fix(management): purge terminal PendingSecuredWrites rows on the list sweep after a retention window (review 2026-10-21 08/G3)

docs/requirements/Component-ManagementService.md

@@ -172,6 +172,8 @@ The two-person authorization workflow for writes through the MxAccess Gateway. B
 
 **Server-side pending TTL (arch-review S2).** A `Pending` secured write is not valid indefinitely. Both `ApproveSecuredWriteCommand` and `RejectSecuredWriteCommand` call a shared `TryExpireIfStaleAsync` helper immediately after the `Pending`-status check: if the row's `SubmittedAtUtc` is older than the configured `SecuredWritePendingTtl` (`ManagementServiceOptions`, default **24 h**), the helper atomically transitions it `Pending → Expired` via `ISecuredWriteRepository.TryMarkExpiredAsync` (compare-and-swap — no verifier recorded, `VerifierUser` stays `NULL`), emits a best-effort `SecuredWriteExpire` audit row (system actor, `Discarded` status — the closest terminal `AuditStatus`), and the command fails with an "expired" error. A stale setpoint therefore can **never** be approved or executed days later, and no `WriteTagRequest` is relayed. A non-positive TTL disables expiry. `ListSecuredWritesCommand` additionally runs an **opportunistic sweep**: on every read it walks the returned page and calls the same helper for each `Pending` row, so overdue writes surface as `Expired` the next time anyone views the queue — no dedicated expiry-timer singleton is needed because the ManagementActor already runs on every central node and the CAS makes concurrent multi-node sweeps idempotent.
 
+**Terminal-row purge (review 2026-10-21 08/G3).** The same list sweep also purges decided/executed rows — `Approved`, `Rejected`, `Expired`, `Executed`, `Failed` — whose last lifecycle instant (`ExecutedAtUtc`, else `DecidedAtUtc`, else `SubmittedAtUtc`) is older than `SecuredWriteTerminalRetention` (default **90 days**), via `ISecuredWriteRepository.PurgeTerminalAsync` (bounded set-based delete, 1 000 rows per pass, so a backlog converges over successive passes). `Pending` rows are never purged — they expire first. The pass is throttled per node to once per `SecuredWriteTerminalPurgeInterval` (default 1 h), is idempotent across both central nodes, and is best-effort (a failure is logged and never fails the list). `PendingSecuredWrites` is operational state; the append-only `AuditLog` `SecuredWrite*` rows remain the lifecycle history after a purge. Previously no component deleted rows, so the table and the list's offset-paged scan grew forever.
+
 ### External Systems
 
 - **ListExternalSystems** / **GetExternalSystem**: Query external system definitions.
@@ -302,6 +304,8 @@ The ManagementActor receives the following services and repositories via DI (inj
 | `ScadaBridge:ManagementService` | `ManagementServiceOptions` | `CommandTimeout` (`TimeSpan`, default 30 s) — Ask timeout the HTTP endpoint applies when forwarding to the `ManagementActor`. A non-positive configured value falls back to the 30 s default. |
 | | | `LongRunningCommandTimeout` (`TimeSpan`, default 5 min) — Ask timeout applied to long-running commands (`ImportBundle`, `PreviewBundle`, `ExportBundle`, `MgmtDeployArtifacts`, `MgmtDeployInstance`, `MgmtDeploySite`); all other commands use `CommandTimeout`. A non-positive configured value falls back to the 5 min default. |
 | | | `SecuredWritePendingTtl` (`TimeSpan`, default 24 h) — age after which a `Pending` secured write is transitioned to `Expired` and can no longer be approved/executed; enforced at approve/reject and swept opportunistically on list. A non-positive value disables expiry (arch-review S2). |
+| | | `SecuredWriteTerminalRetention` (`TimeSpan`, default 90 days) — age (from the row's last lifecycle instant) after which an `Approved`/`Rejected`/`Expired`/`Executed`/`Failed` secured-write row is purged on the list sweep. A non-positive value disables the purge (review 2026-10-21 08/G3). |
+| | | `SecuredWriteTerminalPurgeInterval` (`TimeSpan`, default 1 h, must be ≥ 0) — minimum interval between purge passes on one node; zero purges on every list. |
 
 ## Dependencies