Every open alarm in a scope, oldest first, stably paged (the rail's open list)

Pages through EVERY open alarm (the queue's own membership) at one site, optionally narrowed to camera_ids, oldest first on (created_at, id) with an opaque cursor. Unlike GET /operator/events/all (newest first, offset-paged, 1,000 by default) an old urgent alarm can never sit beyond the first page, and closes or arrivals between pages cannot duplicate or skip rows. Page 1 pins snapshot.as_of; every page of the pass bounds membership by CREATION time (created_at <= as_of, immutable per alarm) and by current membership at that page's own read (still open, unexpired, queue-visible). An alarm that was open at as_of and still is when its page runs is therefore always returned, even if a late AI verdict re-stamps its queued_at. Alarms created after as_of are the push stream's and the next pass's. Late visibility: an alarm created at or before as_of that only becomes visible to the queue after it (a late verdict or failsafe flip) is returned if its key is still ahead of the cursor, otherwise it is the push stream's and the next pass's. status is more (continue), complete (last page; complete as of as_of under these rules) or truncated (the pass ceiling was hit; omitted is the count of eligible alarms after the last returned one at that read, at least that many when omitted_capped). counts are PAGE-ONE observations: the scalar totals (scope_total, site_total), the exact overdue counts by age_marks and oldest_queued_at repeat unchanged from page one on every later page, while by_camera is returned on page one only (null afterwards). The rows returned over a pass can exceed the totals (late-visible alarms) or fall short of them (closes). Each row carries queued_at (age = snapshot.server_time - queued_at) and its live claim. A 200 is always a true statement; anything else (404 unknown or out-of-scope site or any invisible camera, one answer; 403 customer roles; 422 CURSOR_INVALID for an invalid cursor, 422 CURSOR_EXPIRED for an expired one (restart from page 1); 503 deadline or database failure) is UNKNOWN, never an empty list. Central staff only, tenant-scoped in SQL on every page. Read-only: it stamps no first view and takes no claim. Capability: open_alarms_paged_read on GET /auth/me.