feat(alarms): HiLo trigger type with per-band level, hysteresis, messages, overrides

Adds a new HiLo alarm trigger type with four configurable setpoints
(LoLo / Lo / Hi / HiHi). Each setpoint carries an optional priority,
deadband (for hysteresis), and operator message. The site runtime emits
AlarmStateChanged with an AlarmLevel field so consumers can differentiate
warning vs critical bands.

Plumbing:
  - new AlarmLevel enum + AlarmStateChanged.Level/Message init properties
  - AlarmTriggerEditor (Blazor) gets a HiLo render with severity tinting
  - AlarmTriggerConfigCodec extracted from the editor for testability
  - sitestream.proto carries level + message over gRPC
  - SemanticValidator enforces numeric attribute, setpoint ordering,
    non-negative deadband
  - on-trigger scripts get an Alarm global (Name/Level/Priority/Message)
    so notification routing can branch by severity
  - per-instance InstanceAlarmOverride entity + EF migration + flattening
    step + CLI commands; HiLo overrides merge setpoint-by-setpoint, binary
    types whole-replace
  - DebugView shows a Level badge + per-band message tooltip
  - App.razor auto-reloads on permanent Blazor circuit failure
  - docker/regen-proto.sh automates the proto regen workflow (the linux/arm64
    protoc segfault means generated files are checked in for now)

src/ScadaLink.Commons/Entities/Instances/Instance.cs

@@ -11,6 +11,7 @@ public class Instance
     public string UniqueName { get; set; }
     public InstanceState State { get; set; }
     public ICollection<InstanceAttributeOverride> AttributeOverrides { get; set; } = new List<InstanceAttributeOverride>();
+    public ICollection<InstanceAlarmOverride> AlarmOverrides { get; set; } = new List<InstanceAlarmOverride>();
     public ICollection<InstanceConnectionBinding> ConnectionBindings { get; set; } = new List<InstanceConnectionBinding>();
 
     public Instance(string uniqueName)

src/ScadaLink.Commons/Entities/Instances/InstanceAlarmOverride.cs

@@ -0,0 +1,48 @@
+namespace ScadaLink.Commons.Entities.Instances;
+
+/// <summary>
+/// Per-instance override for a template-defined alarm. Lets a deployed
+/// instance tweak setpoints, priority, or per-band messages without forking
+/// the template. Locked alarms (TemplateAlarm.IsLocked) cannot be overridden
+/// — LockEnforcer rejects the change at write time.
+///
+/// Merge semantics (applied during flattening, after template inheritance and
+/// composition):
+///   • <see cref="TriggerConfigurationOverride"/> with a HiLo trigger merges
+///     into the inherited JSON setpoint-by-setpoint (derived keys win,
+///     inherited keys survive for unset derived keys). Same logic as
+///     template-to-template HiLo override, just one layer deeper.
+///   • For ValueMatch / RangeViolation / RateOfChange, the override replaces
+///     the whole TriggerConfiguration JSON (existing whole-replace semantics).
+///   • <see cref="PriorityLevelOverride"/> replaces the alarm's PriorityLevel
+///     when set.
+/// </summary>
+public class InstanceAlarmOverride
+{
+    public int Id { get; set; }
+    public int InstanceId { get; set; }
+
+    /// <summary>
+    /// Canonical name of the alarm being overridden — matches
+    /// <c>ResolvedAlarm.CanonicalName</c> after flattening, so composed-member
+    /// alarms are referenced as <c>[CompositionInstance].[AlarmName]</c>.
+    /// </summary>
+    public string AlarmCanonicalName { get; set; }
+
+    /// <summary>
+    /// Partial JSON (for HiLo) or full JSON (for binary trigger types) to
+    /// override the inherited TriggerConfiguration. <c>null</c> means
+    /// "leave inherited as-is".
+    /// </summary>
+    public string? TriggerConfigurationOverride { get; set; }
+
+    /// <summary>
+    /// Replaces the alarm's PriorityLevel when set. <c>null</c> = keep inherited.
+    /// </summary>
+    public int? PriorityLevelOverride { get; set; }
+
+    public InstanceAlarmOverride(string alarmCanonicalName)
+    {
+        AlarmCanonicalName = alarmCanonicalName ?? throw new ArgumentNullException(nameof(alarmCanonicalName));
+    }
+}

src/ScadaLink.Commons/Interfaces/Repositories/ITemplateEngineRepository.cs

@@ -65,6 +65,13 @@ public interface ITemplateEngineRepository
     Task UpdateInstanceAttributeOverrideAsync(InstanceAttributeOverride attributeOverride, CancellationToken cancellationToken = default);
     Task DeleteInstanceAttributeOverrideAsync(int id, CancellationToken cancellationToken = default);
 
+    // InstanceAlarmOverride
+    Task<IReadOnlyList<InstanceAlarmOverride>> GetAlarmOverridesByInstanceIdAsync(int instanceId, CancellationToken cancellationToken = default);
+    Task<InstanceAlarmOverride?> GetAlarmOverrideAsync(int instanceId, string alarmCanonicalName, CancellationToken cancellationToken = default);
+    Task AddInstanceAlarmOverrideAsync(InstanceAlarmOverride alarmOverride, CancellationToken cancellationToken = default);
+    Task UpdateInstanceAlarmOverrideAsync(InstanceAlarmOverride alarmOverride, CancellationToken cancellationToken = default);
+    Task DeleteInstanceAlarmOverrideAsync(int id, CancellationToken cancellationToken = default);
+
     // InstanceConnectionBinding
     Task<IReadOnlyList<InstanceConnectionBinding>> GetBindingsByInstanceIdAsync(int instanceId, CancellationToken cancellationToken = default);
     Task AddInstanceConnectionBindingAsync(InstanceConnectionBinding binding, CancellationToken cancellationToken = default);

src/ScadaLink.Commons/Messages/Management/InstanceCommands.cs

@@ -10,3 +10,21 @@ public record MgmtDeleteInstanceCommand(int InstanceId);
 public record SetConnectionBindingsCommand(int InstanceId, IReadOnlyList<(string AttributeName, int DataConnectionId)> Bindings);
 public record SetInstanceOverridesCommand(int InstanceId, IReadOnlyDictionary<string, string?> Overrides);
 public record SetInstanceAreaCommand(int InstanceId, int? AreaId);
+
+/// <summary>
+/// Sets (or upserts) a per-instance alarm override. For HiLo trigger types the
+/// <c>TriggerConfigurationOverride</c> JSON is merged setpoint-by-setpoint with
+/// the inherited config; for binary trigger types it replaces the whole config.
+/// Either field is optional — pass null to leave it unchanged.
+/// </summary>
+public record SetInstanceAlarmOverrideCommand(
+    int InstanceId,
+    string AlarmCanonicalName,
+    string? TriggerConfigurationOverride,
+    int? PriorityLevelOverride);
+
+public record DeleteInstanceAlarmOverrideCommand(
+    int InstanceId,
+    string AlarmCanonicalName);
+
+public record ListInstanceAlarmOverridesCommand(int InstanceId);

src/ScadaLink.Commons/Messages/Streaming/AlarmStateChanged.cs

@@ -7,4 +7,23 @@ public record AlarmStateChanged(
     string AlarmName,
     AlarmState State,
     int Priority,
-    DateTimeOffset Timestamp);
+    DateTimeOffset Timestamp)
+{
+    /// <summary>
+    /// Severity level when <see cref="State"/> is <see cref="AlarmState.Active"/>.
+    /// Always <see cref="AlarmLevel.None"/> for binary trigger types
+    /// (ValueMatch, RangeViolation, RateOfChange); set by the HiLo trigger
+    /// type to one of Low/LowLow/High/HighHigh based on the crossed setpoint.
+    /// Added as an init-property so existing positional constructors still
+    /// work — message contract evolves additively.
+    /// </summary>
+    public AlarmLevel Level { get; init; } = AlarmLevel.None;
+
+    /// <summary>
+    /// Optional per-band operator message (e.g., "Coolant critically low —
+    /// shut down"). Set by HiLo triggers when the per-setpoint message is
+    /// configured; otherwise empty. Notification routing and UI tooltips may
+    /// surface this to operators.
+    /// </summary>
+    public string Message { get; init; } = string.Empty;
+}

src/ScadaLink.Commons/Types/Enums/AlarmLevel.cs

@@ -0,0 +1,19 @@
+namespace ScadaLink.Commons.Types.Enums;
+
+/// <summary>
+/// Severity level for an active alarm. Binary alarm types (ValueMatch,
+/// RangeViolation, RateOfChange) always emit <see cref="None"/>. The HiLo
+/// trigger type emits one of the directional levels based on which setpoint
+/// the monitored attribute has crossed.
+///
+/// Conventional ordering (lowest setpoint to highest):
+///   LowLow &lt; Low &lt; normal-band &lt; High &lt; HighHigh
+/// </summary>
+public enum AlarmLevel
+{
+    None,
+    Low,
+    LowLow,
+    High,
+    HighHigh
+}

src/ScadaLink.Commons/Types/Enums/AlarmTriggerType.cs

@@ -4,5 +4,12 @@ public enum AlarmTriggerType
 {
     ValueMatch,
     RangeViolation,
-    RateOfChange
+    RateOfChange,
+    /// <summary>
+    /// Multi-setpoint level alarm: monitors a single numeric attribute against
+    /// up to four configurable setpoints (LoLo, Lo, Hi, HiHi). Each setpoint
+    /// may carry its own priority; transitions between levels emit a fresh
+    /// AlarmStateChanged with the corresponding <see cref="AlarmLevel"/>.
+    /// </summary>
+    HiLo
 }

src/ScadaLink.Commons/Types/Scripts/AlarmContext.cs

@@ -0,0 +1,23 @@
+using ScadaLink.Commons.Types.Enums;
+
+namespace ScadaLink.Commons.Types.Scripts;
+
+/// <summary>
+/// Alarm context exposed to on-trigger scripts via <c>Alarm</c>. Lets scripts
+/// branch on the firing severity — e.g., page on-call for HiHi/LoLo but only
+/// email the day shift for Hi/Lo. Always present when an on-trigger script
+/// runs; <see cref="Level"/> is <see cref="AlarmLevel.None"/> for binary
+/// trigger types.
+/// </summary>
+public sealed class AlarmContext
+{
+    public string Name { get; init; } = string.Empty;
+    public AlarmLevel Level { get; init; } = AlarmLevel.None;
+    public int Priority { get; init; }
+
+    /// <summary>
+    /// Per-band operator message configured on the HiLo alarm, or empty for
+    /// binary trigger types and bands without a message.
+    /// </summary>
+    public string Message { get; init; } = string.Empty;
+}