fix(comms): review findings — consumer-based debug orphan net, foreign-cancel triad, honest onConnected, served-row-exact retirement, full-rate reconcile

F1 (HIGH) DebugStreamBridgeActor: the 5-minute orphan net measured the MAILBOX
(SetReceiveTimeout), and once stream events were correctly marked
INotInfluenceReceiveTimeout nothing recurring reset it — the snapshot lands once
and GrpcStreamStable once — so every healthy session self-terminated at ~6 min
with a false "Site disconnected". Replaced with a periodic self-tick
(ConsumerLivenessCheckInterval, 30s) over a consumer-last-seen stamp renewed only
by DebugStreamConsumerAlive, which DebugStreamService Tells on a shared timer to
every session still in its registry (holding a session there IS "a consumer is
attached" — both the Blazor view and the SignalR hub release it on
dispose/disconnect, and it works headless). Reverting the wrapper was rejected: it
would restore the quiet-instance orphan bug.

F2 (MED) SiteStreamGrpcClient: the RpcException(Cancelled) filter now requires
cts.IsCancellationRequested. A peer-originated / channel-dispose Cancelled fired
none of onError/onCompleted/onConnected, leaving SiteAlarmAggregatorActor with
_streamDown=false forever (IsLive stuck true, reconcile reopen guard never fired).

F3 (MED) SiteStreamGrpcClient: a header TIMEOUT is no longer reported as
connected — that shape is exactly what an unreachable site produces, and it
cleared _streamDown, consumed _seedOnConnect and launched a full snapshot fan-out
at a dead site. AwaitHeadersAsync returns bool; the first received event is the
fallback connected signal, fired at most once from headers OR first event.

F4 (LOW-MED) SqliteAuditWriter.MarkReconciledUpToAsync: the blanket below-cursor
UPDATE retired late-stamped inserts that were never served (then age-purged —
silent loss). The flip is now bounded by insertion order: a Pending row retires
only if its rowid is at or below the high-water mark of rows this instance has
served from ReadPendingSinceAsync (clamped on purge, since SQLite reuses rowids);
Forwarded rows are exempt (central ACKed them over the push path). At-least-once
is unchanged.

F5 (LOW) Documented the liveness dependency (a served row never covered by a later
cursor stays Pending forever; PurgeExpiredAsync never purges Pending) in
ISiteAuditQueue + Component-AuditLog.md, and added a cheap site-health signal:
SiteAuditBacklogReporter logs a rate-limited warning when the existing
oldest-pending metric exceeds 24h.

F6 (MED) SiteAlarmAggregatorActor: _fanoutSinceLastTick was armed by the
reconcile's OWN fan-out, so steady state ran fan-out→skip→fan-out→skip — one
reconcile per 2x interval (120s), halving the not-reporting refresh and the alarm
reconcile backstop. The skip is now armed only by connect/failover-driven seeds
(initial, _seedOnConnect, and a re-seed queued behind one).

Tests: Communication.Tests 691 passed (+13), AuditLog.Tests 382 passed (+5).

src/ZB.MOM.WW.ScadaBridge.Communication/Grpc/SiteStreamGrpcClient.cs

@@ -246,11 +246,12 @@ public class SiteStreamGrpcClient : IAsyncDisposable, IDisposable
     /// </param>
     /// <param name="ct">Cancellation token to stop the subscription.</param>
     /// <param name="onConnected">
-    /// Optional callback invoked once when the site has ACCEPTED the subscription (response
-    /// headers received — the site writes them as soon as its relay actor is subscribed, so
-    /// no event can be missed after this point). The per-site aggregator uses it to run
-    /// exactly one re-seed per successful (re)connect instead of one per reconnect attempt.
-    /// Never invoked more than once per call, and never after <paramref name="onError"/>.
+    /// Optional callback invoked once when the site has ACCEPTED the subscription — response
+    /// headers received (the site writes them as soon as its relay actor is subscribed, so no
+    /// event can be missed after this point), or the first event received if the peer defers
+    /// its headers. A header timeout is NOT treated as connected. The per-site aggregator uses
+    /// this to run exactly one re-seed per successful (re)connect instead of one per reconnect
+    /// attempt. Never invoked more than once per call, and never after <paramref name="onError"/>.
     /// </param>
     /// <returns>A task that represents the asynchronous operation.</returns>
     public virtual async Task SubscribeSiteAsync(
@@ -311,11 +312,11 @@ public class SiteStreamGrpcClient : IAsyncDisposable, IDisposable
     /// <param name="onError">Invoked once if the stream faulted.</param>
     /// <param name="onCompleted">Invoked once if the server ended the stream with OK.</param>
     /// <param name="onConnected">
-    /// Optional; invoked once when the server's response headers arrive — i.e. the site has
-    /// accepted the subscription and its relay actor is attached. Bounded by
-    /// <see cref="ConnectedHeaderTimeout"/> so a peer that defers headers (a pre-WP2.3 site,
-    /// which only flushes them with its first event) still reports connected instead of
-    /// leaving the caller waiting for a signal that may never come on a quiet site.
+    /// Optional; invoked AT MOST ONCE when the site has demonstrably accepted the
+    /// subscription — either the server's response headers arrived (bounded by
+    /// <see cref="ConnectedHeaderTimeout"/>) or, for a peer that defers headers until its
+    /// first message, the first event was received. A header timeout alone is never
+    /// reported as connected: that is also exactly what an unreachable site looks like.
     /// </param>
     /// <returns>A task that completes when the stream has ended and its outcome been reported.</returns>
     internal async Task ConsumeStreamAsync(
@@ -328,27 +329,49 @@ public class SiteStreamGrpcClient : IAsyncDisposable, IDisposable
         Action? onConnected = null)
     {
         var completedGracefully = false;
+        var connectedReported = false;
+
+        // Fires onConnected AT MOST ONCE, from whichever proof of a live peer arrives
+        // first: the response headers, or (for a peer that defers headers until its first
+        // message) the first event. A header TIMEOUT is deliberately NOT such a proof —
+        // see AwaitHeadersAsync.
+        void ReportConnected()
+        {
+            if (connectedReported || onConnected is null) return;
+            connectedReported = true;
+            onConnected();
+        }
+
         try
         {
             using (var call = openCall())
             {
-                if (onConnected is not null)
+                if (onConnected is not null && await AwaitHeadersAsync(call, cts.Token).ConfigureAwait(false))
                 {
-                    await AwaitHeadersAsync(call, cts.Token).ConfigureAwait(false);
-                    onConnected();
+                    ReportConnected();
                 }
 
                 await foreach (var evt in call.ResponseStream.ReadAllAsync(cts.Token))
                 {
+                    // Fallback connected signal: an event can only come from a peer that
+                    // accepted the subscription, so it proves what the headers would have.
+                    // Raised BEFORE the event is delivered so the consumer sees
+                    // connected-then-event ordering.
+                    ReportConnected();
                     onEvent(evt);
                 }
             }
 
             completedGracefully = true;
         }
-        catch (RpcException ex) when (ex.StatusCode == StatusCode.Cancelled)
+        catch (RpcException ex) when (ex.StatusCode == StatusCode.Cancelled && cts.IsCancellationRequested)
         {
-            // Normal cancellation — not an error
+            // OUR OWN cancellation (Unsubscribe / reconnect / channel teardown we asked
+            // for) — not an error. The IsCancellationRequested guard matters: a Cancelled
+            // status can also originate at the PEER or from a channel disposed underneath
+            // us, and swallowing THAT fired none of onError/onCompleted/onConnected, so
+            // the consuming actor kept a dead stream marked live forever. Foreign
+            // Cancelled now falls through to the onError path below.
         }
         catch (OperationCanceledException) when (cts.IsCancellationRequested)
         {
@@ -372,26 +395,37 @@ public class SiteStreamGrpcClient : IAsyncDisposable, IDisposable
     }
 
     /// <summary>
-    /// How long to wait for response headers before treating the stream as connected anyway.
-    /// A peer that only flushes headers with its first message would otherwise hold the
-    /// connected signal — and with it the aggregator's re-seed — for as long as the site
-    /// happens to be quiet.
+    /// How long to wait for response headers before giving up on them as the connected
+    /// signal and falling back to the first received event. A peer that only flushes headers
+    /// with its first message would otherwise hold the connected signal — and with it the
+    /// aggregator's re-seed — for as long as the site happens to be quiet.
     /// </summary>
     internal static TimeSpan ConnectedHeaderTimeout { get; set; } = TimeSpan.FromSeconds(10);
 
     /// <summary>
     /// Awaits the call's response headers, bounded by <see cref="ConnectedHeaderTimeout"/>.
-    /// A fault propagates (the caller reports it through <c>onError</c> like any other stream
-    /// fault); a timeout returns normally. On timeout the abandoned headers task is observed
-    /// so a later fault on it can never surface as an unobserved task exception.
+    /// Returns <see langword="true"/> when the headers arrived (the site accepted the
+    /// subscription) and <see langword="false"/> on timeout. A fault propagates (the caller
+    /// reports it through <c>onError</c> like any other stream fault); on timeout the
+    /// abandoned headers task is observed so a later fault on it can never surface as an
+    /// unobserved task exception.
+    /// <para>
+    /// A timeout must NOT be reported as connected: an unreachable/wedged site produces
+    /// exactly that shape, and calling <c>onConnected</c> for it made the aggregator clear
+    /// <c>_streamDown</c>, consume its pending re-seed and fan a full snapshot out at a site
+    /// that never answered. The caller instead treats the FIRST RECEIVED EVENT as the
+    /// fallback connected signal — real proof of a live peer, and the quiet-site case the
+    /// timeout was added for is covered by the reconcile backstop.
+    /// </para>
     /// </summary>
-    private static async Task AwaitHeadersAsync(
+    private static async Task<bool> AwaitHeadersAsync(
         AsyncServerStreamingCall<SiteStreamEvent> call, CancellationToken ct)
     {
         var headers = call.ResponseHeadersAsync;
         try
         {
             await headers.WaitAsync(ConnectedHeaderTimeout, ct).ConfigureAwait(false);
+            return true;
         }
         catch (TimeoutException)
         {
@@ -400,6 +434,7 @@ public class SiteStreamGrpcClient : IAsyncDisposable, IDisposable
                 CancellationToken.None,
                 TaskContinuationOptions.OnlyOnFaulted | TaskContinuationOptions.ExecuteSynchronously,
                 TaskScheduler.Default);
+            return false;
         }
     }