Deletes decided approval records past their retention TTL, ACROSS
TENANTS. Cron-owned TCB code — deliberately NOT a service method and NOT
reachable over HTTP: an unfiltered cross-tenant DELETE behind a role check
would be the same IDOR-shaped hole sweepSLA's doc comment describes for an
HTTP-reachable sweep. The distinct SystemApprovalStore parameter type
makes "cross-tenant deletes happen only inside the TCB" a compile-time
property, not a convention. Returns the number of deleted records.
Deletes decided approval records past their retention TTL, ACROSS TENANTS. Cron-owned TCB code — deliberately NOT a service method and NOT reachable over HTTP: an unfiltered cross-tenant DELETE behind a role check would be the same IDOR-shaped hole sweepSLA's doc comment describes for an HTTP-reachable sweep. The distinct SystemApprovalStore parameter type makes "cross-tenant deletes happen only inside the TCB" a compile-time property, not a convention. Returns the number of deleted records.