perf(comms+audit): close phase-2 residuals — direct ingest path, monotonic timeouts, synthetic probe, not-reporting set, cursor-exact audit pull

src/ZB.MOM.WW.ScadaBridge.AuditLog/Central/GrpcPullAuditEventsClient.cs

@@ -73,6 +73,7 @@ public sealed class GrpcPullAuditEventsClient : IPullAuditEventsClient
     public async Task<PullAuditEventsResponse> PullAsync(
         string siteId,
         DateTime sinceUtc,
+        string? afterId,
         int batchSize,
         CancellationToken ct)
     {
@@ -93,6 +94,10 @@ public sealed class GrpcPullAuditEventsClient : IPullAuditEventsClient
             // EnsureUtc keeps Timestamp.FromDateTime happy (it requires UTC kind).
             SinceUtc = Timestamp.FromDateTime(EnsureUtc(sinceUtc)),
             BatchSize = batchSize,
+            // Composite-keyset tiebreak (proto field 3), mirroring PullSiteCalls exactly.
+            // proto3 has no nullable string — an unset/empty AfterId is the site's signal to
+            // keep the legacy inclusive-timestamp contract (also what a first pull sends).
+            AfterId = afterId ?? string.Empty,
         };
 
         var (reply, transportFault) = await TryInvokeAsync(endpoint, request, siteId, ct)
@@ -121,10 +126,13 @@ public sealed class GrpcPullAuditEventsClient : IPullAuditEventsClient
 
         // Map proto DTOs to canonical AuditEvent records and order oldest-first
         // (the wire is already ordered by the site queue, but the
-        // IPullAuditEventsClient contract is explicit, so sort defensively).
+        // IPullAuditEventsClient contract is explicit, so sort defensively). The EventId
+        // tiebreak matches the site's own composite ordering — ordinal over the "D" GUID
+        // text, which is what SQLite's BINARY collation compares.
         var events = reply.Events
             .Select(AuditEventDtoMapper.FromDto)
             .OrderBy(e => e.OccurredAtUtc)
+            .ThenBy(e => e.EventId.ToString(), StringComparer.Ordinal)
             .ToList();
 
         return new PullAuditEventsResponse(events, reply.MoreAvailable);