perf(comms+audit): close phase-2 residuals — direct ingest path, monotonic timeouts, synthetic probe, not-reporting set, cursor-exact audit pull

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/HeartbeatMessage.cs

@@ -1,7 +1,27 @@
 namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 
+/// <summary>
+/// Application-level heartbeat a site node sends to central on its heartbeat interval.
+/// Central's health aggregator stamps the site's last-seen time from it, and the offline
+/// timeout fires when they stop landing.
+/// </summary>
+/// <param name="SiteId">The reporting site's identifier.</param>
+/// <param name="NodeHostname">The reporting node's hostname.</param>
+/// <param name="IsActive">Whether the reporting node is the site's active (oldest-Up) node.</param>
+/// <param name="Timestamp">When the heartbeat was produced (UTC).</param>
+/// <param name="Synthetic">
+/// <c>true</c> marks a heartbeat that carries NO liveness meaning and that central must skip for
+/// all health bookkeeping — it neither stamps a last-seen time nor replicates to the peer node.
+/// The only producer today is <c>CentralChannelProvider</c>'s failback probe, which reuses the
+/// heartbeat RPC purely to ask "does the preferred central endpoint answer again?"; it is emitted
+/// by a SITE's transport layer, not by any node's heartbeat timer, and counting it as liveness
+/// would keep a site looking alive on the health dashboard from the probe alone. Additive with a
+/// <c>false</c> default (and proto field 5 on <c>HeartbeatDto</c>), so every real heartbeat —
+/// including one from a node that predates the flag — is unaffected.
+/// </param>
 public record HeartbeatMessage(
     string SiteId,
     string NodeHostname,
     bool IsActive,
-    DateTimeOffset Timestamp);
+    DateTimeOffset Timestamp,
+    bool Synthetic = false);