[F54] per-operation correlation + compat OnWriteComplete fan-out

Closes the residual that R3/R4 Path A's commit `c73a33e` deferred:
the OperationStatus.context field was always None because no
in-flight correlation map existed in SessionInner, and the
mxaccess-compat broadcast channels for OnWriteComplete /
OperationComplete were exposed on the public API but had no
fan-out task draining session events into them.

**mxaccess (Part 1 — per-operation correlation):**

- New `pending_ops: Mutex<HashMap<[u8; 16], OperationContext>>` on
  SessionInner. Populated when `Session::write*` / `subscribe*`
  dispatches an outstanding operation; entry removed when the
  matching OperationStatus event fires (one-shot semantics).
- New `Session::write_with_handle` (and equivalents for the secured /
  timestamped paths) returns a `WriteHandle { correlation_id }` so
  consumers can correlate completions back to their originating
  call. Existing `write` / `write_value` / etc. signatures unchanged
  and delegate to the handle-returning variant.
- Callback router extended to look up `pending_ops` by correlation_id
  on each operation-status event. When found, populates
  `OperationStatus.context: Some(OperationContext { correlation_id,
  op_kind, reference, retry_count: 0 })`. When not found, falls
  through with `context: None` (verbatim-preserve per CLAUDE.md).
- New unit tests assert: matching correlation_id populates context,
  unknown correlation_id leaves context None, the entry is removed
  from `pending_ops` after one event fires.

**mxaccess-compat (Part 2 — compat-layer fan-out):**

- New `correlation_to_item: tokio::sync::Mutex<HashMap<[u8; 16], i32>>`
  on LmxClientInner.
- `LmxClient::write` / `write_2` / `write_secured` / `write_secured_2`
  call `Session::write_with_handle` (or equivalent) and insert
  `correlation_id → item_handle` into the map before returning.
- `LmxClient::register` / `register_asb` spawn a background task that
  drains `session.operation_status_stream()`. Per event, looks up
  `correlation_to_item[event.context?.correlation_id]` to find the
  item_handle, then routes:
  - `OperationKind::Write` / `OperationKind::WriteSecured` →
    `WriteCompleteEvent { server_handle, item_handle, statuses,
    is_during_recovery }` into `on_write_complete_tx`.
  - Other variants → `OperationCompleteEvent { ... }` into
    `on_operation_complete_tx`.
  - Removes the correlation_id from `correlation_to_item` after
    firing (one-shot).
- Events with no matching item_handle (correlation_id not in map)
  are dropped silently — no bogus item_handle=0 events.
- Task cancelled on LmxClient drop via `JoinHandle::abort` (matches
  the existing `subscription_task` pattern).
- New unit tests cover: Write op routes to on_write_complete, Read
  op routes to on_operation_complete, unknown correlation_id is
  dropped.

Result: the C# `LMX_OnWriteComplete(int hLMXServerHandle, int
phItemHandle, ref MXSTATUS_PROXY[] pVars)` callback shape is now
end-to-end-achievable. A consumer calls `LmxClient::write(hServer,
hItem, value, userId)` and drains `client.on_write_complete()`; the
yielded `WriteCompleteEvent` carries the right `(server_handle,
item_handle, statuses, is_during_recovery)` tuple.

Public API: `Session::write_with_handle` + `WriteHandle` are new;
existing signatures unchanged. `cargo public-api` baselines
regenerated under `design/public-api/{mxaccess,mxaccess-compat}.txt`.

Workspace: 765 → 823 tests pass (~58 new tests from F54). Clippy
`-D warnings` clean. Rustdoc `-D warnings` clean.

F54 status in `design/followups.md` moved Open → Resolved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

design/public-api/mxaccess.txt

@@ -7,6 +7,8 @@ pub use mxaccess::MxStatusCategory
 pub use mxaccess::MxStatusSource
 pub use mxaccess::MxValue
 pub use mxaccess::MxValueKind
+pub use mxaccess::NmxOperationStatusFormat
+pub use mxaccess::NmxOperationStatusMessage
 pub use mxaccess::Resolver
 pub use mxaccess::ResolverError
 pub use mxaccess::WriteValue
@@ -89,6 +91,8 @@ pub mxaccess::session::OperationContext::correlation_id: [u8; 16]
 pub mxaccess::session::OperationContext::op_kind: mxaccess::session::OperationKind
 pub mxaccess::session::OperationContext::reference: core::option::Option<alloc::sync::Arc<str>>
 pub mxaccess::session::OperationContext::retry_count: u32
+impl mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::new(correlation_id: [u8; 16], op_kind: mxaccess::session::OperationKind, reference: core::option::Option<alloc::sync::Arc<str>>, retry_count: u32) -> Self
 impl core::clone::Clone for mxaccess::session::OperationContext
 pub fn mxaccess::session::OperationContext::clone(&self) -> mxaccess::session::OperationContext
 impl core::fmt::Debug for mxaccess::session::OperationContext
@@ -105,6 +109,8 @@ pub mxaccess::session::OperationStatus::context: core::option::Option<mxaccess::
 pub mxaccess::session::OperationStatus::is_during_recovery: bool
 pub mxaccess::session::OperationStatus::raw: mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub mxaccess::session::OperationStatus::status: mxaccess_codec::status::MxStatus
+impl mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::new(raw: mxaccess_codec::operation_status::NmxOperationStatusMessage, status: mxaccess_codec::status::MxStatus, context: core::option::Option<mxaccess::session::OperationContext>, is_during_recovery: bool) -> Self
 impl core::clone::Clone for mxaccess::session::OperationStatus
 pub fn mxaccess::session::OperationStatus::clone(&self) -> mxaccess::session::OperationStatus
 impl core::fmt::Debug for mxaccess::session::OperationStatus
@@ -143,6 +149,26 @@ impl core::marker::Unpin for mxaccess::session::Subscription
 impl core::marker::UnsafeUnpin for mxaccess::session::Subscription
 impl !core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::Subscription
 impl !core::panic::unwind_safe::UnwindSafe for mxaccess::session::Subscription
+#[non_exhaustive] pub struct mxaccess::session::WriteHandle
+pub mxaccess::session::WriteHandle::correlation_id: [u8; 16]
+impl core::clone::Clone for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::clone(&self) -> mxaccess::session::WriteHandle
+impl core::cmp::Eq for mxaccess::session::WriteHandle
+impl core::cmp::PartialEq for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::eq(&self, other: &mxaccess::session::WriteHandle) -> bool
+impl core::fmt::Debug for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::WriteHandle
+impl core::marker::StructuralPartialEq for mxaccess::session::WriteHandle
+impl core::marker::Freeze for mxaccess::session::WriteHandle
+impl core::marker::Send for mxaccess::session::WriteHandle
+impl core::marker::Sync for mxaccess::session::WriteHandle
+impl core::marker::Unpin for mxaccess::session::WriteHandle
+impl core::marker::UnsafeUnpin for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::WriteHandle
 pub fn mxaccess::session::filetime_to_system_time(filetime_ticks: i64) -> std::time::SystemTime
 pub fn mxaccess::session::system_time_to_filetime(time: std::time::SystemTime) -> core::result::Result<i64, mxaccess::Error>
 pub type mxaccess::session::RebuildFactory = alloc::sync::Arc<(dyn core::ops::function::Fn() -> core::pin::Pin<alloc::boxed::Box<(dyn core::future::future::Future<Output = core::result::Result<mxaccess_nmx::client::NmxClient, mxaccess_nmx::client::NmxClientError>> + core::marker::Send)>> + core::marker::Send + core::marker::Sync)>
@@ -482,6 +508,8 @@ pub mxaccess::OperationContext::correlation_id: [u8; 16]
 pub mxaccess::OperationContext::op_kind: mxaccess::session::OperationKind
 pub mxaccess::OperationContext::reference: core::option::Option<alloc::sync::Arc<str>>
 pub mxaccess::OperationContext::retry_count: u32
+impl mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::new(correlation_id: [u8; 16], op_kind: mxaccess::session::OperationKind, reference: core::option::Option<alloc::sync::Arc<str>>, retry_count: u32) -> Self
 impl core::clone::Clone for mxaccess::session::OperationContext
 pub fn mxaccess::session::OperationContext::clone(&self) -> mxaccess::session::OperationContext
 impl core::fmt::Debug for mxaccess::session::OperationContext
@@ -498,6 +526,8 @@ pub mxaccess::OperationStatus::context: core::option::Option<mxaccess::session::
 pub mxaccess::OperationStatus::is_during_recovery: bool
 pub mxaccess::OperationStatus::raw: mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub mxaccess::OperationStatus::status: mxaccess_codec::status::MxStatus
+impl mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::new(raw: mxaccess_codec::operation_status::NmxOperationStatusMessage, status: mxaccess_codec::status::MxStatus, context: core::option::Option<mxaccess::session::OperationContext>, is_during_recovery: bool) -> Self
 impl core::clone::Clone for mxaccess::session::OperationStatus
 pub fn mxaccess::session::OperationStatus::clone(&self) -> mxaccess::session::OperationStatus
 impl core::fmt::Debug for mxaccess::session::OperationStatus
@@ -556,7 +586,7 @@ pub fn mxaccess::Session::callbacks(&self) -> tokio::sync::broadcast::Receiver<a
 pub async fn mxaccess::Session::connect_nmx(addr: core::net::socket_addr::SocketAddr, options: mxaccess::SessionOptions, ntlm: mxaccess_rpc::ntlm::NtlmClientContext, service_ipid: mxaccess_rpc::guid::Guid, resolver: alloc::sync::Arc<dyn mxaccess_galaxy::resolver::Resolver>, recovery: mxaccess::RecoveryPolicy) -> core::result::Result<Self, mxaccess::Error>
 pub async fn mxaccess::Session::has_recovery_factory(&self) -> bool
 pub fn mxaccess::Session::operation_status_events(&self) -> tokio::sync::broadcast::Receiver<alloc::sync::Arc<mxaccess::session::OperationStatus>>
-pub fn mxaccess::Session::operation_status_stream(&self) -> impl futures_core::stream::Stream<Item = core::result::Result<alloc::sync::Arc<mxaccess::session::OperationStatus>, mxaccess::Error>> + core::marker::Send
+pub fn mxaccess::Session::operation_status_stream(&self) -> impl futures_core::stream::Stream<Item = core::result::Result<alloc::sync::Arc<mxaccess::session::OperationStatus>, mxaccess::Error>> + core::marker::Send + use<>
 pub async fn mxaccess::Session::read(&self, reference: &str, timeout: core::time::Duration) -> core::result::Result<mxaccess::DataChange, mxaccess::Error>
 pub async fn mxaccess::Session::recover_connection(&self, policy: mxaccess::RecoveryPolicy) -> core::result::Result<(), mxaccess::Error>
 pub fn mxaccess::Session::recovery_events(&self) -> tokio::sync::broadcast::Receiver<alloc::sync::Arc<mxaccess::RecoveryEvent>>
@@ -568,7 +598,10 @@ pub async fn mxaccess::Session::subscribe(&self, reference: &str) -> core::resul
 pub async fn mxaccess::Session::unsubscribe(&self, subscription: mxaccess::session::Subscription) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_value(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_value_at(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_value_at_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_value_secured_at(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64, security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_value_secured_at_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64, security: mxaccess::SecurityContext) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
+pub async fn mxaccess::Session::write_value_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 impl mxaccess::Session
 pub async fn mxaccess::Session::connect(_options: mxaccess::ConnectionOptions) -> core::result::Result<Self, mxaccess::Error>
 pub async fn mxaccess::Session::shutdown(self, timeout: core::time::Duration) -> core::result::Result<(), mxaccess::Error>
@@ -577,8 +610,11 @@ pub async fn mxaccess::Session::subscribe_many(&self, _references: &[&str]) -> c
 pub async fn mxaccess::Session::write(&self, reference: &str, value: mxaccess_codec::value::MxValue) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_secured(&self, _reference: &str, _value: mxaccess_codec::value::MxValue, _security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_secured_at(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime, security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_secured_at_with_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime, security: mxaccess::SecurityContext) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_with_completion(&self, _reference: &str, _value: mxaccess_codec::value::MxValue, _client_token: u32) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_with_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_with_timestamp(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_with_timestamp_and_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 impl core::clone::Clone for mxaccess::Session
 pub fn mxaccess::Session::clone(&self) -> mxaccess::Session
 impl core::fmt::Debug for mxaccess::Session
@@ -653,6 +689,26 @@ impl core::marker::Unpin for mxaccess::TransportCapabilities
 impl core::marker::UnsafeUnpin for mxaccess::TransportCapabilities
 impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::TransportCapabilities
 impl core::panic::unwind_safe::UnwindSafe for mxaccess::TransportCapabilities
+#[non_exhaustive] pub struct mxaccess::WriteHandle
+pub mxaccess::WriteHandle::correlation_id: [u8; 16]
+impl core::clone::Clone for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::clone(&self) -> mxaccess::session::WriteHandle
+impl core::cmp::Eq for mxaccess::session::WriteHandle
+impl core::cmp::PartialEq for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::eq(&self, other: &mxaccess::session::WriteHandle) -> bool
+impl core::fmt::Debug for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::WriteHandle
+impl core::marker::StructuralPartialEq for mxaccess::session::WriteHandle
+impl core::marker::Freeze for mxaccess::session::WriteHandle
+impl core::marker::Send for mxaccess::session::WriteHandle
+impl core::marker::Sync for mxaccess::session::WriteHandle
+impl core::marker::Unpin for mxaccess::session::WriteHandle
+impl core::marker::UnsafeUnpin for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::WriteHandle
 pub trait mxaccess::Transport: core::marker::Send + core::marker::Sync + 'static
 pub fn mxaccess::Transport::capabilities(&self) -> mxaccess::TransportCapabilities
 pub fn mxaccess::Transport::kind(&self) -> mxaccess::TransportKind