fix(management): purge terminal PendingSecuredWrites rows on the list sweep after a retention window (review 2026-10-21 08/G3)

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SecuredWriteRepository.cs

@@ -188,4 +188,25 @@ WHERE Id = {id}
 
         return await query.CountAsync(ct);
     }
+
+    /// <inheritdoc />
+    public async Task<int> PurgeTerminalAsync(DateTime olderThanUtc, int batchSize, CancellationToken ct = default)
+    {
+        if (batchSize <= 0)
+        {
+            return 0;
+        }
+
+        // Bounded set-based delete (DELETE ... WHERE Id IN (SELECT TOP(n) ...)): never a
+        // whole-table delete in one statement, so a first purge of a long-lived table cannot
+        // hold a large lock. Pending is excluded — it is expired first, then purged later.
+        return await _context.Set<PendingSecuredWrite>()
+            .Where(p => TerminalStatuses.Contains(p.Status)
+                && (p.ExecutedAtUtc ?? p.DecidedAtUtc ?? p.SubmittedAtUtc) < olderThanUtc)
+            .OrderBy(p => p.Id)
+            .Take(batchSize)
+            .ExecuteDeleteAsync(ct);
+    }
+
+    private static readonly string[] TerminalStatuses = ["Approved", "Rejected", "Expired", "Executed", "Failed"];
 }