fix(audit-log): explicit long CommandTimeout on partition-switch and per-channel purge maintenance paths

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/AuditLogIngestActorTests.cs

@@ -259,12 +259,12 @@ public class AuditLogIngestActorTests : TestKit, IClassFixture<MsSqlMigrationFix
             AuditLogQueryFilter filter, AuditLogPaging paging, CancellationToken ct = default) =>
             _inner.QueryAsync(filter, paging, ct);
 
-        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, CancellationToken ct = default) =>
-            _inner.SwitchOutPartitionAsync(monthBoundary, ct);
+        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
+            _inner.SwitchOutPartitionAsync(monthBoundary, commandTimeout, ct);
 
         public Task<long> PurgeChannelOlderThanAsync(
-            string channel, DateTime threshold, int batchSize, CancellationToken ct = default) =>
-            _inner.PurgeChannelOlderThanAsync(channel, threshold, batchSize, ct);
+            string channel, DateTime threshold, int batchSize, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
+            _inner.PurgeChannelOlderThanAsync(channel, threshold, batchSize, commandTimeout, ct);
 
         public Task<long> BackfillSourceNodeAsync(
             string sentinel, DateTime before, int batchSize, CancellationToken ct = default) =>

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/AuditLogPurgeActorTests.cs

@@ -51,6 +51,11 @@ public class AuditLogPurgeActorTests : TestKit, IClassFixture<MsSqlMigrationFixt
         public DateTime? ThrowOnBoundary { get; set; }
         public Exception? BoundaryException { get; set; }
 
+        // Task 4: captures the maintenance command timeout the actor threads through to the
+        // switch-out + per-channel purge, so tests can assert the options value reaches the repo.
+        public List<TimeSpan?> SwitchTimeouts { get; } = new();
+        public List<TimeSpan?> ChannelTimeouts { get; } = new();
+
         // M5.5 (T3): records every per-channel purge call as
         // (channel, threshold, batchSize) so tests can assert which channels the
         // actor chose to purge and with what window.
@@ -69,8 +74,9 @@ public class AuditLogPurgeActorTests : TestKit, IClassFixture<MsSqlMigrationFixt
             AuditLogQueryFilter filter, AuditLogPaging paging, CancellationToken ct = default) =>
             Task.FromResult<IReadOnlyList<AuditEvent>>(Array.Empty<AuditEvent>());
 
-        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, CancellationToken ct = default)
+        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, TimeSpan? commandTimeout = null, CancellationToken ct = default)
         {
+            SwitchTimeouts.Add(commandTimeout);
             if (ThrowOnBoundary.HasValue && monthBoundary == ThrowOnBoundary.Value)
             {
                 throw BoundaryException ?? new InvalidOperationException("simulated switch failure");
@@ -87,9 +93,10 @@ public class AuditLogPurgeActorTests : TestKit, IClassFixture<MsSqlMigrationFixt
         }
 
         public Task<long> PurgeChannelOlderThanAsync(
-            string channel, DateTime threshold, int batchSize, CancellationToken ct = default)
+            string channel, DateTime threshold, int batchSize, TimeSpan? commandTimeout = null, CancellationToken ct = default)
         {
             ChannelPurges.Add((channel, threshold, batchSize));
+            ChannelTimeouts.Add(commandTimeout);
             return Task.FromResult(RowsPerChannel(channel));
         }
 
@@ -491,4 +498,49 @@ public class AuditLogPurgeActorTests : TestKit, IClassFixture<MsSqlMigrationFixt
 
         Assert.Empty(repo.ChannelPurges);
     }
+
+    // ---------------------------------------------------------------------
+    // 10. PurgeTick_Passes_MaintenanceCommandTimeout_To_Repository (Task 4)
+    // ---------------------------------------------------------------------
+
+    [Fact]
+    public void PurgeTick_Passes_MaintenanceCommandTimeout_To_Repository()
+    {
+        // The actor must thread AuditLogPurgeOptions.ResolvedMaintenanceCommandTimeout through to
+        // BOTH the partition switch-out and each per-channel purge, so the ~30s ADO.NET default
+        // cannot self-lock the drop-and-rebuild dance (arch-review 04, S2).
+        var boundary = new DateTime(2025, 5, 1, 0, 0, 0, DateTimeKind.Utc);
+        var repo = new RecordingRepo
+        {
+            Boundaries = new List<DateTime> { boundary },
+            RowsPerBoundary = _ => 7L,
+        };
+
+        var purgeOptions = FastTickOptions();
+        purgeOptions.MaintenanceCommandTimeoutMinutes = 45;
+
+        // A per-channel override shorter than the global window so the channel purge also fires.
+        var auditOptions = Options.Create(new AuditLogOptions
+        {
+            RetentionDays = 365,
+            PerChannelRetentionDays = new Dictionary<string, int> { ["ApiOutbound"] = 30 },
+        });
+
+        var sp = BuildScopedProvider(repo);
+        Sys.ActorOf(Props.Create(() => new AuditLogPurgeActor(
+            sp,
+            Options.Create(purgeOptions),
+            auditOptions,
+            NullLogger<AuditLogPurgeActor>.Instance)));
+
+        var expected = TimeSpan.FromMinutes(45);
+        AwaitAssert(
+            () =>
+            {
+                Assert.Contains(expected, repo.SwitchTimeouts);
+                Assert.Contains(expected, repo.ChannelTimeouts);
+            },
+            duration: TimeSpan.FromSeconds(3),
+            interval: TimeSpan.FromMilliseconds(50));
+    }
 }

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/AuditLogPurgeOptionsTests.cs

@@ -0,0 +1,31 @@
+using ZB.MOM.WW.ScadaBridge.AuditLog.Central;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Tests.Central;
+
+/// <summary>
+/// Task 4 tests for <see cref="AuditLogPurgeOptions.MaintenanceCommandTimeoutMinutes"/> /
+/// <see cref="AuditLogPurgeOptions.ResolvedMaintenanceCommandTimeout"/>: the maintenance timeout
+/// defaults to 30 minutes and is clamped to a 1-minute floor so a misconfigured 0/negative value
+/// cannot yield a zero/negative ADO.NET command timeout (arch-review 04, S2).
+/// </summary>
+public class AuditLogPurgeOptionsTests
+{
+    [Fact]
+    public void MaintenanceCommandTimeout_Defaults_To_30_Minutes()
+    {
+        var options = new AuditLogPurgeOptions();
+        Assert.Equal(30, options.MaintenanceCommandTimeoutMinutes);
+        Assert.Equal(TimeSpan.FromMinutes(30), options.ResolvedMaintenanceCommandTimeout);
+    }
+
+    [Theory]
+    [InlineData(0, 1)]     // clamp floor — a zero config value cannot become a zero timeout
+    [InlineData(-5, 1)]    // clamp floor — negatives are rejected by ADO.NET
+    [InlineData(1, 1)]     // boundary passthrough
+    [InlineData(45, 45)]   // ordinary passthrough
+    public void ResolvedMaintenanceCommandTimeout_Clamps_To_MinimumOneMinute(int configured, int expectedMinutes)
+    {
+        var options = new AuditLogPurgeOptions { MaintenanceCommandTimeoutMinutes = configured };
+        Assert.Equal(TimeSpan.FromMinutes(expectedMinutes), options.ResolvedMaintenanceCommandTimeout);
+    }
+}

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/CentralAuditWriteFailuresTests.cs

@@ -42,10 +42,10 @@ public class CentralAuditWriteFailuresTests : TestKit
         public Task<IReadOnlyList<AuditEvent>> QueryAsync(
             AuditLogQueryFilter filter, AuditLogPaging paging, CancellationToken ct = default) =>
             Task.FromResult<IReadOnlyList<AuditEvent>>(Array.Empty<AuditEvent>());
-        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, CancellationToken ct = default) =>
+        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
             Task.FromResult(0L);
         public Task<long> PurgeChannelOlderThanAsync(
-            string channel, DateTime threshold, int batchSize, CancellationToken ct = default) =>
+            string channel, DateTime threshold, int batchSize, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
             Task.FromResult(0L);
         public Task<long> BackfillSourceNodeAsync(
             string sentinel, DateTime before, int batchSize, CancellationToken ct = default) =>

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/SiteAuditReconciliationActorTests.cs

@@ -86,11 +86,11 @@ public class SiteAuditReconciliationActorTests : TestKit, IClassFixture<MsSqlMig
             AuditLogQueryFilter filter, AuditLogPaging paging, CancellationToken ct = default) =>
             Task.FromResult<IReadOnlyList<AuditEvent>>(Inserted);
 
-        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, CancellationToken ct = default) =>
+        public Task<long> SwitchOutPartitionAsync(DateTime monthBoundary, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
             Task.FromResult(0L);
 
         public Task<long> PurgeChannelOlderThanAsync(
-            string channel, DateTime threshold, int batchSize, CancellationToken ct = default) =>
+            string channel, DateTime threshold, int batchSize, TimeSpan? commandTimeout = null, CancellationToken ct = default) =>
             Task.FromResult(0L);
 
         public Task<long> BackfillSourceNodeAsync(

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Integration/PartitionPurgeTests.cs

@@ -474,4 +474,54 @@ WHERE  name = 'UX_AuditLog_EventId'
         Assert.Contains(rows, r => r.EventId == dbOldId);
         Assert.Contains(rows, r => r.EventId == dbRecentId);
     }
+
+    // ---------------------------------------------------------------------
+    // 5. SwitchOut_WithExplicitCommandTimeout_Succeeds (Task 4)
+    // ---------------------------------------------------------------------
+
+    /// <summary>
+    /// Task 4 (arch-review 04, S2): proves the explicit-<see cref="TimeSpan"/> maintenance-timeout
+    /// overload of <see cref="IAuditLogRepository.SwitchOutPartitionAsync"/> runs the real
+    /// drop-and-rebuild dance to completion against SQL Server — the old row is purged, the kept row
+    /// survives, and the returned sampled row-count reflects the switched partition. Exercising the
+    /// timeout path end-to-end guards against a regression that only sets the timeout on the sample
+    /// command and forgets the DDL batch (or vice versa).
+    /// </summary>
+    [SkippableFact]
+    public async Task SwitchOut_WithExplicitCommandTimeout_Succeeds()
+    {
+        Skip.IfNot(_fixture.Available, _fixture.SkipReason);
+
+        var siteId = "switch-timeout-" + Guid.NewGuid().ToString("N").Substring(0, 8);
+        var oldEventId = Guid.NewGuid();
+        var keptEventId = Guid.NewGuid();
+        var (oldOccurred, keptOccurred, _, _) = SeedOccurredAt();
+
+        await using (var seedConn = _fixture.OpenConnection())
+        {
+            await DirectInsertAsync(seedConn, oldEventId, oldOccurred, siteId);
+            await DirectInsertAsync(seedConn, keptEventId, keptOccurred, siteId);
+        }
+
+        var janBoundary = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+
+        await using (var ctx = CreateContext())
+        {
+            var repo = new AuditLogRepository(ctx);
+            var rowsDeleted = await repo.SwitchOutPartitionAsync(janBoundary, TimeSpan.FromMinutes(30));
+            Assert.True(rowsDeleted >= 1,
+                $"Expected the Jan-2026 partition switch-out to report >= 1 sampled row; got {rowsDeleted}.");
+        }
+
+        await using var verify = CreateContext();
+        var rows = await verify.Set<AuditLogRow>()
+            .Where(e => e.SourceSiteId == siteId)
+            .ToListAsync();
+        Assert.DoesNotContain(rows, r => r.EventId == oldEventId);
+        Assert.Contains(rows, r => r.EventId == keptEventId);
+
+        // The dance must leave the idempotency-supporting unique index rebuilt.
+        await using var check = _fixture.OpenConnection();
+        await AssertUxIndexExistsAsync(check);
+    }
 }