feat(localdb): alarm_sf_events replicated table

Adds the alarm store-and-forward buffer to the consolidated LocalDb file and
registers it for replication, so a node that dies with undelivered alarm
history no longer takes it to the grave.

The table keeps the legacy queue's shape rather than the status column the
plan sketched. An acknowledged row is deleted, not marked delivered: that
needs no second sweeper to keep the table bounded, leaves the capacity
semantics untouched, and the replication engine carries the delete as a
tombstone so the peer drops its copy anyway -- which is what the status
column was for. last_error is retained because it is the only operator-facing
record of why a row was dead-lettered.

The primary key is app-minted TEXT. The legacy AUTOINCREMENT RowId cannot
replicate under last-writer-wins: two nodes would independently allocate
rowid 7 to different alarms and silently overwrite each other. The drain
index therefore orders by enqueued_at_utc rather than insertion order, with
id as a tiebreak so the ordering is total.

Tables are created unconditionally, independent of AlarmHistorian:Enabled.
An empty registered table costs three triggers; creating it lazily would mean
a node that enables the historian later writes rows before its capture
triggers exist, which is exactly the silent-loss shape OnReady's ordering
comment warns about.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/AlarmSfSchema.cs

@@ -0,0 +1,77 @@
+using Microsoft.Data.Sqlite;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian;
+
+/// <summary>
+///     DDL for the alarm store-and-forward buffer: one row per alarm event awaiting delivery to
+///     the historian gateway.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Replaces the standalone <c>alarm-historian.db</c> the sink used to own outright. Living
+///         in the consolidated LocalDb file is what lets the buffer replicate to the redundant pair
+///         peer, so a node that dies with undelivered alarm history no longer takes it to the grave.
+///     </para>
+///     <para>
+///         Deliberately depends on nothing but <see cref="SqliteConnection"/> so it can be applied
+///         to any connection — the host's <c>LocalDbSetup.OnReady</c> in production, and a bare
+///         connection in a test — without dragging the DI graph along. Mirrors
+///         <c>DeploymentCacheSchema</c>.
+///     </para>
+///     <para>
+///         <b>Why <see cref="IdColumn"/> is TEXT and app-minted.</b> The legacy queue keyed on
+///         <c>RowId INTEGER PRIMARY KEY AUTOINCREMENT</c>. Convergence is last-writer-wins over the
+///         primary key, so two nodes independently allocating rowid 7 for different alarms would
+///         silently overwrite one another. The sink mints the id from a hash of the payload, which
+///         additionally makes the same event converge to one row when both nodes of a pair enqueue
+///         it — as they legitimately do in the window before the first redundancy snapshot arrives.
+///     </para>
+/// </remarks>
+public static class AlarmSfSchema
+{
+    /// <summary>Table holding queued alarm events awaiting delivery.</summary>
+    public const string EventsTable = "alarm_sf_events";
+
+    /// <summary>The single primary-key column.</summary>
+    public const string IdColumn = "id";
+
+    /// <summary>
+    ///     Creates the buffer table if it does not already exist. Idempotent.
+    /// </summary>
+    /// <param name="connection">
+    ///     An already-open connection. <c>ILocalDb.CreateConnection()</c> hands out open,
+    ///     pragma-configured connections — do not call <c>Open()</c> on one.
+    /// </param>
+    public static void Apply(SqliteConnection connection)
+    {
+        ArgumentNullException.ThrowIfNull(connection);
+
+        using var cmd = connection.CreateCommand();
+
+        // Columns map 1:1 onto the legacy Queue table so the one-time migrator is a straight copy
+        // and the drain keeps its existing semantics: dead_lettered is the same 0/1 flag, and an
+        // acknowledged row is DELETEd rather than marked. Deleting keeps the table bounded without
+        // a second sweeper, and the replication engine carries the delete as a tombstone, so the
+        // peer drops its copy too.
+        //
+        // The drain index orders by enqueued_at_utc because a hashed TEXT id carries no insertion
+        // order the way the legacy AUTOINCREMENT RowId did. Timestamps are round-trip ("O") format,
+        // so lexicographic ordering is chronological; id breaks ties so the order is total and the
+        // index covers the drain's read.
+        cmd.CommandText = """
+            CREATE TABLE IF NOT EXISTS alarm_sf_events (
+                id               TEXT    NOT NULL PRIMARY KEY,
+                alarm_id         TEXT    NOT NULL,
+                enqueued_at_utc  TEXT    NOT NULL,
+                payload_json     TEXT    NOT NULL,
+                attempt_count    INTEGER NOT NULL DEFAULT 0,
+                last_attempt_utc TEXT    NULL,
+                last_error       TEXT    NULL,
+                dead_lettered    INTEGER NOT NULL DEFAULT 0
+            );
+            CREATE INDEX IF NOT EXISTS ix_alarm_sf_events_drain
+                ON alarm_sf_events (dead_lettered, enqueued_at_utc, id);
+            """;
+        cmd.ExecuteNonQuery();
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LocalDbSetup.cs

@@ -1,11 +1,12 @@
 using ZB.MOM.WW.LocalDb;
+using ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian;
 using ZB.MOM.WW.OtOpcUa.Runtime.DeploymentCache;
 
 namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
 
 /// <summary>
-///     The <c>onReady</c> callback handed to <c>AddZbLocalDb</c>: creates the deployment-cache
-///     tables and opts them into replication.
+///     The <c>onReady</c> callback handed to <c>AddZbLocalDb</c>: creates the deployment-cache and
+///     alarm store-and-forward tables and opts them into replication.
 /// </summary>
 /// <remarks>
 ///     <para>
@@ -26,8 +27,15 @@ public static class LocalDbSetup
     ///         <c>RegisterReplicated</c> is what installs the three AFTER triggers that capture
     ///         changes into the oplog. Any row written before that call is never captured, so it
     ///         never reaches the peer — silently, and permanently, because nothing ever revisits
-    ///         history. Phase 1 writes nothing here; when Phase 2 adds its store-and-forward
-    ///         migrator, the migrator must run <i>after</i> both registrations for the same reason.
+    ///         history. The Phase-2 legacy alarm migrator therefore runs <i>after</i> every
+    ///         registration, not alongside the DDL.
+    ///     </para>
+    ///     <para>
+    ///         The alarm buffer's tables are created unconditionally, regardless of whether this
+    ///         node has <c>AlarmHistorian:Enabled</c> set. An empty registered table costs three
+    ///         triggers and nothing else, whereas creating it lazily when the sink first appears
+    ///         would mean a node that enables the historian later writes rows before its triggers
+    ///         exist — which is precisely the silent-loss shape above.
     ///     </para>
     /// </remarks>
     /// <param name="db">The freshly constructed local database.</param>
@@ -40,9 +48,11 @@ public static class LocalDbSetup
         using (var connection = db.CreateConnection())
         {
             DeploymentCacheSchema.Apply(connection);
+            AlarmSfSchema.Apply(connection);
         }
 
         db.RegisterReplicated(DeploymentCacheSchema.ArtifactsTable);
         db.RegisterReplicated(DeploymentCacheSchema.PointerTable);
+        db.RegisterReplicated(AlarmSfSchema.EventsTable);
     }
 }