perf(central): set-based ingest, aligned partition purge, KPI query shapes, EF hygiene

docs/requirements/Component-SiteCallAudit.md

@@ -135,6 +135,28 @@ Pinned)` on the EventStream (transition-only, mirroring
 health-observable condition rather than a silent log line, and the latch clears
 with `Pinned=false` once a later tick makes progress.
 
+**The drain runs off the mailbox.** A reconciliation pass is unbounded work —
+every site, up to a page ceiling of network pulls each, one upsert per row — so
+it runs as a background task with a `PipeTo`-delivered completion message and a
+single-flight guard, not as an actor message handler. A handler occupies the
+actor for its whole duration, so a post-outage catch-up used to park telemetry
+ingest, UI queries and KPI Asks behind it; those callers time out rather than
+queue, which made a slow site look like a dead central. The single-flight guard
+is raised and lowered ON the actor thread, so the per-site cursor and pinned-latch
+dictionaries the pass mutates are still only ever touched by one task at a time,
+and the mailbox supplies the memory barrier between consecutive passes. The
+daily terminal-row purge uses the same shape. (`NotificationOutboxActor`'s
+dispatch sweep is the in-repo reference.)
+
+**The central upsert is one statement.** `SiteCallAuditRepository.UpsertAsync`
+issues a single batch that runs the monotonic UPDATE first and INSERTs only when
+nothing matched *and* the row genuinely does not exist — instead of an
+unconditional insert-if-absent followed by the update, which cost two round trips
+on every packet and wasted the insert half for every packet after the first. The
+existence re-check is load-bearing: a zero row count also means "the monotonic
+guard rejected this packet", and inserting there would fork the mirror with a
+second row for an id that already exists.
+
 ## Retry / Discard Relay
 
 Parked cached calls live in the owning site's S&F buffer. Operator Retry/Discard