fix(localdb): snapshot review fixes — MAX-guarded complete watermark, keyset pagination, phantom-row guard

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

ZB.MOM.WW.LocalDb/src/ZB.MOM.WW.LocalDb.Replication/Internal/SyncSession.cs

@@ -58,9 +58,10 @@ internal sealed class SyncSession
     /// <summary>
     /// Invoked when THIS node owes the peer a snapshot (its own snapshot-required computation, not
     /// the peer's) before deltas resume. Receives a gated send delegate that enqueues on the bounded
-    /// data lane (never the raw transport). Wired to <see cref="SnapshotStreamer.SendAsync"/>.
+    /// data lane (never the raw transport); returns the as-of oplog seq the snapshot covers so the
+    /// pump can skip already-covered tail deltas. Wired to <see cref="SnapshotStreamer.SendAsync"/>.
     /// </summary>
-    public Func<Func<SyncMessage, CancellationToken, Task>, CancellationToken, Task>? SnapshotSender { get; set; }
+    public Func<Func<SyncMessage, CancellationToken, Task>, CancellationToken, Task<long>>? SnapshotSender { get; set; }
 
     /// <summary>
     /// Consumes an inbound snapshot inline on the receive loop: SnapshotBegin opens the receive,
@@ -72,6 +73,9 @@ internal sealed class SyncSession
     /// <summary>Highest seq the peer has acknowledged applying this session.</summary>
     public long PeerAckedSeq => Interlocked.Read(ref _peerAckedSeq);
 
+    /// <summary>Highest oplog seq handed to the wire (or covered by a sent snapshot). Test/metric observation only.</summary>
+    internal long SentThruSeq => Interlocked.Read(ref _sentThruSeq);
+
     /// <summary>The peer node's identity, once the handshake has completed. Volatile: written on the session task, read from test/metric threads.</summary>
     public string? PeerNodeId
     {
@@ -151,11 +155,19 @@ internal sealed class SyncSession
         // We stream the snapshot when WE owe the peer one (computed from our pruned horizon /
         // needs_snapshot), then it lands on the peer's receive loop. The peer's own flag drives ITS
         // send direction symmetrically; both are safe to run because LWW merges either way.
+        // Memory profile of a MUTUAL snapshot: while we send here (receive loop not yet running),
+        // the peer's inbound frames — potentially its entire snapshot — buffer in the unbounded
+        // duplex inbox until our send completes. Worst case one full peer snapshot held in memory;
+        // acceptable for the small LocalDb datasets this library targets.
         if (snapshotRequired)
         {
             if (SnapshotSender is null)
                 throw new NotSupportedException("snapshot required but no snapshot sender configured");
-            await SnapshotSender(dataSend, ct);
+            var snapshotAsOfSeq = await SnapshotSender(dataSend, ct);
+            // The snapshot already carries every row state up to as-of; skipping the pump past it
+            // avoids re-sending tail deltas the peer would only discard via LWW.
+            if (snapshotAsOfSeq > _sentThruSeq)
+                _sentThruSeq = snapshotAsOfSeq;
         }
     }