perf(comms+audit): close phase-2 residuals — direct ingest path, monotonic timeouts, synthetic probe, not-reporting set, cursor-exact audit pull

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/SiteAuditReconciliationActorTests.cs

@@ -194,7 +194,7 @@ public class SiteAuditReconciliationActorTests : TestKit, IClassFixture<MsSqlMig
     /// </summary>
     private sealed class ScriptedPullClient : IPullAuditEventsClient
     {
-        public List<(string SiteId, DateTime SinceUtc, int BatchSize)> Calls { get; } = new();
+        public List<(string SiteId, DateTime SinceUtc, string? AfterId, int BatchSize)> Calls { get; } = new();
         private readonly Dictionary<string, Queue<PullAuditEventsResponse>> _scripted = new();
         private readonly Dictionary<string, Exception> _throwOnSite = new();
 
@@ -211,9 +211,9 @@ public class SiteAuditReconciliationActorTests : TestKit, IClassFixture<MsSqlMig
         }
 
         public Task<PullAuditEventsResponse> PullAsync(
-            string siteId, DateTime sinceUtc, int batchSize, CancellationToken ct)
+            string siteId, DateTime sinceUtc, string? afterId, int batchSize, CancellationToken ct)
         {
-            Calls.Add((siteId, sinceUtc, batchSize));
+            Calls.Add((siteId, sinceUtc, afterId, batchSize));
             if (_throwOnSite.TryGetValue(siteId, out var ex))
             {
                 throw ex;
@@ -425,6 +425,104 @@ public class SiteAuditReconciliationActorTests : TestKit, IClassFixture<MsSqlMig
 
         Assert.Equal(DateTime.MinValue, client.Calls[0].SinceUtc);
         Assert.Equal(t3, client.Calls[1].SinceUtc);
+
+        // The composite half travels too (arch-review phase-2 residual #5): the first pull has
+        // no cursor at all, the second carries the id of the row at t3 so the site can retire
+        // it exactly instead of leaving the boundary instant permanently servable.
+        Assert.Null(client.Calls[0].AfterId);
+        Assert.Equal(e3.EventId.ToString(), client.Calls[1].AfterId);
+    }
+
+    [Fact]
+    public void Cursor_AdvancesOnTheIdTiebreak_WhenEveryRowSharesOneInstant()
+    {
+        // The case a bare timestamp cursor could never drain: a burst all stamped at the same
+        // instant. The timestamp cannot move, so only the id half can — and it must, or the
+        // next pull re-serves the identical window forever.
+        var sites = new StaticEnumerator(new SiteEntry("siteA", "http://siteA:8083"));
+        var t = new DateTime(2026, 5, 20, 10, 0, 0, DateTimeKind.Utc);
+
+        // Deterministic ids so "the greatest ordinal" is a fact, not a coin flip.
+        var low = NewEvent("siteA", t, Guid.Parse("11111111-1111-1111-1111-111111111111"));
+        var high = NewEvent("siteA", t, Guid.Parse("99999999-9999-9999-9999-999999999999"));
+        var mid = NewEvent("siteA", t, Guid.Parse("55555555-5555-5555-5555-555555555555"));
+
+        var client = new ScriptedPullClient().Script("siteA",
+            new PullAuditEventsResponse(new[] { low, high, mid }, MoreAvailable: true));
+        var repo = new RecordingRepo();
+
+        CreateActor(sites, client, repo, FastTickOptions());
+
+        AwaitAssert(() => Assert.True(client.Calls.Count >= 2,
+            $"need at least 2 pulls, got {client.Calls.Count}"),
+            duration: TimeSpan.FromSeconds(5),
+            interval: TimeSpan.FromMilliseconds(50));
+
+        Assert.Equal(t, client.Calls[1].SinceUtc);
+        Assert.Equal(high.EventId.ToString(), client.Calls[1].AfterId);
+    }
+
+    [Fact]
+    public void BothCursorHalves_AreHeldBack_WhileARowIsStillBeingRetried()
+    {
+        // A held-back cursor must hold BOTH halves: advancing the id while pinning the
+        // timestamp would skip past the very rows being retried.
+        var sites = new StaticEnumerator(new SiteEntry("siteA", "http://siteA:8083"));
+        var t = new DateTime(2026, 5, 20, 10, 0, 0, DateTimeKind.Utc);
+        var evt = NewEvent("siteA", t);
+
+        var client = new ScriptedPullClient().Script("siteA",
+            new PullAuditEventsResponse(new[] { evt }, MoreAvailable: false));
+        var repo = new AlwaysThrowingRepo();
+
+        CreateActor(sites, client, repo, FastTickOptions());
+
+        AwaitAssert(() => Assert.True(client.Calls.Count >= 2,
+            $"need at least 2 pulls, got {client.Calls.Count}"),
+            duration: TimeSpan.FromSeconds(5),
+            interval: TimeSpan.FromMilliseconds(50));
+
+        Assert.Equal(DateTime.MinValue, client.Calls[1].SinceUtc);
+        Assert.Null(client.Calls[1].AfterId);
+    }
+
+    /// <summary>Repository whose every insert throws, so the retry hold-back path is taken.</summary>
+    private sealed class AlwaysThrowingRepo : IAuditLogRepository
+    {
+        public Task InsertIfNotExistsAsync(AuditEvent evt, CancellationToken ct = default) =>
+            throw new InvalidOperationException("central insert failed");
+
+        public Task<IReadOnlyList<AuditEvent>> QueryAsync(
+            AuditLogQueryFilter filter, AuditLogPaging paging, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<long> SwitchOutPartitionAsync(
+            DateTime monthBoundary, TimeSpan? commandTimeout = null, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<long> PurgeChannelOlderThanAsync(
+            string channel, DateTime threshold, int batchSize, TimeSpan? commandTimeout = null,
+            CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<long> BackfillSourceNodeAsync(
+            string sentinel, DateTime before, int batchSize, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<IReadOnlyList<DateTime>> GetPartitionBoundariesOlderThanAsync(
+            DateTime threshold, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<ZB.MOM.WW.ScadaBridge.Commons.Types.AuditLogKpiSnapshot> GetKpiSnapshotAsync(
+            TimeSpan window, DateTime? nowUtc = null, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<IReadOnlyList<ExecutionTreeNode>> GetExecutionTreeAsync(
+            Guid executionId, CancellationToken ct = default)
+            => throw new NotSupportedException();
+
+        public Task<IReadOnlyList<string>> GetDistinctSourceNodesAsync(CancellationToken ct = default)
+            => throw new NotSupportedException();
     }
 
     // ---------------------------------------------------------------------