merge(r2): r2-plan04

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Configurations/SiteCallEntityTypeConfiguration.cs

@@ -97,5 +97,14 @@ public class SiteCallEntityTypeConfiguration : IEntityTypeConfiguration<SiteCall
             .HasDatabaseName("IX_SiteCalls_NonTerminal")
             .HasFilter("[TerminalAtUtc] IS NULL")
             .IncludeProperties(nameof(SiteCall.SourceSite), nameof(SiteCall.SourceNode), nameof(SiteCall.Status));
+
+        // Terminal backs the daily retention purge's predicate (TerminalAtUtc IS NOT NULL
+        // AND TerminalAtUtc < cutoff) and Task 11's MIN() slice anchor: filtered to the
+        // terminal population so the purge seeks the expired tail instead of full-scanning
+        // the 365-day table (arch-review 04 round 2, R6). Complements IX_SiteCalls_NonTerminal,
+        // which is filtered to IS NULL and unusable for this predicate.
+        builder.HasIndex(s => s.TerminalAtUtc)
+            .HasDatabaseName("IX_SiteCalls_Terminal")
+            .HasFilter("[TerminalAtUtc] IS NOT NULL");
     }
 }

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Migrations/20260713142234_AddSiteCallsTerminalIndex.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSiteCallsTerminalIndex : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateIndex(
+                name: "IX_SiteCalls_Terminal",
+                table: "SiteCalls",
+                column: "TerminalAtUtc",
+                filter: "[TerminalAtUtc] IS NOT NULL");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_SiteCalls_Terminal",
+                table: "SiteCalls");
+        }
+    }
+}

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Migrations/ScadaBridgeDbContextModelSnapshot.cs

@@ -167,6 +167,10 @@ namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations
 
                     SqlServerIndexBuilderExtensions.IncludeProperties(b.HasIndex("CreatedAtUtc"), new[] { "SourceSite", "SourceNode", "Status" });
 
+                    b.HasIndex("TerminalAtUtc")
+                        .HasDatabaseName("IX_SiteCalls_Terminal")
+                        .HasFilter("[TerminalAtUtc] IS NOT NULL");
+
                     b.HasIndex("SourceSite", "CreatedAtUtc")
                         .IsDescending(false, true)
                         .HasDatabaseName("IX_SiteCalls_Source_Created");

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/KpiHistoryRepository.cs

@@ -1,4 +1,6 @@
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
 using ZB.MOM.WW.ScadaBridge.Commons.Entities.Kpi;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Kpi;
@@ -13,14 +15,22 @@ namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories;
 public sealed class KpiHistoryRepository : IKpiHistoryRepository
 {
     private readonly ScadaBridgeDbContext _context;
+    private readonly ILogger<KpiHistoryRepository> _logger;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="KpiHistoryRepository"/> class.
     /// </summary>
     /// <param name="context">The EF Core database context.</param>
-    public KpiHistoryRepository(ScadaBridgeDbContext context)
+    /// <param name="logger">
+    /// Optional logger; defaults to <see cref="NullLogger{T}"/> (mirrors
+    /// <c>SiteCallAuditRepository</c> — MS.DI resolves <see cref="ILogger{T}"/> automatically,
+    /// so no registration churn). Used to classify the self-healing failover fold-race.
+    /// </param>
+    public KpiHistoryRepository(
+        ScadaBridgeDbContext context, ILogger<KpiHistoryRepository>? logger = null)
     {
         _context = context ?? throw new ArgumentNullException(nameof(context));
+        _logger = logger ?? NullLogger<KpiHistoryRepository>.Instance;
     }
 
     /// <inheritdoc />
@@ -101,8 +111,14 @@ public sealed class KpiHistoryRepository : IKpiHistoryRepository
         // fetch it and group IN MEMORY. This deliberately avoids provider-specific
         // DATEADD/DATEPART hour-truncation translation (SQLite in tests, SQL Server in prod),
         // keeping the hour-bucket arithmetic identical across providers and trivially correct.
+        // Projected, untracked fetch: the fold only reads these six fields and never
+        // mutates a KpiSample. A tracked ToListAsync registered ~5k-90k read-only
+        // entities in the change tracker per healthy 3h fold — all re-scanned by
+        // DetectChanges on the final SaveChanges (arch-review 04 round 2, R2). A
+        // projection is inherently untracked and materializes no entity at all.
         var samples = await _context.KpiSamples
             .Where(s => s.CapturedAtUtc >= from && s.CapturedAtUtc < to)
+            .Select(s => new FoldSample(s.Source, s.Metric, s.Scope, s.ScopeKey, s.CapturedAtUtc, s.Value))
             .ToListAsync(cancellationToken);
         if (samples.Count == 0)
         {
@@ -164,7 +180,22 @@ public sealed class KpiHistoryRepository : IKpiHistoryRepository
             }
         }
 
-        await _context.SaveChangesAsync(cancellationToken);
+        try
+        {
+            await _context.SaveChangesAsync(cancellationToken);
+        }
+        catch (DbUpdateException ex)
+        {
+            // Failover-overlap race: the old singleton incarnation's in-flight fold and the
+            // new node's first fold can both Add the same (series, hour) row; the unique
+            // IX_KpiRollupHourly_Series then faults the loser's ENTIRE SaveChanges — the
+            // failure grain is the PASS, not the row (arch-review 04 round 2, R5). The fold
+            // only ever writes KpiRollupHourly rows, so any save fault here is a lost upsert
+            // race or a transient the next idempotent re-fold repairs identically; classify
+            // at Information instead of surfacing a scary error for a self-healing no-op.
+            _logger.LogInformation(ex,
+                "KPI rollup fold lost a failover-overlap upsert race; pass discarded, next fold self-heals.");
+        }
     }
 
     /// <inheritdoc />
@@ -186,6 +217,15 @@ public sealed class KpiHistoryRepository : IKpiHistoryRepository
             .ToListAsync(cancellationToken);
     }
 
+    /// <inheritdoc />
+    public async Task<DateTime?> GetLatestRollupHourAsync(CancellationToken cancellationToken = default)
+    {
+        // Single MAX over the unique IX_KpiRollupHourly_Series population (the rollup
+        // table is small — one row per series-hour). Null when no rollups exist.
+        return await _context.KpiRollupHourly
+            .MaxAsync(r => (DateTime?)r.HourStartUtc, cancellationToken);
+    }
+
     /// <inheritdoc />
     public async Task PurgeRollupsOlderThanAsync(DateTime before, CancellationToken cancellationToken = default)
     {
@@ -212,4 +252,8 @@ public sealed class KpiHistoryRepository : IKpiHistoryRepository
     /// <summary>In-memory grouping key: one KPI series (four-tuple) within one UTC hour.</summary>
     private readonly record struct SeriesHourKey(
         string Source, string Metric, string Scope, string? ScopeKey, DateTime HourStartUtc);
+
+    /// <summary>Narrow, untracked projection of one KpiSample row for the fold (R2).</summary>
+    private readonly record struct FoldSample(
+        string Source, string Metric, string Scope, string? ScopeKey, DateTime CapturedAtUtc, double Value);
 }

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SiteCallAuditRepository.cs

@@ -246,9 +246,29 @@ OPTION (RECOMPILE);";
     /// <inheritdoc />
     public async Task<int> PurgeTerminalAsync(DateTime olderThanUtc, CancellationToken ct = default)
     {
-        return await _context.Database.ExecuteSqlInterpolatedAsync(
-            $"DELETE FROM dbo.SiteCalls WHERE TerminalAtUtc IS NOT NULL AND TerminalAtUtc < {olderThanUtc};",
-            ct);
+        // Time-sliced batches (arch-review 04 round 2, R6 — the one maintenance DELETE
+        // that missed round 1's batching pass): each DELETE covers at most one DAY of
+        // terminal rows, capping the lock/log footprint per statement. Steady state
+        // (daily purge, 365-day retention) is a single slice; only catch-up after an
+        // outage runs several. One-day (not one-hour) slices are proportionate to
+        // SiteCalls volume, which is far below KpiSample's. The MIN() anchor and the
+        // DELETE predicate both seek IX_SiteCalls_Terminal (filtered IS NOT NULL).
+        var total = 0;
+        var floor = await _context.SiteCalls
+            .Where(s => s.TerminalAtUtc != null && s.TerminalAtUtc < olderThanUtc)
+            .MinAsync(s => s.TerminalAtUtc, ct);
+        while (floor is not null && floor < olderThanUtc)
+        {
+            var ceiling = floor.Value.AddDays(1) < olderThanUtc ? floor.Value.AddDays(1) : olderThanUtc;
+            total += await _context.Database.ExecuteSqlInterpolatedAsync(
+                $"DELETE FROM dbo.SiteCalls WHERE TerminalAtUtc IS NOT NULL AND TerminalAtUtc < {ceiling};",
+                ct);
+            floor = await _context.SiteCalls
+                .Where(s => s.TerminalAtUtc != null && s.TerminalAtUtc < olderThanUtc)
+                .MinAsync(s => s.TerminalAtUtc, ct);
+        }
+
+        return total;
     }
 
     // Terminal status string literals for the interval-throughput KPIs. The