Optionalfilter: ApprovalListFilterDeletes TERMINAL (approved/rejected) records whose terminal timestamp —
decidedAt, or updatedAt when a decided record was persisted without one
— is strictly before cutoffIso, bounded to at most limit deletions.
The retention-purge primitive behind purgeExpiredApprovals
(retention.ts) — cron-only by type, exactly like list/transition: a
tenant-bound store never gains this method.
The cron-only cross-tenant view (SLA sweep). Deliberately NOT an ApprovalStore (no create/get) and NOT brandable (
[TENANT_BOUND]?: never), so it is unassignable wherever a TenantBoundApprovalStore is required — "system stores never reach a request handler" is a compile error, not a convention.