WW.ScadaBridge.AuditLog/Central/AuditLogPurgeActor.cs

@@ -182,7 +182,7 @@ public class AuditLogPurgeActor : ReceiveActor
             try
             {
                 var rowsDeleted = await repository
-                    .SwitchOutPartitionAsync(boundary)
+                    .SwitchOutPartitionAsync(boundary, _purgeOptions.ResolvedMaintenanceCommandTimeout)
                     .ConfigureAwait(false);
                 sw.Stop();
 
@@ -250,7 +250,11 @@ public class AuditLogPurgeActor : ReceiveActor
             try
             {
                 var rowsDeleted = await repository
-                    .PurgeChannelOlderThanAsync(channel, channelThreshold, _purgeOptions.ChannelPurgeBatchSize)
+                    .PurgeChannelOlderThanAsync(
+                        channel,
+                        channelThreshold,
+                        _purgeOptions.ChannelPurgeBatchSize,
+                        _purgeOptions.ResolvedMaintenanceCommandTimeout)
                     .ConfigureAwait(false);
                 sw.Stop();
 

src/ZB.MOM.WW.ScadaBridge.AuditLog/Central/AuditLogPurgeOptions.cs

@@ -56,6 +56,30 @@ public sealed class AuditLogPurgeOptions
     /// </summary>
     public int ChannelPurgeBatchSize => ChannelPurgeBatchSizeConfigured < 1 ? 1 : ChannelPurgeBatchSizeConfigured;
 
+    /// <summary>
+    /// Per-command timeout (in minutes) for the maintenance SQL the purge tick issues —
+    /// both the partition switch-out drop-and-rebuild dance
+    /// (<see cref="ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories.IAuditLogRepository.SwitchOutPartitionAsync"/>)
+    /// and each per-channel <c>DELETE TOP</c> batch. Default 30 minutes.
+    /// </summary>
+    /// <remarks>
+    /// The ADO.NET default command timeout is ~30 seconds. On a large or contended partition the
+    /// SWITCH dance (which briefly drops <c>UX_AuditLog_EventId</c>) can exceed that and abort
+    /// mid-flight — leaving the live table without its idempotency-supporting unique index until a
+    /// later tick's CATCH branch rebuilds it (arch-review 04, S2). A generous maintenance timeout
+    /// lets the metadata-only switch complete rather than self-locking. Resolved via
+    /// <see cref="ResolvedMaintenanceCommandTimeout"/>, clamped to a 1-minute floor.
+    /// </remarks>
+    public int MaintenanceCommandTimeoutMinutes { get; set; } = 30;
+
+    /// <summary>
+    /// Resolves the effective maintenance command timeout, clamped to at least 1 minute so a
+    /// misconfigured <c>0</c>/negative value cannot yield a zero/negative timeout (which ADO.NET
+    /// interprets as "no timeout" for <c>0</c> and rejects for negatives).
+    /// </summary>
+    public TimeSpan ResolvedMaintenanceCommandTimeout =>
+        TimeSpan.FromMinutes(MaintenanceCommandTimeoutMinutes < 1 ? 1 : MaintenanceCommandTimeoutMinutes);
+
     /// <summary>
     /// Test-only override for finer control over the tick cadence than
     /// whole-hour resolution allows. When non-null, takes precedence over