fix(communication): failback probe sentinel uses an illegal actor name so it can never match a real instance (review 2026-10-21 03/P-2 follow-up)

src/ZB.MOM.WW.ScadaBridge.Communication/Grpc/SitePairChannelProvider.cs

@@ -589,8 +589,14 @@ public sealed class SitePairChannelProvider : IDisposable
         return GrpcChannel.ForAddress(endpoint, channelOptions);
     }
 
-    /// <summary>Sentinel instance name the readiness probe queries; never a real instance.</summary>
+    /// <summary>
-    internal const string ReadinessProbeInstance = "__scadabridge-failback-probe__";
+    /// Sentinel instance name the readiness probe queries. The leading <c>$</c> makes it an
+    /// illegal Akka actor name, which <c>ActorNameRules</c> rejects for every real instance, so it
+    /// can never collide with one. The site-side DeploymentStateQuery path (dispatcher →
+    /// DeploymentManagerActor → a parameterised SQLite lookup) never validates or materialises
+    /// the name, so the probe simply reads "not deployed".
+    /// </summary>
+    internal const string ReadinessProbeInstance = "$scadabridge-failback-probe";
 
     /// <summary>
     /// Production failback probe (review 2026-10-21 03/P-2): a real, read-only

tests/ZB.MOM.WW.ScadaBridge.Communication.Tests/Grpc/SitePairChannelProviderFailbackTests.cs

@@ -150,6 +150,14 @@ public class SitePairChannelProviderFailbackTests
         Assert.Contains(SitePairChannelProvider.ReadinessProbeInstance, handler.LastRequestBody);
     }
 
+    /// <summary>Verifies that the probe's sentinel instance name can never be a real instance (it is not a legal actor name).</summary>
+    [Fact]
+    public void ReadinessProbeSentinel_IsNotALegalInstanceName()
+    {
+        Assert.False(ZB.MOM.WW.ScadaBridge.Commons.Validation.ActorNameRules.IsValid(
+            SitePairChannelProvider.ReadinessProbeInstance));
+    }
+
     /// <summary>
     /// Minimal in-memory gRPC server stand-in: a trailers-only Unavailable (+ the not-dispatched
     /// trailer) while not ready, or a framed <see cref="LifecycleReply"/> with OK status when ready.