Resolve all high-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Services/IConfigurationCommandTransaction.cs

@@ -0,0 +1,22 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+
+/// <summary>Executes one database-only configuration command and its audit rows atomically.</summary>
+public interface IConfigurationCommandTransaction
+{
+    /// <summary>Each database retry supplies a fresh scope; the operation must not perform external side effects.</summary>
+    Task<object?> ExecuteAsync(Func<IServiceProvider, Task<object?>> operation);
+}
+
+/// <summary>Defers local cache/channel maintenance until a configuration commit succeeds.</summary>
+public interface IConfigurationCommitActions
+{
+    /// <summary>Queues an idempotent local maintenance action.</summary>
+    void Add(Func<Task> action);
+}
+
+/// <summary>Evicts a circuit's tracked read entities after a separately scoped configuration command.</summary>
+public interface IConfigurationReadSession
+{
+    /// <summary>Clears stale tracked read state; form drafts must be held separately.</summary>
+    void Reset();
+}

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/DatabaseConnectionDefCommands.cs

@@ -2,9 +2,9 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 
 public record ListDatabaseConnectionsCommand;
 public record GetDatabaseConnectionCommand(int DatabaseConnectionId);
-public record CreateDatabaseConnectionDefCommand(string Name, string ConnectionString);
+public record CreateDatabaseConnectionDefCommand(string Name, string ConnectionString, int? MaxRetries = null, TimeSpan? RetryDelay = null);
 // ConnectionString is nullable (arch-review C3): an omitted (null) value preserves
 // the stored secret rather than wiping it — the connection string is elided from
 // List/Get responses, so a round-trip must not require re-sending it.
-public record UpdateDatabaseConnectionDefCommand(int DatabaseConnectionId, string Name, string? ConnectionString);
+public record UpdateDatabaseConnectionDefCommand(int DatabaseConnectionId, string Name, string? ConnectionString, int? MaxRetries = null, TimeSpan? RetryDelay = null);
 public record DeleteDatabaseConnectionDefCommand(int DatabaseConnectionId);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/InstanceCommands.cs

@@ -85,3 +85,6 @@ public record NativeAlarmSourceOverrideEntry(
 public record SetInstanceNativeAlarmSourceOverridesCommand(
     int InstanceId,
     IReadOnlyList<NativeAlarmSourceOverrideEntry> Overrides);
+
+/// <summary>Removes an attribute override so the inherited value is used again.</summary>
+public record DeleteInstanceAttributeOverrideCommand(int InstanceId, string AttributeName);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/NotificationCommands.cs

@@ -14,4 +14,17 @@ public record UpdateSmtpConfigCommand(int SmtpConfigId, string Server, int Port,
 public record ListSmsConfigsCommand;
 // FromNumber is optional: a Twilio Messaging-Service-only config supplies MessagingServiceSid
 // instead. At-least-one-of (FromNumber, MessagingServiceSid) is validated at the CLI/UI boundary.
-public record UpdateSmsConfigCommand(int SmsConfigId, string AccountSid, string? FromNumber, string? MessagingServiceSid = null, string? ApiBaseUrl = null, string? AuthToken = null);
+public record UpdateSmsConfigCommand(int SmsConfigId, string AccountSid, string? FromNumber, string? MessagingServiceSid = null, string? ApiBaseUrl = null, string? AuthToken = null, int? ConnectionTimeoutSeconds = null, int? MaxRetries = null, TimeSpan? RetryDelay = null);
+
+/// <summary>Renames a list without replacing its named recipients.</summary>
+public record RenameNotificationListCommand(int NotificationListId, string Name);
+/// <summary>Adds a named recipient matching the owning list's channel.</summary>
+public record AddNotificationRecipientCommand(int NotificationListId, string Name, string? EmailAddress, string? PhoneNumber);
+/// <summary>Deletes one recipient without rewriting unrelated list membership.</summary>
+public record DeleteNotificationRecipientCommand(int RecipientId);
+/// <summary>Creates an email configuration using the update path's validation and secret projection.</summary>
+public record CreateSmtpConfigCommand(string Server, int Port, string AuthMode, string FromAddress, string? TlsMode = null, string? Credentials = null, string? OAuth2Authority = null, string? OAuth2Scope = null, string? Transport = null)
+    : UpdateSmtpConfigCommand(0, Server, Port, AuthMode, FromAddress, TlsMode, Credentials, OAuth2Authority, OAuth2Scope, Transport);
+/// <summary>Creates an SMS configuration using the same validation as updates.</summary>
+public record CreateSmsConfigCommand(string AccountSid, string? FromNumber, string? MessagingServiceSid = null, string? ApiBaseUrl = null, string? AuthToken = null, int? ConnectionTimeoutSeconds = null, int? MaxRetries = null, TimeSpan? RetryDelay = null)
+    : UpdateSmsConfigCommand(0, AccountSid, FromNumber, MessagingServiceSid, ApiBaseUrl, AuthToken, ConnectionTimeoutSeconds, MaxRetries, RetryDelay);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Notification/NotificationMessages.cs

@@ -54,7 +54,8 @@ public record NotificationSubmitAck(
 /// </summary>
 public record NotificationStatusQuery(
     string CorrelationId,
-    string NotificationId);
+    string NotificationId,
+    string? VerifiedSourceSiteId = null);
 
 /// <summary>
 /// Central -> Site: response carrying the current delivery status for a queried notification.

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Alarms/NativeAlarmTransition.cs

@@ -30,6 +30,8 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Alarms;
 /// transition time the DCL OBSERVED the ack at (MxAccess Gateway). Non-null only while the
 /// condition is active AND acknowledged, so a re-raise (which arrives unacknowledged) clears it.
 /// </param>
+/// <param name="SnapshotSourceReference">Exact feed binding for a scoped snapshot, including empty for the OPC UA Server feed; null means connection-wide legacy framing.</param>
+/// <param name="SnapshotId">Refresh epoch shared by start, entries and end; null preserves legacy snapshot framing.</param>
 public record NativeAlarmTransition(
     string SourceReference,
     string SourceObjectReference,
@@ -45,4 +47,6 @@ public record NativeAlarmTransition(
     DateTimeOffset TransitionTime,
     string CurrentValue,
     string LimitValue,
-    DateTimeOffset? AckTime = null);
+    DateTimeOffset? AckTime = null,
+    string? SnapshotSourceReference = null,
+    Guid? SnapshotId = null);

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Enums/AlarmTransitionKind.cs

@@ -14,5 +14,7 @@ public enum AlarmTransitionKind
     Acknowledge,
     Clear,
     Retrigger,
-    StateChange
+    StateChange,
+    /// <summary>Begins a source-scoped refresh epoch; appended to preserve existing wire values.</summary>
+    SnapshotStart
 }