fix(notifications): list sort index + CAS operator Retry/Discard (P5-3, P5-4)

P5-3: add IX_Notifications_Created_NotificationId (CreatedAt DESC,
NotificationId DESC) — the Central UI Notification Outbox list page sorts on
exactly that pair, but no existing index leads unconditionally on CreatedAt,
so an unfiltered/lightly filtered page fell back to a full clustered-index
scan + sort on every COUNT + page request. Mirrors the Medium wave's
IX_SiteCalls_Created_TrackedOperationId migration + SQL twin pattern
faithfully, including the handwritten docs/plans/sql script.

P5-4: operator Retry/Discard was read-check-write keyed on NotificationId
only — a detached PipeTo task interleaving with the dispatcher's own write
(or a second concurrent operator action) could land between the read and
the write and get silently clobbered by the unconditional UpdateAsync,
stamping a Delivered row Discarded with stale fields. Adds
INotificationOutboxRepository.TryUpdateFromParkedAsync, a single-statement
compare-and-swap (WHERE Status == Parked) mirroring
SecuredWriteRepository.TryMarkApprovedAsync's CAS shape. NotificationOutboxActor's
RetryAsync/DiscardAsync now use the CAS write and, on a lost race, re-read
to report "notification already progressed to <Status>" instead of silently
overwriting whatever is there now.

Proof of failure: reverting only the actor's CAS usage while keeping the
repository addition reproduces the silent-overwrite bug — 7 tests fail,
including two new deterministic (non-sleep) race-proof tests that mock the
exact GetByIdAsync -> lost-CAS -> re-read sequence the finding describes.
P5-3 is perf-only; verified via migration/SQL-twin parity instead (no
runtime proof-of-failure is meaningful for an index).

tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/RepositoryCoverageTests.cs

@@ -573,6 +573,154 @@ public class NotificationOutboxRepositoryTests : IDisposable
         Assert.False(await _repository.UpdateAsync(loaded));
     }
 
+    [Fact]
+    public async Task TryUpdateFromParkedAsync_StatusIsParked_UpdatesAndReturnsTrue()
+    {
+        var id = Guid.NewGuid().ToString();
+        _context.Notifications.Add(MakeNotification(id, NotificationStatus.Parked));
+        await _context.SaveChangesAsync();
+        _context.ChangeTracker.Clear();
+
+        var loaded = await _repository.GetByIdAsync(id);
+        loaded!.Status = NotificationStatus.Pending;
+        loaded.RetryCount = 0;
+        loaded.NextAttemptAt = null;
+        loaded.LastError = null;
+        Assert.True(await _repository.TryUpdateFromParkedAsync(loaded));
+
+        _context.ChangeTracker.Clear();
+        var reloaded = await _context.Notifications.FindAsync(id);
+        Assert.Equal(NotificationStatus.Pending, reloaded!.Status);
+    }
+
+    /// <summary>
+    /// Direct CAS-miss: the row is currently Delivered (never Parked in this
+    /// scenario), so the conditional WHERE Status == Parked matches nothing and
+    /// the row is left completely untouched — arch-review 2026-08-19 P5-4.
+    /// </summary>
+    [Fact]
+    public async Task TryUpdateFromParkedAsync_StatusIsNotParked_ReturnsFalse_AndLeavesRowUnchanged()
+    {
+        var id = Guid.NewGuid().ToString();
+        var deliveredAt = new DateTimeOffset(2026, 5, 19, 9, 0, 0, TimeSpan.Zero);
+        _context.Notifications.Add(MakeNotification(
+            id, NotificationStatus.Delivered, deliveredAt: deliveredAt));
+        await _context.SaveChangesAsync();
+        _context.ChangeTracker.Clear();
+
+        var staleDiscard = MakeNotification(id, NotificationStatus.Discarded);
+        Assert.False(await _repository.TryUpdateFromParkedAsync(staleDiscard));
+
+        _context.ChangeTracker.Clear();
+        var reloaded = await _context.Notifications.FindAsync(id);
+        Assert.Equal(NotificationStatus.Delivered, reloaded!.Status);
+        Assert.Equal(deliveredAt, reloaded.DeliveredAt);
+    }
+
+    [Fact]
+    public async Task TryUpdateFromParkedAsync_RowPurgedBeforeWrite_ReturnsFalse()
+    {
+        var id = Guid.NewGuid().ToString();
+        _context.Notifications.Add(MakeNotification(id, NotificationStatus.Parked));
+        await _context.SaveChangesAsync();
+        _context.ChangeTracker.Clear();
+
+        var loaded = await _repository.GetByIdAsync(id);
+        Assert.NotNull(loaded);
+
+        await _context.Notifications.Where(n => n.NotificationId == id).ExecuteDeleteAsync();
+        _context.ChangeTracker.Clear();
+
+        loaded!.Status = NotificationStatus.Discarded;
+        Assert.False(await _repository.TryUpdateFromParkedAsync(loaded));
+    }
+
+    /// <summary>
+    /// Deterministic (non-sleep) proof of the arch-review 2026-08-19 P5-4 race:
+    /// the operator reads a Parked row, but before its write lands the
+    /// dispatcher (or a concurrent second operator action) has already moved
+    /// the row to Delivered. <see cref="TryUpdateFromParkedAsync"/>'s CAS must
+    /// refuse the stale write and leave the Delivered row exactly as it is.
+    /// The companion fact below proves the general-purpose
+    /// <see cref="NotificationOutboxRepository.UpdateAsync"/> — the method the
+    /// operator path used PRE-FIX — has no such guard, which is the mechanism
+    /// the finding describes.
+    /// </summary>
+    [Fact]
+    public async Task TryUpdateFromParkedAsync_ConcurrentlyDelivered_ReturnsFalse_AndDoesNotOverwrite()
+    {
+        var id = Guid.NewGuid().ToString();
+        _context.Notifications.Add(MakeNotification(id, NotificationStatus.Parked));
+        await _context.SaveChangesAsync();
+        _context.ChangeTracker.Clear();
+
+        // The operator's read (this snapshot is carried forward stale below).
+        var operatorRead = await _repository.GetByIdAsync(id);
+        Assert.NotNull(operatorRead);
+
+        // The dispatcher's own write lands first, in the window between the
+        // operator's read and write.
+        var deliveredAt = new DateTimeOffset(2026, 5, 19, 9, 0, 0, TimeSpan.Zero);
+        var dispatcherRead = await _repository.GetByIdAsync(id);
+        dispatcherRead!.Status = NotificationStatus.Delivered;
+        dispatcherRead.DeliveredAt = deliveredAt;
+        Assert.True(await _repository.UpdateAsync(dispatcherRead));
+        _context.ChangeTracker.Clear();
+
+        // The operator's stale in-memory copy still says Parked; it attempts a Discard.
+        operatorRead!.Status = NotificationStatus.Discarded;
+        Assert.False(await _repository.TryUpdateFromParkedAsync(operatorRead));
+
+        _context.ChangeTracker.Clear();
+        var reloaded = await _context.Notifications.FindAsync(id);
+        Assert.Equal(NotificationStatus.Delivered, reloaded!.Status);
+        Assert.Equal(deliveredAt, reloaded.DeliveredAt);
+    }
+
+    /// <summary>
+    /// Companion to <see cref="TryUpdateFromParkedAsync_ConcurrentlyDelivered_ReturnsFalse_AndDoesNotOverwrite"/>:
+    /// runs the IDENTICAL interleaving through the unconditional
+    /// <see cref="NotificationOutboxRepository.UpdateAsync"/> instead — the
+    /// method the operator Retry/Discard path called pre-fix — and shows it
+    /// silently clobbers the Delivered row. This documents the exact defect
+    /// arch-review 2026-08-19 P5-4 fixed by routing the operator path through
+    /// <see cref="TryUpdateFromParkedAsync"/>: UpdateAsync itself is unchanged
+    /// (the dispatcher still needs an unconditional write), so this scenario
+    /// remains "true" by design — it is the operator actor's call-site choice
+    /// that was the bug, proven fixed by the actor-level tests in
+    /// NotificationOutbox.Tests (Discard_ConcurrentlyDelivered_...).
+    /// </summary>
+    [Fact]
+    public async Task UpdateAsync_Unconditional_WouldOverwriteConcurrentlyDeliveredRow_DemonstratingP5_4Mechanism()
+    {
+        var id = Guid.NewGuid().ToString();
+        _context.Notifications.Add(MakeNotification(id, NotificationStatus.Parked));
+        await _context.SaveChangesAsync();
+        _context.ChangeTracker.Clear();
+
+        var operatorRead = await _repository.GetByIdAsync(id);
+        Assert.NotNull(operatorRead);
+
+        var deliveredAt = new DateTimeOffset(2026, 5, 19, 9, 0, 0, TimeSpan.Zero);
+        var dispatcherRead = await _repository.GetByIdAsync(id);
+        dispatcherRead!.Status = NotificationStatus.Delivered;
+        dispatcherRead.DeliveredAt = deliveredAt;
+        Assert.True(await _repository.UpdateAsync(dispatcherRead));
+        _context.ChangeTracker.Clear();
+
+        operatorRead!.Status = NotificationStatus.Discarded;
+        // The unconditional UPDATE has no status guard, so it "succeeds" here —
+        // this is the bug. It clobbers the Delivered row to Discarded and drops
+        // DeliveredAt, which is exactly the silent-overwrite hazard P5-4 closes
+        // by moving the operator path to TryUpdateFromParkedAsync.
+        Assert.True(await _repository.UpdateAsync(operatorRead));
+
+        _context.ChangeTracker.Clear();
+        var reloaded = await _context.Notifications.FindAsync(id);
+        Assert.Equal(NotificationStatus.Discarded, reloaded!.Status);
+        Assert.Null(reloaded.DeliveredAt);
+    }
+
     [Fact]
     public async Task QueryAsync_AppliesFilters_OrdersByCreatedAtDescending_AndPaginates()
     {

tests/ZB.MOM.WW.ScadaBridge.NotificationOutbox.Tests/NotificationOutboxActorQueryTests.cs

@@ -258,7 +258,7 @@ public class NotificationOutboxActorQueryTests : TestKit
         Assert.True(response.Success);
         Assert.Null(response.ErrorMessage);
 
-        _repository.Received(1).UpdateAsync(
+        _repository.Received(1).TryUpdateFromParkedAsync(
             Arg.Is<Notification>(n =>
                 n.NotificationId == row.NotificationId &&
                 n.Status == NotificationStatus.Pending &&
@@ -280,7 +280,7 @@ public class NotificationOutboxActorQueryTests : TestKit
         var response = ExpectMsg<RetryNotificationResponse>();
         Assert.False(response.Success);
         Assert.NotNull(response.ErrorMessage);
-        _repository.DidNotReceive().UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
+        _repository.DidNotReceive().TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]
@@ -300,17 +300,19 @@ public class NotificationOutboxActorQueryTests : TestKit
 
     /// <summary>
     /// The row is read successfully but the retention purge deletes it before the
-    /// write lands, so the targeted UPDATE matches nothing. The operator must be
-    /// told the notification is gone — reporting a re-queue that never happened
-    /// is what the ExecuteUpdate rewrite silently introduced (the predecessor
-    /// threw DbUpdateConcurrencyException here).
+    /// write lands, so the CAS write matches nothing. The re-read that follows a
+    /// lost CAS (arch-review 2026-08-19 P5-4) finds nothing either, and the
+    /// operator must be told the notification is gone — reporting a re-queue
+    /// that never happened is what a blind ExecuteUpdate would silently do (the
+    /// pre-ExecuteUpdate predecessor threw DbUpdateConcurrencyException here).
     /// </summary>
     [Fact]
     public void Retry_RowPurgedBeforeWrite_RepliesNotFound()
     {
         var row = MakeNotification(status: NotificationStatus.Parked, retryCount: 10, lastError: "gave up");
-        _repository.GetByIdAsync(row.NotificationId, Arg.Any<CancellationToken>()).Returns(row);
-        _repository.UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
+        _repository.GetByIdAsync(row.NotificationId, Arg.Any<CancellationToken>())
+            .Returns(row, (Notification?)null);
+        _repository.TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
         var actor = CreateActor();
 
         actor.Tell(new RetryNotificationRequest("corr-vanished-retry", row.NotificationId), TestActor);
@@ -327,8 +329,9 @@ public class NotificationOutboxActorQueryTests : TestKit
     public void Discard_RowPurgedBeforeWrite_RepliesNotFound()
     {
         var row = MakeNotification(status: NotificationStatus.Parked);
-        _repository.GetByIdAsync(row.NotificationId, Arg.Any<CancellationToken>()).Returns(row);
-        _repository.UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
+        _repository.GetByIdAsync(row.NotificationId, Arg.Any<CancellationToken>())
+            .Returns(row, (Notification?)null);
+        _repository.TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
         var actor = CreateActor();
 
         actor.Tell(new DiscardNotificationRequest("corr-vanished-discard", row.NotificationId), TestActor);
@@ -340,6 +343,75 @@ public class NotificationOutboxActorQueryTests : TestKit
         Assert.Contains("not found", response.ErrorMessage);
     }
 
+    /// <summary>
+    /// PROOF OF FAILURE for arch-review 2026-08-19 P5-4. Models the race the
+    /// finding describes: the operator's read sees Parked, but by the time the
+    /// write lands the dispatcher has already delivered the row (a detached
+    /// PipeTo task interleaving with the dispatcher's own write). The mechanism
+    /// is proven deterministically via a mocked call sequence, not a wall-clock
+    /// sleep (per the "no new sleep-then-assert" constraint) — the first
+    /// <see cref="INotificationOutboxRepository.GetByIdAsync"/> call (the
+    /// operator's read) returns the Parked row, the CAS write reports a lost
+    /// race, and the SECOND <c>GetByIdAsync</c> call (the fix's re-read used to
+    /// build an honest reply) returns the row now Delivered.
+    /// <para>
+    /// Against the pre-fix actor — which calls the unconditional
+    /// <c>UpdateAsync</c> exactly once and never re-reads — this test fails:
+    /// the single-read code path only ever consumes the first queued value
+    /// (Parked), the in-memory check passes, <c>UpdateAsync</c> is stubbed
+    /// <c>Healthy()</c> (returns true), and the response comes back
+    /// <c>Success = true</c> — i.e. the Delivered row gets silently clobbered
+    /// to Discarded. Post-fix, the CAS is lost, the actor re-reads and reports
+    /// "already progressed to Delivered" instead of overwriting it.
+    /// </para>
+    /// </summary>
+    [Fact]
+    public void Discard_ConcurrentlyDelivered_RepliesAlreadyProgressed_DoesNotOverwrite()
+    {
+        var parkedRow = MakeNotification(status: NotificationStatus.Parked, retryCount: 5, lastError: "gave up");
+        var deliveredRow = MakeNotification(status: NotificationStatus.Delivered);
+        _repository.GetByIdAsync(parkedRow.NotificationId, Arg.Any<CancellationToken>())
+            .Returns(parkedRow, deliveredRow);
+        _repository.TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
+        var actor = CreateActor();
+
+        actor.Tell(new DiscardNotificationRequest("corr-race-discard", parkedRow.NotificationId), TestActor);
+
+        var response = ExpectMsg<DiscardNotificationResponse>();
+        Assert.Equal("corr-race-discard", response.CorrelationId);
+        Assert.False(response.Success);
+        Assert.NotNull(response.ErrorMessage);
+        Assert.Contains("already progressed", response.ErrorMessage);
+        Assert.Contains("Delivered", response.ErrorMessage);
+
+        // The critical invariant: the old unconditional UpdateAsync must NEVER
+        // be reached by the operator path — that call is what silently
+        // clobbered the Delivered row pre-fix.
+        _repository.DidNotReceive().UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
+    }
+
+    /// <summary>Retry half of <see cref="Discard_ConcurrentlyDelivered_RepliesAlreadyProgressed_DoesNotOverwrite"/>.</summary>
+    [Fact]
+    public void Retry_ConcurrentlyDelivered_RepliesAlreadyProgressed_DoesNotOverwrite()
+    {
+        var parkedRow = MakeNotification(status: NotificationStatus.Parked, retryCount: 5, lastError: "gave up");
+        var deliveredRow = MakeNotification(status: NotificationStatus.Delivered);
+        _repository.GetByIdAsync(parkedRow.NotificationId, Arg.Any<CancellationToken>())
+            .Returns(parkedRow, deliveredRow);
+        _repository.TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>()).Returns(false);
+        var actor = CreateActor();
+
+        actor.Tell(new RetryNotificationRequest("corr-race-retry", parkedRow.NotificationId), TestActor);
+
+        var response = ExpectMsg<RetryNotificationResponse>();
+        Assert.Equal("corr-race-retry", response.CorrelationId);
+        Assert.False(response.Success);
+        Assert.NotNull(response.ErrorMessage);
+        Assert.Contains("already progressed", response.ErrorMessage);
+        Assert.Contains("Delivered", response.ErrorMessage);
+        _repository.DidNotReceive().UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
+    }
+
     [Fact]
     public void Discard_ParkedNotification_MarksDiscarded_AndSucceeds()
     {
@@ -353,7 +425,7 @@ public class NotificationOutboxActorQueryTests : TestKit
         Assert.Equal("corr-8", response.CorrelationId);
         Assert.True(response.Success);
 
-        _repository.Received(1).UpdateAsync(
+        _repository.Received(1).TryUpdateFromParkedAsync(
             Arg.Is<Notification>(n => n.Status == NotificationStatus.Discarded),
             Arg.Any<CancellationToken>());
     }
@@ -370,7 +442,7 @@ public class NotificationOutboxActorQueryTests : TestKit
         var response = ExpectMsg<DiscardNotificationResponse>();
         Assert.False(response.Success);
         Assert.NotNull(response.ErrorMessage);
-        _repository.DidNotReceive().UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
+        _repository.DidNotReceive().TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]

tests/ZB.MOM.WW.ScadaBridge.NotificationOutbox.Tests/NotificationOutboxActorRetryEmissionTests.cs

@@ -147,7 +147,7 @@ public class NotificationOutboxActorRetryEmissionTests : TestKit
         ExpectMsg<RetryNotificationResponse>(r => r.Success);
         AwaitAssert(() =>
         {
-            _outboxRepository.Received(1).UpdateAsync(
+            _outboxRepository.Received(1).TryUpdateFromParkedAsync(
                 Arg.Is<Notification>(n => n.Status == NotificationStatus.Pending),
                 Arg.Any<CancellationToken>());
         });

tests/ZB.MOM.WW.ScadaBridge.NotificationOutbox.Tests/OutboxRepositorySubstitute.cs

@@ -8,14 +8,16 @@ namespace ZB.MOM.WW.ScadaBridge.NotificationOutbox.Tests;
 /// Factory for the outbox repository substitute used across these tests.
 /// </summary>
 /// <remarks>
-/// <see cref="INotificationOutboxRepository.UpdateAsync"/> returns whether the
-/// targeted UPDATE actually matched a row — <c>false</c> is the "this
-/// notification no longer exists" signal the operator retry/discard handlers
-/// turn into a not-found reply. NSubstitute's default for <c>Task&lt;bool&gt;</c>
-/// is <c>false</c>, i.e. the VANISHED-row answer, so an unconfigured substitute
-/// would silently put every test on the failure path. Tests that want a healthy
-/// store take one from here; the vanished-row tests configure
-/// <c>Returns(false)</c> for themselves.
+/// <see cref="INotificationOutboxRepository.UpdateAsync"/> and
+/// <see cref="INotificationOutboxRepository.TryUpdateFromParkedAsync"/> both
+/// return whether the targeted UPDATE actually matched a row — <c>false</c> is
+/// the "this notification no longer exists (or, for the CAS variant, is no
+/// longer Parked)" signal the operator retry/discard handlers turn into a
+/// not-found / already-progressed reply. NSubstitute's default for
+/// <c>Task&lt;bool&gt;</c> is <c>false</c>, i.e. the failure answer, so an
+/// unconfigured substitute would silently put every test on the failure path.
+/// Tests that want a healthy store take one from here; the vanished-row and
+/// lost-CAS tests configure <c>Returns(false)</c> for themselves.
 /// </remarks>
 internal static class OutboxRepositorySubstitute
 {
@@ -26,6 +28,9 @@ internal static class OutboxRepositorySubstitute
         repository
             .UpdateAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>())
             .Returns(true);
+        repository
+            .TryUpdateFromParkedAsync(Arg.Any<Notification>(), Arg.Any<CancellationToken>())
+            .Returns(true);
         return repository;
     }
 }