fix(central): review findings — no client-side audit truncation, insert-first upsert, QI-safe scripts, honest operator replies

Six adversarial-review findings in the central SQL/ingest layer.

F1 (AuditLogRepository.InsertChunkAsync) — the set-based ingest declared each
string parameter at its COLUMN width (Actor/Target 256, Action 64, Outcome 16,
Category 32, SourceNode 64), so SqlClient truncated an over-long value at bind
time and committed the mutilated row — silent, in an append-only store, with no
PayloadTruncated flag — while the per-row and reconciliation paths sent the same
value in full and let the server reject it with 2628. Bind at the value's own
length instead; explicit SqlDbType is kept (it fixes the VALUES constructor's
derived column types and datetime2 precision). Design: reject everywhere,
truncate nowhere — matching today's per-row behaviour.

F2 (SiteCallAuditRepository.UpsertAsync) — the single-statement upsert ran the
monotonic UPDATE first and INSERTed only if nothing matched. Two writers racing
the first packet of one TrackedOperationId (the cached dual-write and the
reconciliation pull carry DIFFERENT lifecycle states) both matched nothing, and
the loser then skipped its INSERT or swallowed a 2627 — dropping its
Status/RetryCount/HttpStatus/TerminalAtUtc. Legs swapped to
`IF NOT EXISTS … INSERT; UPDATE <monotonic>` — still one round trip, and the
loser's UPDATE now lands on the winner's row. The duplicate-key catch re-runs
the monotonic UPDATE for the same reason. Moved to raw SQL with explicitly-typed
parameters so the intricate rank predicate exists in exactly one place (an
untyped DateTime would bind as `datetime` and round the freshness tiebreaker).

F3 (docs/plans/sql/*.sql) — filtered-index DDL failed with error 1934 under the
documented `docker exec … sqlcmd` path, which defaults QUOTED_IDENTIFIER OFF;
once IX_Notifications_Delivered exists, QI-OFF DML on Notifications fails too.
All four scripts now open with `SET QUOTED_IDENTIFIER ON; SET ANSI_NULLS ON; GO`
(own batch, so it is in force when the next batch parses), and the migration
convention in Component-ConfigurationDatabase.md documents `sqlcmd -I`. Verified
live: the pre-fix script fails 1934 without -I, the fixed one applies.

F4 (SiteCallAuditActor) — the off-mailbox reconciliation/purge passes reuse the
injected repository, so tests drove one DbContext from the pass and a mailbox
handler concurrently. Serialized at the CALL via a private SerializedRepository
wrapper applied only by the test constructors, rather than running the pass
on-mailbox: production keeps its PipeTo shape untouched, and the existing
"a blocked drain does not stall ingest/query/KPI" regression tests stay
meaningful (they would have been invalidated by suspending the mailbox).

F5 (AuditLogIngestActor) — when the batch failed because the 20 s IngestBudget
expired, the per-row fallback reused the same expired token: N instant failures,
N counter bumps, zero accepted. The fallback now gets a fresh 5 s budget (inside
the 30 s outer Ask), and a blown budget bumps the failure counter ONCE for the
batch instead of once per row.

F6 (NotificationOutboxRepository.UpdateAsync) — ExecuteUpdate's row count was
discarded, so an operator Retry/Discard of a notification the retention purge had
already deleted reported success (the pre-ExecuteUpdate code threw
DbUpdateConcurrencyException). UpdateAsync now returns whether a row matched; the
operator one-shots answer "notification not found" and emit no audit row for the
action that did not happen, while the dispatcher logs a warning (its delivery
already happened; nothing to retry). GetByIdAsync switched to AsNoTracking since
the write is out-of-band.

Tests: 5 new SQL-backed regressions (over-long Target rejected on both paths +
boundary round-trip; concurrent first-write and already-created-by-another-writer
upserts; vanished-row UpdateAsync), a token-identity pin on the ingest fallback,
a repository-concurrency detector for the SiteCallAudit passes, and vanished-row
operator-path tests. The F1/F2/F4 regressions were each confirmed failing against
the pre-fix code. Suites: ConfigurationDatabase 369, AuditLog 378, SiteCallAudit
66, NotificationOutbox 152 — all green, solution builds with 0 warnings.

src/ZB.MOM.WW.ScadaBridge.SiteCallAudit/SiteCallAuditActor.cs

@@ -221,7 +221,7 @@ public class SiteCallAuditActor : ReceiveActor
         ArgumentNullException.ThrowIfNull(repository);
         ArgumentNullException.ThrowIfNull(logger);
 
-        _injectedRepository = repository;
+        _injectedRepository = new SerializedRepository(repository);
         _logger = logger;
         _options = options ?? new SiteCallAuditOptions();
         _auditWriter = auditWriter;
@@ -267,7 +267,7 @@ public class SiteCallAuditActor : ReceiveActor
         ArgumentNullException.ThrowIfNull(pullClient);
         ArgumentNullException.ThrowIfNull(logger);
 
-        _injectedRepository = repository;
+        _injectedRepository = new SerializedRepository(repository);
         _siteEnumerator = siteEnumerator;
         _pullClient = pullClient;
         _logger = logger;
@@ -1564,6 +1564,92 @@ public class SiteCallAuditActor : ReceiveActor
         public static readonly PurgeComplete Instance = new();
         private PurgeComplete() { }
     }
+
+    /// <summary>
+    /// Serializing wrapper applied to a repository handed in through the
+    /// test constructors. One call at a time, in arrival order.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// In production every consumer of this actor's repository gets its OWN DI
+    /// scope — one per message, one per background pass — so the off-mailbox
+    /// reconciliation and purge passes can safely run alongside mailbox handlers:
+    /// separate scopes mean separate <c>DbContext</c>s. The injected-repository
+    /// constructors break that assumption: ONE instance (typically wrapping one
+    /// <c>DbContext</c>) is shared by the mailbox handlers AND the background
+    /// passes, and <c>DbContext</c> forbids concurrent operations — "A second
+    /// operation was started on this context instance" is a hard fault, and the
+    /// interleaving is nondeterministic, so it surfaces as a flaky test rather
+    /// than a reliable one.
+    /// </para>
+    /// <para>
+    /// Serializing at the CALL, not around the whole pass, is deliberate: it
+    /// removes the concurrency hazard while preserving the property the
+    /// off-mailbox passes exist for — a long drain (blocked in a network pull,
+    /// holding no repository call) still lets ingest, query and KPI messages be
+    /// answered. Suspending the mailbox for the duration of a pass would have
+    /// been simpler and would have invalidated exactly those regression tests.
+    /// Production is untouched: it never constructs this type.
+    /// </para>
+    /// </remarks>
+    private sealed class SerializedRepository : ISiteCallAuditRepository
+    {
+        private readonly ISiteCallAuditRepository _inner;
+        private readonly SemaphoreSlim _gate = new(1, 1);
+
+        public SerializedRepository(ISiteCallAuditRepository inner) => _inner = inner;
+
+        public Task UpsertAsync(SiteCall siteCall, CancellationToken ct = default) =>
+            RunAsync(() => _inner.UpsertAsync(siteCall, ct));
+
+        public Task<SiteCall?> GetAsync(TrackedOperationId id, CancellationToken ct = default) =>
+            RunAsync(() => _inner.GetAsync(id, ct));
+
+        public Task<IReadOnlyList<SiteCall>> QueryAsync(
+            SiteCallQueryFilter filter, SiteCallPaging paging, CancellationToken ct = default) =>
+            RunAsync(() => _inner.QueryAsync(filter, paging, ct));
+
+        public Task<int> PurgeTerminalAsync(DateTime olderThanUtc, CancellationToken ct = default) =>
+            RunAsync(() => _inner.PurgeTerminalAsync(olderThanUtc, ct));
+
+        public Task<SiteCallKpiSnapshot> ComputeKpisAsync(
+            DateTime stuckCutoffUtc, DateTime deliveredSinceUtc, CancellationToken ct = default) =>
+            RunAsync(() => _inner.ComputeKpisAsync(stuckCutoffUtc, deliveredSinceUtc, ct));
+
+        public Task<IReadOnlyList<SiteCallSiteKpiSnapshot>> ComputePerSiteKpisAsync(
+            DateTime stuckCutoffUtc, DateTime deliveredSinceUtc, CancellationToken ct = default) =>
+            RunAsync(() => _inner.ComputePerSiteKpisAsync(stuckCutoffUtc, deliveredSinceUtc, ct));
+
+        public Task<IReadOnlyList<SiteCallNodeKpiSnapshot>> ComputePerNodeKpisAsync(
+            DateTime stuckCutoffUtc, DateTime deliveredSinceUtc, CancellationToken ct = default) =>
+            RunAsync(() => _inner.ComputePerNodeKpisAsync(stuckCutoffUtc, deliveredSinceUtc, ct));
+
+        private async Task RunAsync(Func<Task> call)
+        {
+            await _gate.WaitAsync().ConfigureAwait(false);
+            try
+            {
+                await call().ConfigureAwait(false);
+            }
+            finally
+            {
+                _gate.Release();
+            }
+        }
+
+        private async Task<T> RunAsync<T>(Func<Task<T>> call)
+        {
+            await _gate.WaitAsync().ConfigureAwait(false);
+            try
+            {
+                return await call().ConfigureAwait(false);
+            }
+            finally
+            {
+                _gate.Release();
+            }
+        }
+    }
 }
 
 /// <summary>