fix(notifications): list sort index + CAS operator Retry/Discard (P5-3, P5-4)

P5-3: add IX_Notifications_Created_NotificationId (CreatedAt DESC,
NotificationId DESC) — the Central UI Notification Outbox list page sorts on
exactly that pair, but no existing index leads unconditionally on CreatedAt,
so an unfiltered/lightly filtered page fell back to a full clustered-index
scan + sort on every COUNT + page request. Mirrors the Medium wave's
IX_SiteCalls_Created_TrackedOperationId migration + SQL twin pattern
faithfully, including the handwritten docs/plans/sql script.

P5-4: operator Retry/Discard was read-check-write keyed on NotificationId
only — a detached PipeTo task interleaving with the dispatcher's own write
(or a second concurrent operator action) could land between the read and
the write and get silently clobbered by the unconditional UpdateAsync,
stamping a Delivered row Discarded with stale fields. Adds
INotificationOutboxRepository.TryUpdateFromParkedAsync, a single-statement
compare-and-swap (WHERE Status == Parked) mirroring
SecuredWriteRepository.TryMarkApprovedAsync's CAS shape. NotificationOutboxActor's
RetryAsync/DiscardAsync now use the CAS write and, on a lost race, re-read
to report "notification already progressed to <Status>" instead of silently
overwriting whatever is there now.

Proof of failure: reverting only the actor's CAS usage while keeping the
repository addition reproduces the silent-overwrite bug — 7 tests fail,
including two new deterministic (non-sleep) race-proof tests that mock the
exact GetByIdAsync -> lost-CAS -> re-read sequence the finding describes.
P5-3 is perf-only; verified via migration/SQL-twin parity instead (no
runtime proof-of-failure is meaningful for an index).

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/INotificationOutboxRepository.cs

@@ -1,4 +1,5 @@
 using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Notifications;
 
 namespace ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
@@ -83,6 +84,43 @@ public interface INotificationOutboxRepository
     /// </returns>
     Task<bool> UpdateAsync(Notification n, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Compare-and-swap variant of <see cref="UpdateAsync"/> for the operator
+    /// Retry/Discard one-shots: persists <paramref name="n"/>'s delivery-state
+    /// columns (same narrow column set as <see cref="UpdateAsync"/>) ONLY if the
+    /// row's current <c>Status</c> in the database is still
+    /// <see cref="NotificationStatus.Parked"/>. Commits internally — this call
+    /// is its own transaction.
+    /// </summary>
+    /// <remarks>
+    /// <b>Why this exists (arch-review 2026-08-19 P5-4).</b> The operator retry/
+    /// discard handlers are read-check-write across two round trips:
+    /// <see cref="GetByIdAsync"/> reads the row, the handler checks its
+    /// in-memory <c>Status</c>, then a write persists the transition. A detached
+    /// <c>PipeTo</c> task can interleave with the dispatcher's own write (or a
+    /// second concurrent operator action) between those two round trips, so the
+    /// in-memory check is a fast-path rejection, not a correctness guard — a
+    /// blind <see cref="UpdateAsync"/> in that window can stamp a row that has
+    /// already moved on (e.g. the dispatcher delivered it) with the operator's
+    /// stale fields, silently overwriting a <c>Delivered</c> row as
+    /// <c>Discarded</c>. The <c>WHERE Status = Parked</c> predicate below makes
+    /// the <c>Parked-&gt;(Pending|Discarded)</c> transition atomic at the row
+    /// level, mirroring <c>SecuredWriteRepository.TryMarkApprovedAsync</c>'s
+    /// single-statement compare-and-swap. A row that has already progressed
+    /// (dispatcher won the race, or a second operator action won it) and a row
+    /// that has vanished (retention purge) both report zero rows affected;
+    /// callers cannot tell those apart from the return value alone and must
+    /// re-read to report which honestly.
+    /// </remarks>
+    /// <param name="n">The notification whose delivery state should be persisted, if still Parked.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns>
+    /// <see langword="true"/> when a row with that <c>NotificationId</c> was
+    /// found with <c>Status == Parked</c> and its delivery state was persisted;
+    /// <see langword="false"/> otherwise (not found, or no longer Parked).
+    /// </returns>
+    Task<bool> TryUpdateFromParkedAsync(Notification n, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Returns a page of notifications matching <paramref name="filter"/>, ordered by
     /// <c>CreatedAt</c> descending, together with the total matching count.

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Configurations/NotificationOutboxConfiguration.cs

@@ -83,5 +83,23 @@ public class NotificationOutboxConfiguration : IEntityTypeConfiguration<Notifica
         builder.HasIndex(n => n.DeliveredAt)
             .HasDatabaseName("IX_Notifications_Delivered")
             .HasFilter("[Status] = 'Delivered'");
+
+        // Created_NotificationId backs the Central UI Notification Outbox list
+        // page's sort key — NotificationOutboxRepository.QueryAsync orders
+        // (CreatedAt DESC, NotificationId DESC) (NotificationId breaks CreatedAt
+        // ties for deterministic OFFSET paging). None of the indexes above lead
+        // unconditionally on CreatedAt: Status_NextAttemptAt requires an equality
+        // on Status first, SourceSiteId_CreatedAt requires an equality on
+        // SourceSiteId first, and IX_Notifications_Delivered is filtered to
+        // Status='Delivered' only. So an unfiltered (or lightly filtered) page
+        // fell back to a full clustered-index scan + sort on every COUNT + page
+        // request (arch-review 2026-08-19 P5-3, register row-35 class). With both
+        // key columns descending, a forward scan of this index already delivers
+        // rows in the requested order. Exact mirror of
+        // SiteCallEntityTypeConfiguration's IX_SiteCalls_Created_TrackedOperationId
+        // (2026-08-19, arch-review P5-2).
+        builder.HasIndex(n => new { n.CreatedAt, n.NotificationId })
+            .IsDescending(true, true)
+            .HasDatabaseName("IX_Notifications_Created_NotificationId");
     }
 }

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Migrations/20260819201210_AddNotificationsListSortIndex.cs

@@ -0,0 +1,46 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations
+{
+    /// <summary>
+    /// Adds <c>IX_Notifications_Created_NotificationId (CreatedAt DESC,
+    /// NotificationId DESC)</c> — arch-review 2026-08-19 P5-3, register
+    /// row-35 class.
+    /// </summary>
+    /// <remarks>
+    /// <see cref="ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories.NotificationOutboxRepository.QueryAsync"/>
+    /// orders <c>(CreatedAt DESC, NotificationId DESC)</c> for the Central UI
+    /// Notification Outbox list page. None of the existing Notifications indexes
+    /// lead unconditionally on <c>CreatedAt</c> — <c>IX_Notifications_Status_NextAttemptAt</c>
+    /// requires an equality on <c>Status</c> first, <c>IX_Notifications_SourceSiteId_CreatedAt</c>
+    /// requires an equality on <c>SourceSiteId</c> first, and
+    /// <c>IX_Notifications_Delivered</c> is filtered to <c>Status = 'Delivered'</c>
+    /// only — so an unfiltered (or lightly filtered) list page fell back to a full
+    /// clustered-index scan + sort on every COUNT + page request. With both key
+    /// columns descending, a forward scan of this index already delivers rows in
+    /// the requested order. See <c>docs/plans/sql/AddNotificationsListSortIndex.sql</c>
+    /// for the handwritten production-parity script.
+    /// </remarks>
+    public partial class AddNotificationsListSortIndex : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateIndex(
+                name: "IX_Notifications_Created_NotificationId",
+                table: "Notifications",
+                columns: new[] { "CreatedAt", "NotificationId" },
+                descending: new bool[0]);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_Notifications_Created_NotificationId",
+                table: "Notifications");
+        }
+    }
+}

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Migrations/ScadaBridgeDbContextModelSnapshot.cs

@@ -913,6 +913,10 @@ namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations
                         .HasDatabaseName("IX_Notifications_Delivered")
                         .HasFilter("[Status] = 'Delivered'");
 
+                    b.HasIndex("CreatedAt", "NotificationId")
+                        .IsDescending()
+                        .HasDatabaseName("IX_Notifications_Created_NotificationId");
+
                     b.HasIndex("SourceSiteId", "CreatedAt");
 
                     b.HasIndex("Status", "NextAttemptAt");

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/NotificationOutboxRepository.cs

@@ -205,6 +205,48 @@ VALUES
         return rowsAffected > 0;
     }
 
+    /// <inheritdoc />
+    public async Task<bool> TryUpdateFromParkedAsync(Notification n, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(n);
+
+        // Same seven mutable delivery-state columns as UpdateAsync, but the WHERE
+        // clause below ALSO requires the row's current Status to still be Parked
+        // -- a single-statement compare-and-swap (arch-review 2026-08-19 P5-4).
+        // Two round trips (GetByIdAsync then this write) with a status check in
+        // between is not a correctness guard by itself: a detached PipeTo task
+        // can race the dispatcher's own write (or a second concurrent operator
+        // action) in that window. Mirrors SecuredWriteRepository.TryMarkApprovedAsync's
+        // conditional ExecuteUpdate/ExecuteSql pattern, expressed via LINQ
+        // ExecuteUpdateAsync (like UpdateAsync above) so this stays portable
+        // across the SQL Server production provider and the SQLite provider the
+        // repository tests run against.
+        var status = n.Status;
+        var retryCount = n.RetryCount;
+        var lastError = n.LastError;
+        var resolvedTargets = n.ResolvedTargets;
+        var lastAttemptAt = n.LastAttemptAt;
+        var nextAttemptAt = n.NextAttemptAt;
+        var deliveredAt = n.DeliveredAt;
+
+        var notificationId = n.NotificationId;
+
+        var rowsAffected = await _context.Notifications
+            .Where(row => row.NotificationId == notificationId && row.Status == NotificationStatus.Parked)
+            .ExecuteUpdateAsync(
+                setters => setters
+                    .SetProperty(row => row.Status, status)
+                    .SetProperty(row => row.RetryCount, retryCount)
+                    .SetProperty(row => row.LastError, lastError)
+                    .SetProperty(row => row.ResolvedTargets, resolvedTargets)
+                    .SetProperty(row => row.LastAttemptAt, lastAttemptAt)
+                    .SetProperty(row => row.NextAttemptAt, nextAttemptAt)
+                    .SetProperty(row => row.DeliveredAt, deliveredAt),
+                cancellationToken);
+
+        return rowsAffected > 0;
+    }
+
     /// <inheritdoc />
     public async Task<Notification?> GetByIdAsync(string notificationId, CancellationToken cancellationToken = default)
     {

src/ZB.MOM.WW.ScadaBridge.NotificationOutbox/NotificationOutboxActor.cs

@@ -1109,14 +1109,25 @@ public class NotificationOutboxActor : ReceiveActor, IWithTimers
         notification.NextAttemptAt = null;
         notification.LastError = null;
 
-        // Zero rows updated means the row was purged between the read above and
-        // this write. Answer the operator honestly instead of reporting a
-        // re-queue that never happened — and emit no un-park audit row, because
-        // there is nothing to attribute it to.
-        if (!await repository.UpdateAsync(notification))
+        // Compare-and-swap on Status == Parked (arch-review 2026-08-19 P5-4). The
+        // read above and this write are two separate round trips; a detached
+        // PipeTo task can race the dispatcher's own write (or a second
+        // concurrent operator action) in between, so the in-memory check above
+        // is a fast-path rejection, not the correctness guard — a blind
+        // UpdateAsync here could stamp a row that has already moved on (e.g. the
+        // dispatcher delivered it) back to Pending with stale fields. A lost CAS
+        // means either the row vanished (purge) or it progressed past Parked
+        // under us; re-read to report which honestly instead of silently
+        // overwriting whatever is there now, and emit no un-park audit row in
+        // either case, because there is nothing to attribute it to.
+        if (!await repository.TryUpdateFromParkedAsync(notification))
         {
+            var current = await repository.GetByIdAsync(request.NotificationId);
             return new RetryNotificationResponse(
-                request.CorrelationId, Success: false, ErrorMessage: "notification not found");
+                request.CorrelationId, Success: false,
+                ErrorMessage: current is null
+                    ? "notification not found"
+                    : $"notification already progressed to {current.Status}; retry not applied");
         }
 
         // Operator re-queued a parked notification. Emit a Submitted NotifyDeliver
@@ -1190,13 +1201,22 @@ public class NotificationOutboxActor : ReceiveActor, IWithTimers
 
         notification.Status = NotificationStatus.Discarded;
 
-        // Same vanished-row honesty as the retry path: a purge between the read
-        // and the write leaves nothing to discard, so report not-found rather
-        // than success (and skip the terminal audit row below).
-        if (!await repository.UpdateAsync(notification))
+        // Same compare-and-swap on Status == Parked as the retry path (arch-review
+        // 2026-08-19 P5-4): a purge between the read and the write leaves nothing
+        // to discard, and a dispatcher/other-operator write landing in that same
+        // window (e.g. a delivery succeeding) must not be silently clobbered by a
+        // blind write of this stale in-memory copy. Re-read on a lost CAS to
+        // report which case it was, and skip the terminal audit row below either
+        // way — there is nothing to attribute a discard of a row that was never
+        // actually discarded.
+        if (!await repository.TryUpdateFromParkedAsync(notification))
         {
+            var current = await repository.GetByIdAsync(request.NotificationId);
             return new DiscardNotificationResponse(
-                request.CorrelationId, Success: false, ErrorMessage: "notification not found");
+                request.CorrelationId, Success: false,
+                ErrorMessage: current is null
+                    ? "notification not found"
+                    : $"notification already progressed to {current.Status}; discard not applied");
         }
 
         // A manual discard is the OTHER code path that produces