perf(comms): alarms-only seed, capped buffers, at-least-once audit pull

src/ZB.MOM.WW.ScadaBridge.Communication/CommunicationOptions.cs

@@ -107,6 +107,21 @@ public class CommunicationOptions
     /// <summary>Maximum number of concurrent gRPC streaming subscriptions per site node.</summary>
     public int GrpcMaxConcurrentStreams { get; set; } = 100;
 
+    /// <summary>
+    /// Send-channel capacity for a per-instance Debug View stream (<c>SubscribeInstance</c>).
+    /// Lossy by design: the Debug View is a diagnostic surface and drops its oldest events
+    /// under backpressure rather than stalling the site's event hub.
+    /// </summary>
+    public int GrpcInstanceStreamChannelCapacity { get; set; } = 1000;
+
+    /// <summary>
+    /// Send-channel capacity for the site-wide alarm stream (<c>SubscribeSite</c>). Larger
+    /// than the Debug View's (WP2.3): that feed backs the operator Alarm Summary, where a
+    /// silently dropped transition is a missed alarm rather than a missed diagnostic frame,
+    /// and an alarm burst arriving during a WAN stall must survive the stall.
+    /// </summary>
+    public int GrpcSiteAlarmStreamChannelCapacity { get; set; } = 20_000;
+
     /// <summary>Akka.Remote transport heartbeat interval.</summary>
     public TimeSpan TransportHeartbeatInterval { get; set; } = TimeSpan.FromSeconds(5);
 
@@ -185,4 +200,12 @@ public class CommunicationOptions
     /// reconcile publishes are always immediate. Default 250 ms.
     /// </summary>
     public TimeSpan LiveAlarmCachePublishCoalesce { get; set; } = TimeSpan.FromMilliseconds(250);
+
+    /// <summary>
+    /// Random jitter added to each per-site reconcile tick, as a fraction of
+    /// <see cref="LiveAlarmCacheReconcileInterval"/> (WP2.3). Without it every aggregator
+    /// started by one central failover fans its whole-site snapshot out on the same 60s
+    /// boundary forever. Zero disables jitter.
+    /// </summary>
+    public double LiveAlarmCacheReconcileJitterFraction { get; set; } = 0.2;
 }