perf(comms): alarms-only seed, capped buffers, at-least-once audit pull

src/ZB.MOM.WW.ScadaBridge.Communication/Protos/sitestream.proto

@@ -164,13 +164,26 @@ message CachedTelemetryBatch { repeated CachedTelemetryPacket packets = 1; }
 
 // Audit Log (#23) M6 reconciliation pull: central→site request for any
 // site-local AuditLog rows with OccurredAtUtc >= since_utc that have not yet
-// been ingested centrally (ForwardState in {Pending, Forwarded}). The site
-// flips returned rows to Reconciled after the response is on the wire.
+// been ingested centrally (ForwardState in {Pending, Forwarded}). Rows are NOT
+// flipped to Reconciled when they are served — only when a LATER pull's cursor
+// proves central consumed them (see after_id), so a fault between the response
+// leaving the site and central committing it re-serves the rows instead of
+// silently losing them (at-least-once).
 // more_available signals batch_size was saturated so the caller knows to
 // issue a follow-up pull with an advanced since_utc cursor.
 message PullAuditEventsRequest {
   google.protobuf.Timestamp since_utc = 1;
   int32 batch_size = 2;
+  // Composite-keyset cursor (WP2.3), mirroring PullSiteCallsRequest.after_id:
+  // the EventId ("D" GUID form) of the last row central has already CONSUMED at
+  // since_utc. When set, the site returns only rows strictly after the composite
+  // (OccurredAtUtc, EventId) pair — un-pinning a batch that would otherwise stall
+  // when more than batch_size rows share one since_utc instant — AND treats the
+  // cursor as proof of receipt: everything at or before it is flipped to
+  // Reconciled. Empty (the proto3 string default) preserves the legacy inclusive
+  // >= behaviour, under which only rows strictly older than since_utc are proven
+  // received. Additive-only.
+  string after_id = 3;
 }
 
 message PullAuditEventsResponse {