tools: upgrade Get-InfisicalSecret to stream separation, drop banner regex

Earlier fix (commit 047125b) filtered the infisical CLI's
"A new release of infisical is available" upgrade banner from
captured output via regex matching. That worked but coupled the
filter to specific banner-pattern strings — a future banner shape
("Update available" / "New version detected" / a localized
message) would slip through and break NTLM Type1 auth again.

The principled fix is to stop capturing stderr at all.
PowerShell's call operator (`&`) keeps stdout and stderr on
separate streams unless explicitly merged; the previous code's
`2>&1` was the actual mistake. Without it, the banner stays in
the error stream (visible on the console for diagnostics) and
the captured `$value` contains only the script's stdout — which
for `Get-Secret.ps1` is just the secret value from `infisical
secrets get --plain`.

Verified: live re-run of F54 (lmx_write_complete_live) passes
post-change with `MX_TEST_DOMAIN='DESKTOP-6JL3KKO'` clean and
the banner visibly logged to console (stderr) above each [SET]
line. No regex coupling to a specific banner-pattern remains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -5,10 +5,12 @@ format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 the workspace as a whole follows [SemVer](https://semver.org/) but the
 0.0.x line is pre-release / API-unstable.
 
-## [Unreleased] — V1 — 2026-05-06
+## [Unreleased] — V1 — 2026-05-07
 
 V1 is the first publishable cut. Closes M0 → M6 from
-`design/60-roadmap.md`.
+`design/60-roadmap.md`. The workspace stays at `version = "0.0.0"`
+indefinitely (F48 — internal usage only, no crates.io publish; consumers
+depend via path or git).
 
 ### Added
 
@@ -29,6 +31,10 @@ V1 is the first publishable cut. Closes M0 → M6 from
   `IRemUnknown::RemQueryInterface` + `RemAddRef`/`RemRelease` (F11).
 - **`mxaccess-callback`** — RPC server hosting `INmxSvcCallback` +
   `IRemUnknown` for inbound `DataReceived` / `StatusReceived` frames.
+  `dcom_sink` (F55 Path A, gated by `windows-com`) hosts the callback
+  as a DCOM-managed object so `RegisterEngine2` accepts it on AVEVA
+  installs that do SCM-side OXID resolution against RPCSS; the
+  hand-rolled `CallbackExporter` is retained for unit tests.
 - **`mxaccess-nmx`** — `INmxService2` client (`RegisterEngine2`,
   `TransferData`, `AddSubscriberEngine`, `SetHeartbeatSendInterval`,
   etc.) plus auto-resolving `NmxClient::create` factory (F12, gated by
@@ -49,12 +55,28 @@ V1 is the first publishable cut. Closes M0 → M6 from
   `subscribe_buffered` per R2 single-sample-with-cadence-knob
   semantics (F36), `recover_connection` reconnect loop (F16), recovery
   events (`RecoveryEvent::Started/Recovered/Failed`), and a typed
-  `Error` taxonomy. Optional `metrics` feature emits per-op counters,
-  latency histograms, and connection-state gauges (F40).
+  `Error` taxonomy. Recovery replay re-issues `RegisterReference` (not
+  `AdviseSupervisory`) for buffered subscriptions so the
+  `.property(buffer)` shape survives transport rebuild (F45);
+  `unsubscribe` skips the `UnAdvise` wire frame for buffered
+  subscriptions to match the .NET reference's `IsBuffered` guard
+  (F47). `Session::ensure_publisher_connected` issues the
+  `INmxService2::Connect` + `AddSubscriberEngine` round-trip before
+  the first advise against each publishing engine, so `0x33`
+  DataUpdate frames flow on this AVEVA install (F56). New
+  `WriteHandle { correlation_id }` returned by `*_with_handle` write
+  variants for per-operation correlation; `OperationStatus.context`
+  carries the originating `OperationContext` (F54). Optional
+  `metrics` feature emits per-op counters, latency histograms, and
+  connection-state gauges (F40).
 - **`mxaccess-compat`** — `LMXProxyServer`-shaped Rust facade exposing
   the 18-method `ILMXProxyServer5` surface as async fns over
   `mxaccess::Session` / `AsbSession` with a `Mutex<HashMap<i32,
   ItemRef>>` handle table and `Stream`-based event channels (F35).
+  `LmxClient` spawns an `operation_status_drain` fan-out task that
+  routes `Write` / `WriteSecured` events to `on_write_complete` and
+  every other op kind to `on_operation_complete`, dropping events
+  with unknown correlation ids silently (F54).
 - **Examples** — `connect-write-read.rs`, `subscribe.rs`,
   `subscribe-buffered.rs`, `asb-subscribe.rs`, `multi-tag.rs`,
   `recovery.rs`, `secured-write.rs`, plus diagnostic
@@ -63,6 +85,37 @@ V1 is the first publishable cut. Closes M0 → M6 from
 - **Tooling** — `cargo public-api` baselines under
   `design/public-api/{crate}.txt` with CI drift check (F41).
   `design/M6-bench-baseline.md` records the alloc-count baseline.
+- **Performance (post-baseline) — F52.** Three codec optimisations
+  measured against the F38 alloc-count harness:
+  - `write_message::encode_to_bytes_mut` (F52.1) — `BytesMut` output
+    so consumers can `split_to` / `freeze` and forward to a wire-level
+    sink without copying. Same alloc count as `encode`.
+  - Thread-local name-signature cache (F52.2) — repeated
+    `MxReferenceHandle::from_names` calls with the same names skip the
+    `to_lowercase` + CRC walk. `from_names` drops 2 → 0 allocs/op once
+    warm; bounded at 1024 entries per thread.
+  - `write_message::encode_into_bytes_mut` (F52.3) — caller-supplied
+    `BytesMut` scratch buffer; reusing across writes drops fixed-width
+    scalars from 2 → 1 alloc/op and Boolean from 1 → 0.
+  Bench deltas pinned in `design/M6-bench-baseline.md` § F52.{1,2,3}.
+- **Live evidence — F49 / F50 / F51.** F49 step 5 (`LmxClient`
+  `OnWriteComplete` round-trip) verified live against AVEVA via
+  `cargo test -p mxaccess-compat --features live-windows-com --test
+  lmx_write_complete_live`. F50 captured `Suspend` (NMX opcode `0x2D`,
+  server-side) + `Activate` (client-side, no wire traffic) under
+  `captures/123-frida-suspend-advised-instrumented/` +
+  `captures/124-frida-activate-advised-instrumented/`; R5 settled.
+  F51 provisioned 7 UDAs on `$TestMachine` via `wwtools/graccesscli`
+  (TestFloat / TestDouble / TestDateTime / TestDuration + array
+  variants), captured live `AsbVariant` wire bytes for each scalar
+  type, and pinned them via
+  `crates/mxaccess-codec/tests/f51_type_matrix_parity.rs`.
+- **`MxStatus` synthesizer kernel** — Path A from `Lmx.dll`
+  `FUN_10100ce0` ported into `MxStatus::from_packed_u32`. Settles R3
+  + R4 (`OperationComplete` trigger conditions and completion-only
+  byte mappings: the .NET reference's `WriteCompleted` is itself a
+  half-implementation; the Rust port preserves the wire bytes
+  verbatim and routes them through the synthesizer kernel).
 
 ### Changed (vs the .NET reference)
 
@@ -77,26 +130,35 @@ V1 is the first publishable cut. Closes M0 → M6 from
 ### Known limitations
 
 - **F3** — cross-domain NTLM Type1/2/3 fixture is permanently
-  out-of-scope on the dev host (single-domain). Single-domain wire
-  parity is verified; cross-domain is documented but not regression-
-  tested.
-- **F45** — recovery replay for buffered subscriptions falls through
-  to plain `AdviseSupervisory`, losing the `.property(buffer)`
-  registration. Filed as a follow-up.
-- **F46** — `LmxProxy.dll!CLMXProxyServer.Suspend`/`.Activate` wire
-  emission was not instrumented; the compatibility-server's
-  client-side gating is documented but the underlying ORPC call
-  shape is unconfirmed.
-- **R3 / R4** — `OperationComplete` trigger conditions and
-  completion-only byte mappings are unmapped in both the .NET
-  reference and the Rust port. Frame bytes are preserved verbatim
-  via `Session::operation_status_events()`.
+  out-of-scope on the dev host (single-domain only). Single-domain
+  wire parity is verified; cross-domain rounds-trip through the same
+  shape-agnostic AV-pair codec but no live fixture pins it. Self-
+  contained provisioning recipe (lab topology, capture procedure,
+  fixture layout, round-trip test skeleton) at
+  `docs/F3-cross-domain-ntlm-recipe.md` for whoever has access to a
+  two-forest Windows lab.
+- **F53 (protocol crates only)** — `#![warn(missing_docs)]` is
+  enabled and warning-clean on the consumer-facing `mxaccess` +
+  `mxaccess-compat` lib roots. Protocol crates measure 1883
+  missing-docs warnings (mostly struct-field-level wire-shape
+  records); enabling the lint there would add per-field one-liners
+  without consumer value. Lint stays off on protocol crates
+  indefinitely. Per-module `#![allow(missing_docs)]` opt-out is the
+  re-introduction path if a contributor wants per-crate enforcement.
 
 ## Publish order
 
+> **Note (2026-05-06, F48):** the workspace will not be published to
+> crates.io. Internal usage only; consumers depend via path or git.
+> The dependency DAG below is retained as a workspace-hygiene check
+> (`design/F48-publish-dry-run.md` validates each crate's `cargo
+> package --list` produces a clean tarball with no accidental
+> captures or large files) and as the publish recipe if the policy
+> ever changes (e.g. an internal contributor wants registry-style
+> versioning via a private cargo registry).
+
 Workspace crates form a dependency DAG; `cargo publish` requires
-already-published deps to exist on crates.io, so the order matters.
-For V1 cut:
+already-published deps to exist on crates.io, so the order matters:
 
 1. `mxaccess-codec` (no internal deps)
 2. `mxaccess-rpc` (no internal deps)

analysis/frida/mx-nmx-trace.js

@@ -1,5 +1,55 @@
 // Frida hooks generated from headless Ghidra RVAs.
 // Usage: frida -f <MxTraceHarness.exe> -l analysis/frida/mx-nmx-trace.js -- <harness args>
+//
+// F46 — Suspend / Activate instrumentation procedure
+// ---------------------------------------------------
+// The `mx.suspend.*` and `mx.activate.*` events below close the wire-side gap
+// left by capture 077 (`captures/077-frida-suspend-advised-scanstate/`). The
+// hooks attach to `LmxProxy.dll!CLMXProxyServer.Suspend` (RVA 0x13d9c, FUN_10013d9c)
+// and `LmxProxy.dll!CLMXProxyServer.Activate` (RVA 0x14028, FUN_10014028) — the
+// two RVAs were extracted from `analysis/ghidra/exports/LmxProxy.dll.string-refs.tsv`
+// (rows tagged `CLMXProxyServer::Suspend - Server Handle` and
+// `CLMXProxyServer::Activate - Server Handle`). The export table does NOT
+// expose `Resume` or `Reactivate` symbols anywhere in `LmxProxy.dll`,
+// `Lmx.dll`, or the `ILMXProxyServer5` interface — verified against
+// `analysis/ghidra/exports/LmxProxy.dll.ghidra.md` and the decompiled
+// interface at `analysis/decompiled-mxaccess/ArchestrA/MxAccess/ILMXProxyServer5.cs`.
+//
+// To re-run capture 077 with the new hooks active (left for the maintainer
+// on the live AVEVA host):
+//
+//   1. Rebuild the x86 trace harness:
+//        msbuild src\MxTraceHarness\MxTraceHarness.csproj /p:Configuration=Release
+//   2. Suspend-advised scenario:
+//        frida ^
+//          -f src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe ^
+//          -l analysis\frida\mx-nmx-trace.js ^
+//          -- --scenario=suspend-advised ^
+//             --tag=TestChildObject.ScanState ^
+//             --write-delay-ms=1000 ^
+//             --duration=3 ^
+//             --log=captures\NNN-frida-suspend-activate-instrumented\harness.log ^
+//             --client=MxFridaTrace-NNN
+//   3. Activate-advised scenario (re-runs Suspend then Activate):
+//        frida ^
+//          -f src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe ^
+//          -l analysis\frida\mx-nmx-trace.js ^
+//          -- --scenario=activate-advised ^
+//             --tag=TestChildObject.ScanState ^
+//             --write-delay-ms=1000 ^
+//             --duration=3 ^
+//             --log=captures\NNN-frida-suspend-activate-instrumented\harness.log ^
+//             --client=MxFridaTrace-NNN
+//   4. Save the resulting `frida-events.tsv` (plus `harness.log`,
+//      `frida-command.txt`, `frida.stdout.jsonl`) under
+//      `captures/NNN-frida-suspend-activate-instrumented/` (next free NNN).
+//   5. Grep for `mx.suspend.begin|mx.suspend.end|mx.activate.begin|mx.activate.end`
+//      in the new TSV. If any matching `nmx.enter` / `lmx.*` events appear in
+//      the same time window — typed decode the body and update
+//      `analysis/proxy/nmxsvcps-procedures.tsv` + `docs/M6-buffered-evidence.md`.
+//      If no NMX traffic accompanies the hook fires — Suspend/Activate are
+//      confirmed client-side-only and R5 in `design/70-risks-and-open-questions.md`
+//      moves to "fully settled — client-side only".
 
 const maxDump = 4096;
 const installed = {};
@@ -173,6 +223,79 @@ function hookPlainArgs(moduleName, rva, name, argCount) {
   });
 }
 
+function readMxStatusOut(ptrValue) {
+  // MxStatus on the wire is 4 × int16 = 8 bytes:
+  //   short Success, short Category, short DetectedBy, short Detail.
+  // See src/MxNativeCodec/MxStatus.cs and the .NET reference's
+  // `out MxStatus pMxStatus` parameter on ILMXProxyServer5.{Suspend,Activate}.
+  try {
+    if (ptrValue.isNull()) return null;
+    return {
+      raw: dumpBytes(ptrValue, 8),
+      success: ptrValue.add(0).readS16(),
+      category: ptrValue.add(2).readS16(),
+      detectedBy: ptrValue.add(4).readS16(),
+      detail: ptrValue.add(6).readS16()
+    };
+  } catch (e) {
+    return { error: e.message };
+  }
+}
+
+function hookSuspendActivate(rva, name, eventVerb) {
+  // CLMXProxyServer::Suspend / Activate are __stdcall member methods:
+  //   HRESULT Suspend(int hLMXServerHandle, int hItem, MxStatus* pMxStatusOut)
+  // After Frida's __stdcall lowering, args[0] = this (because the prologue
+  // pushes ECX into the stack frame the same way AdviseSupervisory does at
+  // RVA 0x142b4), args[1] = serverHandle, args[2] = itemHandle,
+  // args[3] = MxStatus* out. Mirrors the AdviseSupervisory hookPlainArgs
+  // shape but with typed out-param decoding (cf. hookAuthenticateUser).
+  hook("LmxProxy.dll", rva, name, function (address, module) {
+    return {
+      onEnter(args) {
+        this.statusOut = ptrArg(args, 3);
+        this.serverHandle = intArg(args, 1);
+        this.itemHandle = intArg(args, 2);
+        emit({
+          event: "mx." + eventVerb + ".begin",
+          module: "LmxProxy.dll",
+          name,
+          address: address.toString(),
+          ecx: this.context.ecx ? this.context.ecx.toString() : "",
+          serverHandle: this.serverHandle,
+          itemHandle: this.itemHandle,
+          statusOutPtr: this.statusOut.toString()
+        });
+      },
+      onLeave(retval) {
+        emit({
+          event: "mx." + eventVerb + ".end",
+          module: "LmxProxy.dll",
+          name,
+          retval: retval.toString(),
+          serverHandle: this.serverHandle,
+          itemHandle: this.itemHandle,
+          status: readMxStatusOut(this.statusOut)
+        });
+      }
+    };
+  });
+}
+
+function hookSuspend() {
+  // FUN_10013d9c, RVA 0x13d9c; matched on the
+  // `CLMXProxyServer::Suspend - Server Handle ` string xref in
+  // analysis/ghidra/exports/LmxProxy.dll.string-refs.tsv:119.
+  hookSuspendActivate(0x13d9c, "CLMXProxyServer.Suspend", "suspend");
+}
+
+function hookActivate() {
+  // FUN_10014028, RVA 0x14028; matched on the
+  // `CLMXProxyServer::Activate - Server Handle ` string xref in
+  // analysis/ghidra/exports/LmxProxy.dll.string-refs.tsv:122.
+  hookSuspendActivate(0x14028, "CLMXProxyServer.Activate", "activate");
+}
+
 function hookAuthenticateUser() {
   hook("LmxProxy.dll", 0x1399f, "CLMXProxyServer.AuthenticateUser", function (address, module) {
     return {
@@ -452,6 +575,12 @@ function installKnownHooks() {
   hookPlainArgs("LmxProxy.dll", 0x1121d, "CLMXProxyServer.AddBufferedItem", 5);
   hookPlainArgs("LmxProxy.dll", 0x0fc80, "CLMXProxyServer.SetBufferedUpdateInterval", 3);
   hookPlainArgs("LmxProxy.dll", 0x142b4, "CLMXProxyServer.AdviseSupervisory", 5);
+  // F46: Suspend / Activate wire-side instrumentation. No `Resume` / `Reactivate`
+  // exports exist in LmxProxy.dll's symbol table — verified against
+  // analysis/ghidra/exports/LmxProxy.dll.ghidra.md and the
+  // ILMXProxyServer5 / ILMXProxyServer4 decompiled interfaces.
+  hookSuspend();
+  hookActivate();
   hookPlainArgs("LmxProxy.dll", 0x163c0, "CProxy_ILMXProxyServerEvents2.Fire_OnBufferedDataChange", 8);
   hookPlainArgs("LmxProxy.dll", 0x16b50, "CUserConnectionCallback.OnSetAttributeResult", 4);
   hookPlainArgs("LmxProxy.dll", 0x16d4b, "CUserConnectionCallback.OperationComplete", 4);

analysis/ghidra/exports/Lmx.dll.aadct-decompile.md

@@ -0,0 +1,35 @@
+# Lmx.dll selected decompile
+
+## FUN_10178fc0 at 10178fc0
+
+Signature: `undefined FUN_10178fc0(void)`
+
+```c
+
+void FUN_10178fc0(void)
+
+{
+  uint uVar1;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  puStack_c = &LAB_101663ae;
+  local_10 = ExceptionList;
+  uVar1 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  local_8 = 1;
+  DAT_101d6160 = SysAllocString(L"Lmx.aaDCT");
+  if (DAT_101d6160 == (BSTR)0x0) {
+                    /* WARNING: Subroutine does not return */
+    FUN_100013e0(0x8007000e,uVar1);
+  }
+  local_8 = 0xffffffff;
+  _atexit(FUN_101793a0);
+  ExceptionList = local_10;
+  return;
+}
+
+
+```
+

analysis/ghidra/exports/Lmx.dll.set-attribute-result-decompile.md

@@ -0,0 +1,501 @@
+# Lmx.dll selected decompile
+
+## FUN_10114a90 at 10114a90
+
+Signature: `undefined FUN_10114a90(void)`
+
+```c
+
+void __thiscall
+FUN_10114a90(undefined4 *param_1,int param_2,int *param_3,ushort param_4,undefined4 param_5,
+            void *param_6,short *param_7)
+
+{
+  char cVar1;
+  uint uVar2;
+  undefined4 uVar3;
+  basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *pbVar4;
+  int iVar5;
+  undefined4 *puVar6;
+  wchar_t *pwVar7;
+  wchar_t *pwVar8;
+  size_t _MaxCount;
+  DWORD DVar9;
+  int iVar10;
+  int *piVar11;
+  undefined2 uVar12;
+  wchar_t _Ch;
+  _func_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr
+  *p_Var13;
+  undefined4 uVar14;
+  undefined1 local_ba4 [20];
+  undefined1 local_b90 [20];
+  undefined4 local_b7c;
+  undefined4 local_b74;
+  void *local_b70;
+  short *local_b6c;
+  undefined4 *local_b68;
+  int *local_b64;
+  char local_b5e;
+  char local_b5d;
+  undefined4 *local_b5c [391];
+  wchar_t local_540 [520];
+  undefined1 local_130 [20];
+  undefined1 local_11c [20];
+  undefined1 local_108 [60];
+  undefined1 local_cc [20];
+  undefined4 local_b8 [36];
+  undefined4 local_28;
+  undefined4 local_24;
+  undefined4 local_20;
+  uint local_14;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  local_8 = 0xffffffff;
+  puStack_c = &LAB_101729a5;
+  local_10 = ExceptionList;
+  uVar2 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  local_b5c[0] = (undefined4 *)(uint)param_4;
+  local_b74 = param_5;
+  local_b70 = param_6;
+  local_b6c = param_7;
+  local_14 = uVar2;
+  cVar1 = FUN_100408d0(uVar2);
+  if (cVar1 != '\0') {
+    local_20 = *(undefined4 *)(local_b6c + 2);
+    swprintf_s(local_540,0x104,L"<success %d category %d detectedBy %d detail %d>",
+               (int)(short)*(undefined4 *)local_b6c,local_20,*(undefined4 *)(local_b6c + 4),
+               (int)local_b6c[6]);
+    local_b64 = (int *)FUN_10004010(local_b74,local_b70);
+    local_b5c[0] = (undefined4 *)FUN_100040a0(local_b5c[0]);
+    uVar3 = FUN_100300d0(param_3);
+    iVar5 = param_2;
+    p_Var13 = endl_exref;
+    pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x20),
+                          L"PreboundReference::OnSetAttributeResult - ENTER correlationId ",param_2,
+                          L" pValue ",uVar3,L" quality ",local_b5c[0],L" timestamp ",local_b64,
+                          L" mxStatus ",local_540);
+    pbVar4 = std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+                       (pbVar4,iVar5);
+    uVar3 = FUN_1001a0e0(pbVar4);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(uVar3);
+    std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+              (pbVar4,p_Var13);
+  }
+  if (param_2 == 0) {
+    if (*local_b6c == -1) {
+      iVar5 = (**(code **)(*param_3 + 0x60))(param_3,&local_b68);
+      iVar5 = FUN_10048e60(iVar5 == 0,iVar5,300,"preboundreference.cpp");
+      if (iVar5 == 0) goto LAB_1011543c;
+      if (local_b68 != (undefined4 *)0x0) {
+        local_b64 = (int *)0x0;
+        local_8 = 1;
+        uVar12 = 0x1011;
+        iVar5 = (**(code **)(*param_3 + 0x80))(param_3,&local_b64);
+        if (iVar5 == 0) {
+          FUN_1008e710(local_b64);
+          local_8._0_1_ = 2;
+          FUN_10112f20(local_b90);
+          local_8._0_1_ = 1;
+          FUN_10021cc0();
+          FUN_1005f730(&local_28);
+          uVar3 = CONCAT22(uVar12,(undefined2)local_20);
+          cVar1 = FUN_100057b0(local_28,local_24,uVar3,0x138,"preboundreference.cpp");
+          uVar12 = (undefined2)((uint)uVar3 >> 0x10);
+          if (cVar1 != '\0') {
+            FUN_1004c220();
+            local_8._0_1_ = 3;
+            FUN_1004c320(param_1[0x14]);
+            local_b5c[0] = local_b8;
+            uVar12 = 0x1011;
+            FUN_10073b80(local_b5c,0);
+            iVar5 = FUN_1005f730(local_130);
+            FUN_10040470(*(undefined2 *)(iVar5 + 2));
+            local_8._0_1_ = 1;
+            FUN_1002e080();
+          }
+          cVar1 = FUN_100057b0(local_28,local_24,CONCAT22(uVar12,(undefined2)local_20),0x144,
+                               "preboundreference.cpp");
+          if (cVar1 == '\0') {
+            param_1[0x2a] = 4;
+          }
+          else {
+            iVar5 = FUN_1005f730(local_11c);
+            if (*(short *)(iVar5 + 10) == 0) {
+              FUN_101131d0();
+            }
+            else {
+              param_1[0x2a] = 3;
+              param_1[0x29] = 0;
+              FUN_10114620();
+            }
+          }
+        }
+        local_8 = 0xffffffff;
+        if (local_b64 != (int *)0x0) {
+          (**(code **)(*local_b64 + 8))(local_b64);
+        }
+        goto LAB_1011543c;
+      }
+    }
+    else if (((DAT_101d8c40 == 2) && (param_1[0x29] == 0)) &&
+            (*(ushort *)(param_1[0x19] + 0x2ac) - 0x7c17 < 0x3e9)) {
+      cVar1 = FUN_100408d0(uVar2);
+      if (cVar1 != '\0') {
+        uVar3 = FUN_10003fc0(*(undefined4 *)local_b6c,*(undefined4 *)(local_b6c + 2),
+                             *(undefined4 *)(local_b6c + 4),*(undefined4 *)(local_b6c + 6));
+        p_Var13 = endl_exref;
+        uVar3 = FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x1c),
+                             L"PreboundReference - attempting local platform <",param_1 + 6,
+                             L">  - status ",uVar3);
+        uVar3 = FUN_1001dec0(uVar3);
+        uVar3 = FUN_1001a0e0(uVar3);
+        pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+                 FUN_1001a0e0(uVar3);
+        std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+                  (pbVar4,p_Var13);
+      }
+      param_1[5] = param_1[5] + 1;
+      param_1[0x2a] = 1;
+      param_1[0x29] = 1;
+      FUN_10112cd0();
+      goto LAB_1011543c;
+    }
+LAB_10115432:
+    param_1[0x2a] = 4;
+    goto LAB_1011543c;
+  }
+  if (param_2 != 1) goto LAB_1011543c;
+  param_1[0x2a] = 6;
+  if (*local_b6c != -1) {
+    if (*(char *)(param_1 + 0x1b) != '\0') {
+      if ((uint)param_1[0x21] < 8) {
+        puVar6 = param_1 + 0x1c;
+      }
+      else {
+        puVar6 = (undefined4 *)param_1[0x1c];
+      }
+      iVar5 = (**(code **)(*(int *)param_1[0x14] + 0x44))((int *)param_1[0x14],puVar6);
+      if (iVar5 < 0) {
+                    /* WARNING: Subroutine does not return */
+        FUN_1005bf30(iVar5,0,"E:\\BldSrc\\6\\s\\ExtInterfaces\\Lmx\\IMxReferencePtr.h",0x75);
+      }
+      *(undefined1 *)(param_1 + 0x1b) = 0;
+    }
+    if (*(int *)(local_b6c + 2) == 3) {
+LAB_1011502e:
+      param_1[0x2a] = 6;
+      goto LAB_1011543c;
+    }
+    if ((*(int *)(local_b6c + 2) == 4) && (local_b6c[6] == 0x1f42)) {
+      local_b70 = operator_new(8);
+      local_8 = 0xb;
+      if (local_b70 == (void *)0x0) {
+        local_b5c[0] = (undefined4 *)0x0;
+      }
+      else {
+        local_b5c[0] = (undefined4 *)FUN_10112b50(param_1);
+      }
+      local_8 = 0xffffffff;
+      cVar1 = FUN_10048d60(local_b5c[0] != (undefined4 *)0x0,0x23b,"preboundreference.cpp");
+      if (cVar1 != '\0') {
+        uVar3 = FUN_10016fd0();
+        FUN_1005f7e0(uVar3);
+        FUN_1004c220();
+        local_8 = 0xc;
+        FUN_1004c320(param_1[0x14]);
+        local_b68 = local_b8;
+        FUN_10073b80(&local_b68,0);
+        param_1[5] = param_1[5] + 1;
+        param_1[0x2a] = 1;
+        DVar9 = GetTickCount();
+        FUN_1008f150(local_b5c[0],0,0,0,0,*(undefined4 *)local_b6c,*(undefined4 *)(local_b6c + 2),
+                     *(undefined4 *)(local_b6c + 4),*(undefined4 *)(local_b6c + 6),0,DVar9);
+        local_8 = 0xffffffff;
+        FUN_1002e080();
+      }
+      goto LAB_1011543c;
+    }
+    goto LAB_10115432;
+  }
+  iVar5 = (**(code **)(*param_3 + 0x60))(param_3,&local_b68);
+  iVar5 = FUN_10048e60(iVar5 == 0,iVar5,0x19d,"preboundreference.cpp");
+  if (iVar5 == 0) goto LAB_1011543c;
+  if (local_b68 == (undefined4 *)0x0) goto LAB_1011502e;
+  local_b64 = (int *)0x0;
+  local_8 = 6;
+  uVar12 = 0x1011;
+  iVar5 = (**(code **)(*param_3 + 0x80))(param_3,&local_b64);
+  if (iVar5 == 0) {
+    FUN_1008e710(local_b64);
+    local_8._0_1_ = 7;
+    FUN_10112f20(local_ba4);
+    local_8 = CONCAT31(local_8._1_3_,6);
+    FUN_10021cc0();
+    if (*(char *)(param_1 + 0x1b) != '\0') {
+      piVar11 = param_1 + 0x1c;
+      if (7 < (uint)param_1[0x21]) {
+        piVar11 = (int *)*piVar11;
+      }
+      FUN_1005f700(piVar11);
+      *(undefined1 *)(param_1 + 0x1b) = 0;
+    }
+    iVar5 = FUN_1005f730(local_108);
+    if (*(short *)(iVar5 + 10) == 0) {
+      local_b5d = '\0';
+      local_b5e = '\0';
+      puVar6 = (undefined4 *)FUN_1005f730(local_cc);
+      cVar1 = FUN_100057b0(*puVar6,puVar6[1],CONCAT22(uVar12,*(undefined2 *)(puVar6 + 2)),0x1c1,
+                           "preboundreference.cpp");
+      if (cVar1 == '\0') {
+        if (*(char *)(param_1 + 4) != '\0') {
+          FUN_1004c220();
+          local_8._0_1_ = 8;
+          FUN_1004c320(param_1[0x14]);
+          local_b5c[0] = local_b8;
+          FUN_10073b80(local_b5c,0);
+          local_8 = CONCAT31(local_8._1_3_,6);
+          FUN_1002e080();
+        }
+        local_b5e = '\x01';
+      }
+      else {
+        pwVar7 = (wchar_t *)FUN_1005f590();
+        cVar1 = FUN_10134a10(pwVar7);
+        if (cVar1 == '\0') {
+          pwVar8 = wcschr(pwVar7,L'.');
+          if ((pwVar8 != (wchar_t *)0x0) &&
+             (_MaxCount = (int)pwVar8 - (int)pwVar7 >> 1, _MaxCount != 0)) {
+            pwVar8 = (wchar_t *)FUN_1005f610();
+            iVar5 = _wcsnicmp(pwVar7,pwVar8,_MaxCount);
+            if (iVar5 == 0) {
+              _Ch = L'.';
+              pwVar7 = (wchar_t *)FUN_1005f660();
+              pwVar7 = wcschr(pwVar7,_Ch);
+              if (pwVar7 == (wchar_t *)0x0) goto LAB_10114e2f;
+            }
+            local_b5d = '\x01';
+          }
+        }
+      }
+LAB_10114e2f:
+      if ((*(char *)(param_1 + 4) == '\0') || ((local_b5d == '\0' && (local_b5e == '\0')))) {
+        param_1[0x2a] = 4;
+      }
+      else {
+        local_b70 = operator_new(8);
+        local_8._0_1_ = 9;
+        if (local_b70 == (void *)0x0) {
+          local_b5c[0] = (undefined4 *)0x0;
+        }
+        else {
+          local_b5c[0] = (undefined4 *)FUN_10112b50(param_1);
+        }
+        local_8 = CONCAT31(local_8._1_3_,6);
+        cVar1 = FUN_10048d60(local_b5c[0] != (undefined4 *)0x0,0x1ee,"preboundreference.cpp");
+        if (cVar1 == '\0') {
+          param_1[0x2a] = 4;
+          iVar5 = FUN_10022ff0();
+          if (*(int *)(iVar5 + 0xac) == 0) {
+            iVar10 = FUN_1002f080();
+            if (iVar10 != 0) goto LAB_10114f66;
+            uVar3 = 0;
+          }
+          else {
+LAB_10114f66:
+            uVar3 = *(undefined4 *)(iVar5 + 0xac);
+          }
+          uVar14 = 0;
+          FUN_10022ff0(uVar3,0);
+          cVar1 = FUN_10022ba0(uVar3,uVar14);
+          if (cVar1 != '\0') {
+            uVar3 = FUN_1005f590();
+            uVar3 = FUN_10022ff0(L"PreboundReference::OnSetAttributeResult unable to crreate CPreboundReferenceAdapter for ref %s"
+                                 ,uVar3);
+            FUN_10022cb0(uVar3);
+          }
+        }
+        else {
+          *(undefined1 *)(param_1 + 4) = 0;
+          uVar3 = FUN_10016fd0();
+          FUN_1005f7e0(uVar3);
+          FUN_1008fc40(&DAT_1017a514);
+          FUN_1008fc70(&DAT_1017a514);
+          param_1[5] = param_1[5] + 1;
+          param_1[0x2a] = 1;
+          DVar9 = GetTickCount();
+          local_b70 = (void *)CONCAT22(local_b70._2_2_,0x1f42);
+          local_b7c = (uint)local_b7c._2_2_ << 0x10;
+          FUN_1008f150(local_b5c[0],0,0,0,0,local_b7c,4,0,local_b70,0,DVar9);
+        }
+      }
+    }
+    else {
+      param_1[0x2a] = 3;
+      param_1[0x29] = 0;
+      FUN_10114620();
+    }
+  }
+  local_8 = 0xffffffff;
+  if (local_b64 != (int *)0x0) {
+    (**(code **)(*local_b64 + 8))(local_b64);
+  }
+LAB_1011543c:
+  if (*(char *)(param_1 + 0x1b) != '\0') {
+    if ((uint)param_1[0x21] < 8) {
+      puVar6 = param_1 + 0x1c;
+    }
+    else {
+      puVar6 = (undefined4 *)param_1[0x1c];
+    }
+    iVar5 = (**(code **)(*(int *)param_1[0x14] + 0x44))((int *)param_1[0x14],puVar6);
+    if (iVar5 < 0) {
+                    /* WARNING: Subroutine does not return */
+      FUN_1005bf30(iVar5,0,"E:\\BldSrc\\6\\s\\ExtInterfaces\\Lmx\\IMxReferencePtr.h",0x75);
+    }
+    *(undefined1 *)(param_1 + 0x1b) = 0;
+  }
+  if ((param_1[0x2a] != 1) && (param_1[0x2a] != 2)) {
+    FUN_10050df0(local_b6c,param_1);
+  }
+  piVar11 = param_1 + 5;
+  *piVar11 = *piVar11 + -1;
+  if (*piVar11 == 0) {
+    (**(code **)*param_1)(1);
+  }
+  local_b5c[0] = (undefined4 *)param_1[0x2a];
+  if (param_1[5] == 1) {
+    local_b68 = param_1;
+    piVar11 = (int *)FUN_100484c0(&local_b70,&local_b68);
+    iVar5 = *piVar11;
+    cVar1 = FUN_10048d60(iVar5 != *(int *)(param_1[0x19] + 0x180),0x273,"preboundreference.cpp");
+    if (cVar1 != '\0') {
+      FUN_100382e0(&local_b70,iVar5);
+      piVar11 = param_1 + 5;
+      *piVar11 = *piVar11 + -1;
+      if (*piVar11 == 0) {
+        (**(code **)*param_1)(1);
+      }
+    }
+  }
+  cVar1 = FUN_100408d0();
+  if (cVar1 != '\0') {
+    uVar3 = FUN_10001e20(local_b5c);
+    p_Var13 = endl_exref;
+    uVar3 = FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x20),
+                         L"PreboundReference::OnSetAttributeResult - EXIT status ",uVar3);
+    pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(uVar3);
+    std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+              (pbVar4,p_Var13);
+  }
+  ExceptionList = local_10;
+  __security_check_cookie(local_14 ^ (uint)&stack0xfffffffc);
+  return;
+}
+
+
+```
+
+## FUN_100dc750 at 100dc750
+
+Signature: `undefined FUN_100dc750(void)`
+
+```c
+
+void __thiscall FUN_100dc750(int *param_1,uint param_2,int param_3,int param_4,BSTR param_5)
+
+{
+  char cVar1;
+  uint uVar2;
+  undefined4 uVar3;
+  basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *pbVar4;
+  undefined4 *puVar5;
+  _func_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr
+  *p_Var6;
+  uint local_23c;
+  int *local_234;
+  BSTR local_230;
+  uint local_22c;
+  int local_228;
+  int local_224;
+  BSTR local_220;
+  wchar_t local_21c [260];
+  uint local_14;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  local_8 = 0xffffffff;
+  puStack_c = &LAB_1016d12b;
+  local_10 = ExceptionList;
+  uVar2 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  local_14 = uVar2;
+  cVar1 = FUN_100408d0(uVar2);
+  if (cVar1 != '\0') {
+    local_23c._0_2_ = (short)param_2;
+    swprintf_s(local_21c,0x104,L"<success %d category %d detectedBy %d detail %d>",
+               (int)(short)local_23c,param_3,param_4,(int)(short)param_5);
+    p_Var6 = endl_exref;
+    uVar3 = FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x14),
+                         L"DemandReadCallback::CancelWithStatus - status ",local_21c);
+    pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(uVar3);
+    std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+              (pbVar4,p_Var6);
+  }
+  if (((param_3 == 5) && (param_4 == 0)) && ((short)param_5 == 1)) {
+    local_23c = param_2 & 0xffff0000;
+    local_230 = (BSTR)CONCAT22(local_230._2_2_,5);
+    local_228 = 3;
+    local_22c = local_23c;
+    local_224 = 2;
+    local_220 = local_230;
+  }
+  else {
+    local_22c = param_2;
+    local_228 = param_3;
+    local_224 = param_4;
+    local_220 = param_5;
+  }
+  cVar1 = FUN_100408d0(uVar2);
+  if (cVar1 != '\0') {
+    swprintf_s(local_21c,0x104,L"<success %d category %d detectedBy %d detail %d>",
+               (int)(short)local_22c,local_228,local_224,(int)(short)local_220);
+    p_Var6 = endl_exref;
+    uVar3 = FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x14),
+                         L"DemandReadCallback::CancelWithStatus - Calling OnGetAttributeResult with status "
+                         ,local_21c);
+    pbVar4 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(uVar3);
+    std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+              (pbVar4,p_Var6);
+  }
+  puVar5 = (undefined4 *)FUN_10005170();
+  local_8 = 0;
+  (**(code **)(*param_1 + 4))(*puVar5,0,DAT_101d6504,DAT_101d6508,&local_22c);
+  local_8 = 0xffffffff;
+  if (local_234 != (int *)0x0) {
+    (**(code **)(*local_234 + 8))(local_234);
+  }
+  SysFreeString(local_230);
+  ExceptionList = local_10;
+  __security_check_cookie(local_14 ^ (uint)&stack0xfffffffc);
+  return;
+}
+
+
+```
+

analysis/ghidra/exports/Lmx.dll.set-attribute-result-xrefs.md

@@ -0,0 +1,35 @@
+# Lmx.dll xrefs
+
+## 0x114a90 at 10114a90
+
+Target function: `FUN_10114a90`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10196410` | `DATA` | `` |
+
+## 0x100dc750 at 100dc750
+
+Target function: `FUN_100dc750`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1018f268` | `DATA` | `` |
+
+## 0x1010b990 at 1010b990
+
+Target function: `FUN_1010b990`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1010cf49` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010e440` | `UNCONDITIONAL_CALL` | `FUN_1010e410` |
+
+## 0x1010dc80 at 1010dc80
+
+Target function: `FUN_1010dc80`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10195488` | `DATA` | `` |
+

analysis/ghidra/exports/Lmx.dll.synthesizer-callers-xrefs.md

@@ -0,0 +1,119 @@
+# Lmx.dll xrefs
+
+## 0x1010bd10 at 1010bd10
+
+Target function: `FUN_1010bd10`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1010d89b` | `UNCONDITIONAL_CALL` | `FUN_1010d4a0` |
+
+## 0x1010e410 at 1010e410
+
+Target function: `FUN_1010e410`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `101956a8` | `DATA` | `` |
+
+## 0x10101360 at 10101360
+
+Target function: `FUN_10101360`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10061e82` | `UNCONDITIONAL_CALL` | `FUN_10061c60` |
+| `10110335` | `UNCONDITIONAL_CALL` | `` |
+
+## 0x10100ce0 at 10100ce0
+
+Target function: `FUN_10100ce0`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1010c2ea` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c474` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c50d` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c5fb` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c8ac` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010ca5f` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010cb16` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010cd61` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010f27d` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010f365` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010fa8d` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010facf` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+
+## 0x10100bc0 at 10100bc0
+
+Target function: `FUN_10100bc0`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1010c47e` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c605` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010ca69` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010cb20` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+
+## 0x1005e580 at 1005e580
+
+Target function: `FUN_1005e580`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1010c612` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010ca76` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010f51a` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010f8bb` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010fa76` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `1010fab8` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `10110415` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `10110440` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `10110513` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `101116fc` | `UNCONDITIONAL_CALL` | `` |
+| `10111ab6` | `UNCONDITIONAL_CALL` | `` |
+| `10111d51` | `UNCONDITIONAL_CALL` | `` |
+| `10111884` | `UNCONDITIONAL_CALL` | `` |
+| `101118d2` | `UNCONDITIONAL_CALL` | `` |
+| `10111b52` | `UNCONDITIONAL_CALL` | `` |
+| `10110be2` | `UNCONDITIONAL_CALL` | `FUN_10110986` |
+| `10110c03` | `UNCONDITIONAL_CALL` | `FUN_10110986` |
+
+## 0x10067aa0 at 10067aa0
+
+Target function: `FUN_10067aa0`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1006afb2` | `UNCONDITIONAL_CALL` | `FUN_10069c30` |
+| `101044a9` | `UNCONDITIONAL_CALL` | `Catch@10104467` |
+| `100fd351` | `UNCONDITIONAL_CALL` | `FUN_100fd200` |
+| `10067d89` | `UNCONDITIONAL_CALL` | `FUN_10067d30` |
+| `100fd560` | `UNCONDITIONAL_CALL` | `FUN_100fd400` |
+| `100ffe3a` | `UNCONDITIONAL_CALL` | `FUN_100ffc90` |
+| `1010951d` | `UNCONDITIONAL_CALL` | `FUN_10107880` |
+| `1010bfcc` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c250` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c2bb` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c7a4` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010d27a` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010f497` | `UNCONDITIONAL_CALL` | `FUN_1010ee00` |
+| `10070743` | `UNCONDITIONAL_CALL` | `FUN_10070360` |
+| `10070869` | `UNCONDITIONAL_CALL` | `FUN_10070360` |
+| `10070a01` | `UNCONDITIONAL_CALL` | `FUN_10070360` |
+
+## 0x100860c0 at 100860c0
+
+Target function: `FUN_100860c0`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10069f19` | `UNCONDITIONAL_CALL` | `FUN_10069c30` |
+| `1006a588` | `UNCONDITIONAL_CALL` | `FUN_10069c30` |
+| `10138a4b` | `UNCONDITIONAL_CALL` | `FUN_101389c0` |
+| `1010c158` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c206` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010c5ba` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010d0b4` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+| `1010d167` | `UNCONDITIONAL_CALL` | `FUN_1010bd10` |
+

analysis/ghidra/exports/Lmx.dll.synthesizer-helpers-decompile.md

@@ -0,0 +1,574 @@
+# Lmx.dll selected decompile
+
+## FUN_10003fc0 at 10003fc0
+
+Signature: `undefined FUN_10003fc0(void)`
+
+```c
+
+wchar_t * __thiscall
+FUN_10003fc0(wchar_t *param_1,short param_2,undefined4 param_3,undefined4 param_4,short param_5)
+
+{
+  swprintf_s(param_1,0x104,L"<success %d category %d detectedBy %d detail %d>",(int)param_2,param_3,
+             param_4,(int)param_5);
+  return param_1;
+}
+
+
+```
+
+## FUN_10016fd0 at 10016fd0
+
+Signature: `undefined FUN_10016fd0(void)`
+
+```c
+
+void __fastcall FUN_10016fd0(int *param_1)
+
+{
+  byte bStack_17;
+  
+  *param_1 = (uint)bStack_17 << 8;
+  param_1[1] = 0;
+  param_1[2] = 0;
+  param_1[3] = 0;
+  param_1[4] = 0;
+  return;
+}
+
+
+```
+
+## FUN_1008f150 at 1008f150
+
+Signature: `undefined FUN_1008f150(void)`
+
+```c
+
+void __thiscall
+FUN_1008f150(int param_1,int *param_2,undefined4 param_3,undefined4 param_4,undefined4 param_5,
+            undefined4 param_6,undefined4 param_7,undefined4 param_8,undefined4 param_9,
+            undefined4 param_10,undefined4 param_11)
+
+{
+  int iVar1;
+  char cVar2;
+  undefined4 uVar3;
+  undefined4 uVar4;
+  basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *pbVar5;
+  int iVar6;
+  int *piVar7;
+  _func_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr_basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>_ptr
+  *p_Var8;
+  int *local_258;
+  undefined4 local_254;
+  ulong local_250;
+  ushort local_24c;
+  ushort uStack_24a;
+  uchar local_248 [4];
+  uchar local_244 [4];
+  undefined4 local_240;
+  undefined4 local_23c;
+  undefined4 local_238;
+  undefined4 local_234;
+  undefined4 local_230;
+  undefined4 local_22c;
+  undefined4 local_228;
+  undefined4 local_224;
+  GUID local_220 [33];
+  uint local_8;
+  
+  local_8 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  CoCreateGuid(local_220);
+  cVar2 = FUN_100408d0();
+  if (cVar2 != '\0') {
+    uVar3 = FUN_10047fe0(local_220[0].Data1,local_220[0]._4_4_,local_220[0].Data4._0_4_,
+                         local_220[0].Data4._4_4_);
+    p_Var8 = endl_exref;
+    uVar4 = (**(code **)(*param_2 + 8))();
+    piVar7 = param_2;
+    pbVar5 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(*(undefined4 *)(DAT_101d6474 + 0x38),
+                          L"CReferenceStringResolver::ResolveReference - reference ",param_2,
+                          L" guid ",uVar3,L" ref ",uVar4);
+    pbVar5 = std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+                       (pbVar5,piVar7);
+    uVar3 = FUN_1001a0e0(pbVar5);
+    uVar3 = FUN_1001a0e0(uVar3);
+    uVar3 = FUN_1001a0e0(uVar3);
+    pbVar5 = (basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_> *)
+             FUN_1001a0e0(uVar3);
+    std::basic_ostream<unsigned_short,struct_std::char_traits<unsigned_short>_>::operator<<
+              (pbVar5,p_Var8);
+  }
+  local_250 = local_220[0].Data1;
+  local_24c = local_220[0].Data2;
+  uStack_24a = local_220[0].Data3;
+  local_244[0] = local_220[0].Data4[4];
+  local_244[1] = local_220[0].Data4[5];
+  local_244[2] = local_220[0].Data4[6];
+  local_244[3] = local_220[0].Data4[7];
+  local_254 = param_11;
+  local_240 = param_7;
+  local_238 = param_9;
+  local_248[0] = local_220[0].Data4[0];
+  local_248[1] = local_220[0].Data4[1];
+  local_248[2] = local_220[0].Data4[2];
+  local_248[3] = local_220[0].Data4[3];
+  local_234 = param_10;
+  local_258 = param_2;
+  iVar1 = *(int *)(param_1 + 0x24);
+  local_22c = param_4;
+  local_23c = param_8;
+  local_228 = param_5;
+  local_230 = param_3;
+  local_224 = param_6;
+  iVar6 = FUN_1008e910(iVar1,*(undefined4 *)(iVar1 + 4),&local_258);
+  if (*(int *)(param_1 + 0x28) == 0x4924923) {
+                    /* WARNING: Subroutine does not return */
+    std::_Xlength_error("list<T> too long");
+  }
+  *(int *)(param_1 + 0x28) = *(int *)(param_1 + 0x28) + 1;
+  *(int *)(iVar1 + 4) = iVar6;
+  **(int **)(iVar6 + 4) = iVar6;
+  __security_check_cookie(local_8 ^ (uint)&stack0xfffffffc);
+  return;
+}
+
+
+```
+
+## FUN_10112f20 at 10112f20
+
+Signature: `undefined FUN_10112f20(void)`
+
+```c
+
+int * __thiscall FUN_10112f20(int *param_1,int *param_2)
+
+{
+  UINT UVar1;
+  BSTR pOVar2;
+  
+  if (*param_1 != *param_2) {
+    AtlComPtrAssign(param_1,*param_2);
+  }
+  if ((BSTR)param_1[1] != (BSTR)param_2[1]) {
+    SysFreeString((BSTR)param_1[1]);
+    pOVar2 = (BSTR)0x0;
+    if ((BSTR)param_2[1] != (BSTR)0x0) {
+      UVar1 = SysStringByteLen((BSTR)param_2[1]);
+      pOVar2 = SysAllocStringByteLen((LPCSTR)param_2[1],UVar1);
+    }
+    param_1[1] = (int)pOVar2;
+    if ((param_2[1] != 0) && (pOVar2 == (BSTR)0x0)) {
+                    /* WARNING: Subroutine does not return */
+      FUN_100013e0(0x8007000e);
+    }
+  }
+  if ((BSTR)param_1[2] != (BSTR)param_2[2]) {
+    SysFreeString((BSTR)param_1[2]);
+    pOVar2 = (BSTR)0x0;
+    if ((BSTR)param_2[2] != (BSTR)0x0) {
+      UVar1 = SysStringByteLen((BSTR)param_2[2]);
+      pOVar2 = SysAllocStringByteLen((LPCSTR)param_2[2],UVar1);
+    }
+    param_1[2] = (int)pOVar2;
+    if ((param_2[2] != 0) && (pOVar2 == (BSTR)0x0)) {
+                    /* WARNING: Subroutine does not return */
+      FUN_100013e0(0x8007000e);
+    }
+  }
+  if ((BSTR)param_1[3] != (BSTR)param_2[3]) {
+    SysFreeString((BSTR)param_1[3]);
+    pOVar2 = (BSTR)0x0;
+    if ((BSTR)param_2[3] != (BSTR)0x0) {
+      UVar1 = SysStringByteLen((BSTR)param_2[3]);
+      pOVar2 = SysAllocStringByteLen((LPCSTR)param_2[3],UVar1);
+    }
+    param_1[3] = (int)pOVar2;
+    if ((param_2[3] != 0) && (pOVar2 == (BSTR)0x0)) {
+                    /* WARNING: Subroutine does not return */
+      FUN_100013e0(0x8007000e);
+    }
+  }
+  if ((BSTR)param_1[4] != (BSTR)param_2[4]) {
+    SysFreeString((BSTR)param_1[4]);
+    pOVar2 = (BSTR)0x0;
+    if ((BSTR)param_2[4] != (BSTR)0x0) {
+      UVar1 = SysStringByteLen((BSTR)param_2[4]);
+      pOVar2 = SysAllocStringByteLen((LPCSTR)param_2[4],UVar1);
+    }
+    param_1[4] = (int)pOVar2;
+    if ((param_2[4] != 0) && (pOVar2 == (BSTR)0x0)) {
+                    /* WARNING: Subroutine does not return */
+      FUN_100013e0(0x8007000e);
+    }
+  }
+  return param_1;
+}
+
+
+```
+
+## FUN_10112da0 at 10112da0
+
+Signature: `undefined FUN_10112da0(void)`
+
+```c
+
+void __fastcall FUN_10112da0(undefined4 *param_1)
+
+{
+  int *piVar1;
+  uint uVar2;
+  void *local_10;
+  undefined1 *puStack_c;
+  int local_8;
+  
+  puStack_c = &LAB_1017253f;
+  local_10 = ExceptionList;
+  uVar2 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  *param_1 = PreboundReference::vftable;
+  param_1[1] = PreboundReference::vftable;
+  param_1[3] = PreboundReference::vftable;
+  local_8 = 7;
+  piVar1 = (int *)param_1[0x19];
+  if (piVar1 != (int *)0x0) {
+    (**(code **)(*piVar1 + 8))(piVar1,uVar2);
+  }
+  local_8._0_1_ = 6;
+  SysFreeString((BSTR)param_1[0x2b]);
+  local_8._0_1_ = 5;
+  SysFreeString((BSTR)param_1[0x27]);
+  local_8._0_1_ = 4;
+  if (7 < (uint)param_1[0x21]) {
+    operator_delete((void *)param_1[0x1c]);
+  }
+  param_1[0x21] = 7;
+  param_1[0x20] = 0;
+  *(undefined2 *)(param_1 + 0x1c) = 0;
+  local_8._0_1_ = 3;
+  piVar1 = (int *)param_1[0x1a];
+  if (piVar1 != (int *)0x0) {
+    (**(code **)(*piVar1 + 8))(piVar1);
+  }
+  local_8._0_1_ = 0xc;
+  SysFreeString((BSTR)param_1[0x18]);
+  local_8._0_1_ = 0xb;
+  SysFreeString((BSTR)param_1[0x17]);
+  local_8._0_1_ = 10;
+  SysFreeString((BSTR)param_1[0x16]);
+  local_8._0_1_ = 9;
+  SysFreeString((BSTR)param_1[0x15]);
+  local_8._0_1_ = 2;
+  piVar1 = (int *)param_1[0x14];
+  if (piVar1 != (int *)0x0) {
+    (**(code **)(*piVar1 + 8))(piVar1);
+  }
+  local_8._0_1_ = 1;
+  if (7 < (uint)param_1[0x12]) {
+    operator_delete((void *)param_1[0xd]);
+  }
+  param_1[0x12] = 7;
+  param_1[0x11] = 0;
+  *(undefined2 *)(param_1 + 0xd) = 0;
+  local_8 = (uint)local_8._1_3_ << 8;
+  if (7 < (uint)param_1[0xb]) {
+    operator_delete((void *)param_1[6]);
+  }
+  param_1[0xb] = 7;
+  param_1[10] = 0;
+  *(undefined2 *)(param_1 + 6) = 0;
+  *param_1 = MxConnectionCallback::vftable;
+  ExceptionList = local_10;
+  return;
+}
+
+
+```
+
+## FUN_101139c0 at 101139c0
+
+Signature: `undefined FUN_101139c0(void)`
+
+```c
+
+undefined4 * __thiscall FUN_101139c0(undefined4 *param_1,short *param_2,undefined4 param_3)
+
+{
+  short sVar1;
+  uint uVar2;
+  short *psVar3;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  puStack_c = &LAB_101726b3;
+  local_10 = ExceptionList;
+  uVar2 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  *param_1 = MxConnectionCallback::vftable;
+  local_8 = 0;
+  param_1[1] = CReferenceToResolve::vftable;
+  *(undefined1 *)(param_1 + 2) = 0;
+  param_1[3] = RedundancyResolutionStatusCallback::vftable;
+  *param_1 = PreboundReference::vftable;
+  param_1[1] = PreboundReference::vftable;
+  param_1[3] = PreboundReference::vftable;
+  *(undefined1 *)(param_1 + 4) = 0;
+  param_1[5] = 0;
+  param_1[0xb] = 7;
+  param_1[10] = 0;
+  *(undefined2 *)(param_1 + 6) = 0;
+  psVar3 = param_2;
+  do {
+    sVar1 = *psVar3;
+    psVar3 = psVar3 + 1;
+  } while (sVar1 != 0);
+  FUN_100363d0(param_2,(int)psVar3 - (int)(param_2 + 1) >> 1);
+  local_8._1_3_ = (undefined3)((uint)local_8 >> 8);
+  param_1[0x12] = 7;
+  param_1[0x11] = 0;
+  *(undefined2 *)(param_1 + 0xd) = 0;
+  local_8._0_1_ = 2;
+  FUN_10113900(param_2);
+  param_1[0x19] = param_3;
+  param_1[0x1a] = 0;
+  *(undefined1 *)(param_1 + 0x1b) = 0;
+  param_1[0x21] = 7;
+  param_1[0x20] = 0;
+  *(undefined2 *)(param_1 + 0x1c) = 0;
+  param_1[0x27] = 0;
+  param_1[0x2a] = 0;
+  param_1[0x2b] = 0;
+  local_8 = CONCAT31(local_8._1_3_,8);
+  *(undefined1 *)(param_1 + 0x2c) = 0;
+  param_1[0x29] = 0;
+  if (DAT_101d8c40 == 0) {
+    FUN_10113070(uVar2);
+  }
+  FUN_101133d0();
+  (**(code **)(*(int *)param_1[0x19] + 4))((int *)param_1[0x19]);
+  ExceptionList = local_10;
+  return param_1;
+}
+
+
+```
+
+## FUN_10113b10 at 10113b10
+
+Signature: `undefined FUN_10113b10(void)`
+
+```c
+
+undefined4 * __thiscall FUN_10113b10(undefined4 *param_1,int *param_2,undefined4 param_3)
+
+{
+  undefined4 *puVar1;
+  short sVar2;
+  char cVar3;
+  uint uVar4;
+  int iVar5;
+  short *psVar6;
+  short *psVar7;
+  undefined2 *puVar8;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined1 local_8;
+  undefined3 uStack_7;
+  
+  puStack_c = &LAB_1017276f;
+  local_10 = ExceptionList;
+  uVar4 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  *param_1 = MxConnectionCallback::vftable;
+  param_1[1] = CReferenceToResolve::vftable;
+  *(undefined1 *)(param_1 + 2) = 0;
+  param_1[3] = RedundancyResolutionStatusCallback::vftable;
+  *param_1 = PreboundReference::vftable;
+  param_1[1] = PreboundReference::vftable;
+  param_1[3] = PreboundReference::vftable;
+  *(undefined1 *)(param_1 + 4) = 0;
+  param_1[5] = 0;
+  param_1[0xb] = 7;
+  param_1[10] = 0;
+  *(undefined2 *)(param_1 + 6) = 0;
+  param_1[0x12] = 7;
+  param_1[0x11] = 0;
+  *(undefined2 *)(param_1 + 0xd) = 0;
+  uStack_7 = 0;
+  local_8 = 2;
+  param_1[0x14] = param_2;
+  if (param_2 != (int *)0x0) {
+    (**(code **)(*param_2 + 4))(param_2,uVar4);
+  }
+  param_1[0x15] = 0;
+  param_1[0x16] = 0;
+  param_1[0x17] = 0;
+  param_1[0x18] = 0;
+  param_1[0x19] = param_3;
+  param_1[0x1a] = 0;
+  *(undefined1 *)(param_1 + 0x1b) = 0;
+  param_1[0x21] = 7;
+  param_1[0x20] = 0;
+  *(undefined2 *)(param_1 + 0x1c) = 0;
+  param_1[0x27] = 0;
+  param_1[0x2a] = 0;
+  param_1[0x2b] = 0;
+  _local_8 = CONCAT31(uStack_7,0xe);
+  *(undefined1 *)(param_1 + 0x2c) = 0;
+  param_1[0x29] = 0;
+  if (DAT_101d8c40 == 0) {
+    FUN_10113070();
+  }
+  if (param_2 != (int *)0x0) {
+    puVar1 = param_1 + 0x15;
+    SysFreeString((BSTR)param_1[0x15]);
+    *puVar1 = 0;
+    iVar5 = (**(code **)(*(int *)param_1[0x14] + 0x20))((int *)param_1[0x14],puVar1);
+    if (iVar5 < 0) {
+                    /* WARNING: Subroutine does not return */
+      FUN_1005bf30(iVar5,0,"E:\\BldSrc\\6\\s\\ExtInterfaces\\Lmx\\IMxReferencePtr.h",0x3f);
+    }
+    psVar7 = (short *)*puVar1;
+    if (psVar7 == (short *)0x0) {
+      psVar7 = &DAT_1017a514;
+    }
+    psVar6 = psVar7;
+    do {
+      sVar2 = *psVar6;
+      psVar6 = psVar6 + 1;
+    } while (sVar2 != 0);
+    FUN_100363d0(psVar7,(int)psVar6 - (int)(psVar7 + 1) >> 1);
+    puVar1 = param_1 + 0x15;
+    SysFreeString((BSTR)param_1[0x15]);
+    *puVar1 = 0;
+    iVar5 = (**(code **)(*(int *)param_1[0x14] + 0x20))((int *)param_1[0x14],puVar1);
+    if (iVar5 < 0) {
+                    /* WARNING: Subroutine does not return */
+      FUN_1005bf30(iVar5,0,"E:\\BldSrc\\6\\s\\ExtInterfaces\\Lmx\\IMxReferencePtr.h",0x3f);
+    }
+    puVar8 = (undefined2 *)*puVar1;
+    if (puVar8 == (undefined2 *)0x0) {
+      puVar8 = &DAT_1017a514;
+    }
+    cVar3 = FUN_10134a10(puVar8);
+    if (cVar3 != '\0') {
+      psVar6 = (short *)FUN_1005f6b0();
+      psVar7 = psVar6;
+      do {
+        sVar2 = *psVar7;
+        psVar7 = psVar7 + 1;
+      } while (sVar2 != 0);
+      FUN_100363d0(psVar6,(int)psVar7 - (int)(psVar6 + 1) >> 1);
+    }
+  }
+  FUN_101133d0();
+  (**(code **)(*(int *)param_1[0x19] + 4))((int *)param_1[0x19]);
+  ExceptionList = local_10;
+  return param_1;
+}
+
+
+```
+
+## FUN_10114620 at 10114620
+
+Signature: `undefined FUN_10114620(void)`
+
+```c
+
+void __fastcall FUN_10114620(int param_1)
+
+{
+  char cVar1;
+  undefined4 uVar2;
+  undefined4 uVar3;
+  undefined1 local_18 [4];
+  void *local_14;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  local_8 = 0xffffffff;
+  puStack_c = &LAB_10172866;
+  local_10 = ExceptionList;
+  ExceptionList = &local_10;
+  if (*(char *)(*(int *)(param_1 + 100) + 0x6dc) != '\0') {
+    cVar1 = FUN_1005faf0(DAT_101d60b8 ^ (uint)&stack0xfffffffc);
+    if (cVar1 == '\0') {
+      local_14 = operator_new(0x1c);
+      local_8 = 0;
+      if (local_14 == (void *)0x0) {
+        local_14 = (void *)0x0;
+      }
+      else {
+        local_14 = (void *)FUN_10060b80();
+      }
+      local_8 = 0xffffffff;
+      FUN_1003ec10(*(undefined4 *)(param_1 + 0x50));
+      uVar3 = 0;
+      uVar2 = FUN_1002c750(&local_14);
+      FUN_10066e70(local_18,uVar2,uVar3);
+      local_14 = operator_new(0x1c);
+      local_8 = 1;
+      if (local_14 == (void *)0x0) {
+        local_14 = (void *)0x0;
+      }
+      else {
+        local_14 = (void *)FUN_10060b80();
+      }
+      local_8 = 0xffffffff;
+      FUN_1003ec10(*(undefined4 *)(param_1 + 0x50));
+      uVar3 = 0;
+      uVar2 = FUN_1002c750(&local_14);
+      FUN_10066e70(local_18,uVar2,uVar3);
+      *(undefined1 *)(*(int *)(param_1 + 100) + 0x6dd) = 1;
+    }
+  }
+  ExceptionList = local_10;
+  return;
+}
+
+
+```
+
+## FUN_10112cd0 at 10112cd0
+
+Signature: `undefined FUN_10112cd0(void)`
+
+```c
+
+void __fastcall FUN_10112cd0(int param_1)
+
+{
+  uint uVar1;
+  void *pvVar2;
+  void *local_10;
+  undefined1 *puStack_c;
+  undefined4 local_8;
+  
+  local_8 = 0xffffffff;
+  puStack_c = &LAB_1017247b;
+  local_10 = ExceptionList;
+  uVar1 = DAT_101d60b8 ^ (uint)&stack0xfffffffc;
+  ExceptionList = &local_10;
+  pvVar2 = operator_new(0x38);
+  local_8 = 0;
+  if (pvVar2 != (void *)0x0) {
+    FUN_1009f240(*(undefined4 *)(param_1 + 0x50),*(undefined2 *)(*(int *)(param_1 + 100) + 0x2ac),
+                 param_1,*(int *)(param_1 + 100));
+  }
+  local_8 = 0xffffffff;
+  (*(code *)**(undefined4 **)(param_1 + 4))(uVar1);
+  ExceptionList = local_10;
+  return;
+}
+
+
+```
+

analysis/ghidra/exports/Lmx.dll.vtable-data-xrefs.md

@@ -0,0 +1,134 @@
+# Lmx.dll xrefs
+
+## 0x10196410 at 10196410
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10196400 at 10196400
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x101963f8 at 101963f8
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x101963f0 at 101963f0
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10112dd3` | `DATA` | `FUN_10112da0` |
+| `10113a13` | `DATA` | `FUN_101139c0` |
+| `10113b5f` | `DATA` | `FUN_10113b10` |
+
+## 0x101963e8 at 101963e8
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10112dda` | `DATA` | `FUN_10112da0` |
+| `10113a1a` | `DATA` | `FUN_101139c0` |
+| `10113b66` | `DATA` | `FUN_10113b10` |
+
+## 0x101963e0 at 101963e0
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10196418 at 10196418
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10196420 at 10196420
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x1018f268 at 1018f268
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x1018f260 at 1018f260
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x1018f258 at 1018f258
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x1018f270 at 1018f270
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10195488 at 10195488
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10195480 at 10195480
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10195478 at 10195478
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+
+## 0x10195490 at 10195490
+
+Target function: `(none)`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| (none) | | |
+

analysis/ghidra/exports/LmxProxy.dll.completion-status-decompile.md

@@ -0,0 +1,448 @@
+# LmxProxy.dll selected decompile
+
+## FUN_10015f72 at 10015f72
+
+Signature: `undefined __thiscall FUN_10015f72(void * this, long param_1, long param_2, undefined4 param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void __thiscall FUN_10015f72(void *this,long param_1,long param_2,undefined4 param_3)
+
+{
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar1;
+  undefined4 *puVar2;
+  int *piVar3;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar4;
+  undefined4 *this_00;
+  long in_stack_0000001c;
+  undefined4 in_stack_00000030;
+  long lVar5;
+  wchar_t *pwVar6;
+  long lVar7;
+  wchar_t *pwVar8;
+  long lVar9;
+  wchar_t *pwVar10;
+  ushort uVar11;
+  undefined4 uVar12;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var13;
+  undefined4 *local_30;
+  undefined4 local_2c;
+  undefined4 local_28;
+  undefined4 local_24;
+  int *local_20;
+  int local_1c;
+  void *local_18;
+  int local_14;
+  undefined4 local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x20;
+  local_8 = 0x10015f7e;
+  puVar2 = (undefined4 *)FUN_100170a4(100);
+  if (puVar2 == (undefined4 *)0x0) {
+    this_00 = (undefined4 *)0x0;
+  }
+  else {
+    this_00 = puVar2 + 1;
+    *puVar2 = 6;
+    _eh_vector_constructor_iterator_(this_00,0x10,6,FUN_10001517,FUN_10001f45);
+  }
+  local_1c = *(int *)((int)this + 8);
+  local_14 = 0;
+  if (0 < local_1c) {
+    local_18 = (void *)((int)this + 4);
+    do {
+      piVar3 = (int *)FUN_10007d02(local_18,local_14);
+      local_20 = piVar3;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 4))(piVar3);
+      }
+      local_8 = 1;
+      if (piVar3 != (int *)0x0) {
+        FUN_10015d08(this_00 + 0x14,param_1);
+        FUN_10015d08(this_00 + 0x10,param_2);
+        if ((CComVariant *)(this_00 + 0xc) != (CComVariant *)&param_3) {
+          ATL::CComVariant::InternalCopy((CComVariant *)(this_00 + 0xc),(tagVARIANT *)&param_3);
+        }
+        FUN_10015d08(this_00 + 8,in_stack_0000001c);
+        if ((CComVariant *)(this_00 + 4) != (CComVariant *)&stack0x00000020) {
+          ATL::CComVariant::InternalCopy
+                    ((CComVariant *)(this_00 + 4),(tagVARIANT *)&stack0x00000020);
+        }
+        *(undefined2 *)this_00 = 0x6024;
+        this_00[2] = in_stack_00000030;
+        local_2c = 0;
+        local_28 = 6;
+        local_24 = 0;
+        local_30 = this_00;
+        bVar1 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                              (DAT_100294e0 + 0x10));
+        if (bVar1 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+          pwVar10 = L"  Item Data Type ";
+          pwVar8 = L"  item Quality ";
+          pwVar6 = L"  Item Handle ";
+          lVar5 = param_1;
+          lVar7 = param_2;
+          lVar9 = in_stack_0000001c;
+          uVar12 = param_3;
+          p_Var13 = endl_exref;
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf(*(int **)(DAT_100294e0 + 0x10),
+                                L"CProxy_ILMXProxyServerEvents::Fire_OnDataChange firing event - Server Handle "
+                               );
+          uVar11 = (ushort)uVar12;
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar5);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar6);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar7);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar8);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar9);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar10);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,uVar11);
+          std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar4,p_Var13);
+        }
+        (**(code **)(*piVar3 + 0x18))(piVar3,1,&DAT_100201f8,0x400,1,&local_30,0,0,0);
+      }
+      local_8 = 0xffffffff;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 8))(piVar3);
+      }
+      local_14 = local_14 + 1;
+    } while (local_14 < local_1c);
+  }
+  if (this_00 != (undefined4 *)0x0) {
+    FUN_10015d66(this_00,3);
+  }
+  return;
+}
+
+
+```
+
+## FUN_1001611f at 1001611f
+
+Signature: `undefined __thiscall FUN_1001611f(void * this, long param_1, long param_2, undefined4 param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void __thiscall FUN_1001611f(void *this,long param_1,long param_2,undefined4 param_3)
+
+{
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar1;
+  undefined4 *puVar2;
+  int *piVar3;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar4;
+  undefined4 *this_00;
+  long lVar5;
+  wchar_t *pwVar6;
+  long lVar7;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var8;
+  undefined4 *local_30;
+  undefined4 local_2c;
+  undefined4 local_28;
+  undefined4 local_24;
+  int *local_20;
+  int local_1c;
+  void *local_18;
+  int local_14;
+  undefined4 local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x20;
+  local_8 = 0x1001612b;
+  puVar2 = (undefined4 *)FUN_100170a4(0x34);
+  if (puVar2 == (undefined4 *)0x0) {
+    this_00 = (undefined4 *)0x0;
+  }
+  else {
+    this_00 = puVar2 + 1;
+    *puVar2 = 3;
+    _eh_vector_constructor_iterator_(this_00,0x10,3,FUN_10001517,FUN_10001f45);
+  }
+  local_1c = *(int *)((int)this + 8);
+  local_14 = 0;
+  if (0 < local_1c) {
+    local_18 = (void *)((int)this + 4);
+    do {
+      piVar3 = (int *)FUN_10007d02(local_18,local_14);
+      local_20 = piVar3;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 4))(piVar3);
+      }
+      local_8 = 1;
+      if (piVar3 != (int *)0x0) {
+        FUN_10015d08(this_00 + 8,param_1);
+        FUN_10015d08(this_00 + 4,param_2);
+        *(undefined2 *)this_00 = 0x6024;
+        this_00[2] = param_3;
+        local_2c = 0;
+        local_28 = 3;
+        local_24 = 0;
+        local_30 = this_00;
+        bVar1 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                              (DAT_100294e0 + 0xc));
+        if (bVar1 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+          pwVar6 = L"  Item Handle ";
+          lVar5 = param_1;
+          lVar7 = param_2;
+          p_Var8 = endl_exref;
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf(*(int **)(DAT_100294e0 + 0xc),
+                                L"CProxy_ILMXProxyServerEvents::Fire_OnWriteComplete firing event - Server Handle "
+                               );
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar5);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar6);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar7);
+          std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar4,p_Var8);
+        }
+        (**(code **)(*piVar3 + 0x18))(piVar3,2,&DAT_100201f8,0x400,1,&local_30,0,0,0);
+      }
+      local_8 = 0xffffffff;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 8))(piVar3);
+      }
+      local_14 = local_14 + 1;
+    } while (local_14 < local_1c);
+  }
+  if (this_00 != (undefined4 *)0x0) {
+    FUN_10015d66(this_00,3);
+  }
+  return;
+}
+
+
+```
+
+## FUN_10016271 at 10016271
+
+Signature: `undefined __thiscall FUN_10016271(void * this, long param_1, long param_2, undefined4 param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void __thiscall FUN_10016271(void *this,long param_1,long param_2,undefined4 param_3)
+
+{
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar1;
+  undefined4 *puVar2;
+  int *piVar3;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar4;
+  undefined4 *this_00;
+  long lVar5;
+  wchar_t *pwVar6;
+  long lVar7;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var8;
+  undefined4 *local_30;
+  undefined4 local_2c;
+  undefined4 local_28;
+  undefined4 local_24;
+  int *local_20;
+  int local_1c;
+  void *local_18;
+  int local_14;
+  undefined4 local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x20;
+  local_8 = 0x1001627d;
+  puVar2 = (undefined4 *)FUN_100170a4(0x34);
+  if (puVar2 == (undefined4 *)0x0) {
+    this_00 = (undefined4 *)0x0;
+  }
+  else {
+    this_00 = puVar2 + 1;
+    *puVar2 = 3;
+    _eh_vector_constructor_iterator_(this_00,0x10,3,FUN_10001517,FUN_10001f45);
+  }
+  local_1c = *(int *)((int)this + 8);
+  local_14 = 0;
+  if (0 < local_1c) {
+    local_18 = (void *)((int)this + 4);
+    do {
+      piVar3 = (int *)FUN_10007d02(local_18,local_14);
+      local_20 = piVar3;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 4))(piVar3);
+      }
+      local_8 = 1;
+      if (piVar3 != (int *)0x0) {
+        FUN_10015d08(this_00 + 8,param_1);
+        FUN_10015d08(this_00 + 4,param_2);
+        local_2c = 0;
+        local_24 = 0;
+        *(undefined2 *)this_00 = 0x6024;
+        this_00[2] = param_3;
+        local_28 = 3;
+        local_30 = this_00;
+        bVar1 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                              (DAT_100294e0 + 0xc));
+        if (bVar1 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+          pwVar6 = L"  Item Handle ";
+          lVar5 = param_1;
+          lVar7 = param_2;
+          p_Var8 = endl_exref;
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf(*(int **)(DAT_100294e0 + 0xc),
+                                L"CProxy_ILMXProxyServerEvents::Fire_OperationComplete firing event - Server Handle "
+                               );
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar5);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar6);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar7);
+          std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar4,p_Var8);
+        }
+        (**(code **)(*piVar3 + 0x18))(piVar3,3,&DAT_100201f8,0x400,1,&local_30,0,0,0);
+      }
+      local_8 = 0xffffffff;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 8))(piVar3);
+      }
+      local_14 = local_14 + 1;
+    } while (local_14 < local_1c);
+  }
+  if (this_00 != (undefined4 *)0x0) {
+    FUN_10015d66(this_00,3);
+  }
+  return;
+}
+
+
+```
+
+## FUN_100163c0 at 100163c0
+
+Signature: `undefined __thiscall FUN_100163c0(void * this, long param_1, long param_2, undefined4 param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void __thiscall FUN_100163c0(void *this,long param_1,long param_2,undefined4 param_3)
+
+{
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar1;
+  undefined4 *puVar2;
+  int *piVar3;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar4;
+  undefined4 *this_00;
+  undefined4 in_stack_00000040;
+  long lVar5;
+  wchar_t *pwVar6;
+  long lVar7;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var8;
+  undefined4 *local_30;
+  undefined4 local_2c;
+  undefined4 local_28;
+  undefined4 local_24;
+  int *local_20;
+  int local_1c;
+  void *local_18;
+  int local_14;
+  undefined4 local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x20;
+  local_8 = 0x100163cc;
+  puVar2 = (undefined4 *)FUN_100170a4(0x74);
+  if (puVar2 == (undefined4 *)0x0) {
+    this_00 = (undefined4 *)0x0;
+  }
+  else {
+    this_00 = puVar2 + 1;
+    *puVar2 = 7;
+    _eh_vector_constructor_iterator_(this_00,0x10,7,FUN_10001517,FUN_10001f45);
+  }
+  local_1c = *(int *)((int)this + 8);
+  local_14 = 0;
+  if (0 < local_1c) {
+    local_18 = (void *)((int)this + 4);
+    do {
+      piVar3 = (int *)FUN_10007d02(local_18,local_14);
+      local_20 = piVar3;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 4))(piVar3);
+      }
+      local_8 = 1;
+      if (piVar3 != (int *)0x0) {
+        FUN_10015d08(this_00 + 0x18,param_1);
+        FUN_10015d08(this_00 + 0x14,param_2);
+        FUN_10015d08(this_00 + 0x10,param_3);
+        if ((CComVariant *)(this_00 + 0xc) != (CComVariant *)&stack0x00000010) {
+          ATL::CComVariant::InternalCopy
+                    ((CComVariant *)(this_00 + 0xc),(tagVARIANT *)&stack0x00000010);
+        }
+        if ((CComVariant *)(this_00 + 8) != (CComVariant *)&stack0x00000020) {
+          ATL::CComVariant::InternalCopy
+                    ((CComVariant *)(this_00 + 8),(tagVARIANT *)&stack0x00000020);
+        }
+        if ((CComVariant *)(this_00 + 4) != (CComVariant *)&stack0x00000030) {
+          ATL::CComVariant::InternalCopy
+                    ((CComVariant *)(this_00 + 4),(tagVARIANT *)&stack0x00000030);
+        }
+        *(undefined2 *)this_00 = 0x6024;
+        this_00[2] = in_stack_00000040;
+        local_2c = 0;
+        local_28 = 7;
+        local_24 = 0;
+        local_30 = this_00;
+        bVar1 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                              (DAT_100294e0 + 0x10));
+        if (bVar1 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+          pwVar6 = L"  Item Handle ";
+          lVar5 = param_1;
+          lVar7 = param_2;
+          p_Var8 = endl_exref;
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf(*(int **)(DAT_100294e0 + 0x10),
+                                L"CProxy_ILMXProxyServerEvents2::Fire_OnBufferedDataChange firing event - Server Handle "
+                               );
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar5);
+          pbVar4 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                   FUN_10002dbf((int *)pbVar4,pwVar6);
+          pbVar4 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                             (pbVar4,lVar7);
+          std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar4,p_Var8);
+        }
+        (**(code **)(*piVar3 + 0x18))(piVar3,1,&DAT_100201f8,0x400,1,&local_30,0,0,0);
+      }
+      local_8 = 0xffffffff;
+      if (piVar3 != (int *)0x0) {
+        (**(code **)(*piVar3 + 8))(piVar3);
+      }
+      local_14 = local_14 + 1;
+    } while (local_14 < local_1c);
+  }
+  if (this_00 != (undefined4 *)0x0) {
+    FUN_10015d66(this_00,3);
+  }
+  return;
+}
+
+
+```
+

analysis/ghidra/exports/LmxProxy.dll.fire-event-xrefs.md

@@ -0,0 +1,34 @@
+# LmxProxy.dll xrefs
+
+## 0x15f72 at 10015f72
+
+Target function: `FUN_10015f72`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `1001695a` | `UNCONDITIONAL_CALL` | `FUN_1001657f` |
+
+## 0x1611f at 1001611f
+
+Target function: `FUN_1001611f`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10016cc8` | `UNCONDITIONAL_CALL` | `FUN_10016b50` |
+
+## 0x16271 at 10016271
+
+Target function: `FUN_10016271`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10016eb3` | `UNCONDITIONAL_CALL` | `FUN_10016d4b` |
+
+## 0x163c0 at 100163c0
+
+Target function: `FUN_100163c0`
+
+| From | Ref type | Caller function |
+| --- | --- | --- |
+| `10016ad8` | `UNCONDITIONAL_CALL` | `FUN_1001657f` |
+

analysis/ghidra/exports/LmxProxy.dll.mxstatus-safearray-decompile.md

@@ -0,0 +1,125 @@
+# LmxProxy.dll selected decompile
+
+## FUN_10003f60 at 10003f60
+
+Signature: `HRESULT __cdecl FUN_10003f60(undefined4 * param_1, undefined2 * param_2, ULONG param_3)`
+
+```c
+
+HRESULT __cdecl FUN_10003f60(undefined4 *param_1,undefined2 *param_2,ULONG param_3)
+
+{
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar1;
+  HRESULT HVar2;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar3;
+  SAFEARRAY *pSVar4;
+  HRESULT HVar5;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var6;
+  SAFEARRAYBOUND local_18;
+  LONG local_10;
+  IRecordInfo *local_c;
+  undefined2 *local_8;
+  
+  local_c = (IRecordInfo *)0x0;
+  HVar2 = GetRecordInfoFromGuids((GUID *)&DAT_1001c2d0,1,0,0,(GUID *)&DAT_1001b530,&local_c);
+  if (HVar2 < 0) {
+    if ((HVar2 != -0x7ffd7fe3) &&
+       (bVar1 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                              (DAT_100294e0 + 4)),
+       bVar1 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0)) {
+      HVar5 = HVar2;
+      p_Var6 = endl_exref;
+      pbVar3 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+               FUN_10002dbf(*(int **)(DAT_100294e0 + 4),L"GetRecordInfoFromGuids failed - hr = ");
+      pbVar3 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                         (pbVar3,HVar5);
+      std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar3,p_Var6);
+    }
+  }
+  else {
+    local_18.lLbound = 0;
+    local_18.cElements = param_3;
+    pSVar4 = SafeArrayCreateEx(0x24,1,&local_18,local_c);
+    *param_1 = pSVar4;
+    (*local_c->lpVtbl->Release)(local_c);
+    if ((SAFEARRAY *)*param_1 == (SAFEARRAY *)0x0) {
+      HVar2 = -0x7fffbffb;
+    }
+    else {
+      HVar2 = SafeArrayGetLBound((SAFEARRAY *)*param_1,1,&local_10);
+      if ((-1 < HVar2) && (HVar2 = SafeArrayAccessData((SAFEARRAY *)*param_1,&local_8), -1 < HVar2))
+      {
+        *local_8 = *param_2;
+        *(undefined4 *)(local_8 + 2) = *(undefined4 *)(param_2 + 2);
+        *(undefined4 *)(local_8 + 4) = *(undefined4 *)(param_2 + 4);
+        local_8[6] = param_2[6];
+        SafeArrayUnaccessData((SAFEARRAY *)*param_1);
+        HVar2 = 0;
+      }
+    }
+  }
+  return HVar2;
+}
+
+
+```
+
+## FUN_10015db2 at 10015db2
+
+Signature: `void * __thiscall FUN_10015db2(void * this, int * param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void * __thiscall
+FUN_10015db2(void *this,int *param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
+            undefined4 param_5,undefined4 param_6)
+
+{
+  *(undefined4 *)this = 1;
+  FUN_10015d38((void *)((int)this + 4),param_1);
+  *(undefined4 *)((int)this + 8) = 0;
+  *(undefined4 *)((int)this + 0x10) = param_2;
+  *(undefined4 *)((int)this + 0x14) = param_3;
+  *(undefined4 *)((int)this + 0x18) = param_4;
+  *(undefined4 *)((int)this + 0xc) = param_6;
+  *(undefined4 *)((int)this + 0x1c) = param_5;
+  *(undefined4 *)((int)this + 0x20) = 0;
+  return this;
+}
+
+
+```
+
+## FUN_10015e4e at 10015e4e
+
+Signature: `void * __thiscall FUN_10015e4e(void * this, int * param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3 replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+void * __thiscall
+FUN_10015e4e(void *this,int *param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
+            undefined4 param_5,undefined4 param_6)
+
+{
+  *(undefined4 *)this = 2;
+  *(undefined4 *)((int)this + 4) = 0;
+  FUN_10015d38((void *)((int)this + 8),param_1);
+  *(undefined4 *)((int)this + 0x20) = 0;
+  *(undefined4 *)((int)this + 0x10) = param_2;
+  *(undefined4 *)((int)this + 0x14) = param_3;
+  *(undefined4 *)((int)this + 0x18) = param_4;
+  *(undefined4 *)((int)this + 0xc) = param_6;
+  *(undefined4 *)((int)this + 0x1c) = param_5;
+  return this;
+}
+
+
+```
+

analysis/ghidra/exports/LmxProxy.dll.status-synthesis-decompile.md

@@ -0,0 +1,475 @@
+# LmxProxy.dll selected decompile
+
+## FUN_1001657f at 1001657f
+
+Signature: `undefined __stdcall FUN_1001657f(uint param_1, undefined4 param_2)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3_catch_GS replaced with injection: EH_prolog3 */
+
+void FUN_1001657f(uint param_1,undefined4 param_2)
+
+{
+  DWORD DVar1;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar2;
+  undefined *puVar3;
+  int iVar4;
+  int *piVar5;
+  DWORD DVar6;
+  undefined4 *puVar7;
+  HRESULT HVar8;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar9;
+  uint uVar10;
+  undefined4 uVar11;
+  wchar_t *pwVar12;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var13;
+  void **in_stack_ffffff1c;
+  undefined1 local_d4 [36];
+  VARIANTARG local_b0;
+  _union_2683 local_a0;
+  VARIANTARG local_90;
+  VARIANTARG local_80;
+  int *local_70 [2];
+  DWORD local_68;
+  undefined *local_64;
+  IUnknown *local_60 [2];
+  BSTR local_58;
+  uint local_54;
+  int *local_50 [2];
+  SAFEARRAY *local_48;
+  undefined1 local_44 [4];
+  FILETIME local_40;
+  undefined2 local_38 [8];
+  undefined1 local_28 [32];
+  uint local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0xc4;
+  local_54 = param_1;
+  local_68 = 0;
+  local_64 = (undefined *)0x0;
+  local_58 = (BSTR)0x0;
+  local_8 = 0;
+  FUN_1000107a((int *)local_50);
+  local_8 = CONCAT31(local_8._1_3_,1);
+  uVar11 = 0;
+  uVar10 = 3;
+  puVar3 = FUN_10003248();
+  iVar4 = FUN_10003897(puVar3,uVar10);
+  puVar3 = FUN_10003248();
+  uVar10 = FUN_1000305b(puVar3,iVar4,uVar11);
+  if ((char)uVar10 != '\0') {
+    pwVar12 = L"OnDataChange callback received";
+    piVar5 = (int *)FUN_10003248();
+    FUN_100031b7(piVar5,pwVar12);
+  }
+  if (DAT_10029594 == 0) {
+    local_8 = local_8 & 0xffffff00;
+    FUN_1000111b((int *)local_50);
+    local_8 = 0xffffffff;
+    SysFreeString(local_58);
+  }
+  else {
+    DVar6 = GetCurrentThreadId();
+    if (DVar6 == DAT_10029594) {
+      iVar4 = *(int *)(param_1 + 8);
+      FUN_1000f663((void *)(iVar4 + 0x2c),&local_40.dwHighDateTime,(int *)(param_1 + 0xc));
+      DVar6 = local_40.dwHighDateTime;
+      if ((((undefined *)local_40.dwHighDateTime != *(undefined **)(iVar4 + 0x30)) &&
+          (FUN_1000f5ef((undefined *)(local_40.dwHighDateTime + 0x3c),&local_40.dwHighDateTime,
+                        (int *)(param_1 + 0x10)), DVar1 = local_40.dwHighDateTime,
+          (undefined *)local_40.dwHighDateTime != *(undefined **)(DVar6 + 0x40))) &&
+         (*(char *)(local_40.dwHighDateTime + 0x1c) != '\0')) {
+        if (*(char *)(local_40.dwHighDateTime + 0x1f) == '\0') {
+          if (*(char *)(local_40.dwHighDateTime + 0x1e) == '\0') {
+            local_40.dwHighDateTime = 0;
+            local_28._0_4_ = (uint)(ushort)local_28._2_2_ << 0x10;
+            local_28._4_4_ = 0;
+            local_28._8_4_ = 0;
+            local_28._12_4_ = (undefined *)0x0;
+            (**(code **)(**(int **)(DVar6 + 0x24) + 0x60))
+                      (*(int **)(DVar6 + 0x24),*(undefined4 *)(DVar1 + 0x18),
+                       &local_40.dwHighDateTime,local_28);
+            if ((local_28._0_2_ == 0xffff) && (local_28._4_4_ == 0)) {
+              *(undefined1 *)(DVar1 + 0x1e) = 1;
+              *(byte *)(DVar1 + 0x1d) = (byte)(local_40.dwHighDateTime >> 1) & 1;
+            }
+          }
+          piVar5 = *(int **)(DVar6 + 0x24);
+          if (local_50[0] != (int *)0x0) {
+            (**(code **)(*local_50[0] + 8))(local_50[0]);
+            local_50[0] = (int *)0x0;
+          }
+          iVar4 = (**(code **)(*piVar5 + 0x50))
+                            (piVar5,*(undefined4 *)(DVar1 + 0x18),local_44,&local_68,local_38,
+                             &local_58,local_50);
+        }
+        else {
+          if (*(char *)(local_40.dwHighDateTime + 0x1e) == '\0') {
+            local_40.dwHighDateTime = 0;
+            local_28._0_4_ = (uint)(ushort)local_28._2_2_ << 0x10;
+            local_28._4_4_ = 0;
+            local_28._8_4_ = 0;
+            local_28._12_4_ = (undefined *)0x0;
+            (**(code **)(**(int **)(DVar6 + 0x30) + 0x28))
+                      (*(int **)(DVar6 + 0x30),*(undefined4 *)(DVar1 + 0x18),
+                       &local_40.dwHighDateTime,local_28);
+            if ((local_28._0_2_ == 0xffff) && (local_28._4_4_ == 0)) {
+              *(undefined1 *)(DVar1 + 0x1e) = 1;
+              *(byte *)(DVar1 + 0x1d) = (byte)(local_40.dwHighDateTime >> 1) & 1;
+            }
+          }
+          piVar5 = *(int **)(DVar6 + 0x30);
+          if (local_50[0] != (int *)0x0) {
+            (**(code **)(*local_50[0] + 8))(local_50[0]);
+            local_50[0] = (int *)0x0;
+          }
+          iVar4 = (**(code **)(*piVar5 + 0x20))
+                            (piVar5,*(undefined4 *)(DVar1 + 0x18),local_44,&local_68,local_38,
+                             local_50);
+        }
+        iVar4 = FUN_1000f8d9((undefined4 *)(uint)(iVar4 == 0),iVar4,0x6d,"MxCallback.cpp");
+        if (iVar4 != 0) {
+          if (*(char *)(DVar1 + 0x28) == '\0') {
+            FUN_1000107a((int *)local_60);
+            local_8 = CONCAT31(local_8._1_3_,4);
+            if (*(char *)(DVar1 + 0x1d) == '\0') {
+              local_40.dwLowDateTime = 0;
+              local_40.dwHighDateTime = 0;
+              CoFileTimeNow(&local_40);
+              local_28._8_4_ = local_40.dwLowDateTime;
+              local_28._12_4_ = local_40.dwHighDateTime;
+            }
+            else {
+              local_28._8_4_ = local_68;
+              local_28._12_4_ = local_64;
+            }
+            HVar8 = (*local_60[0]->lpVtbl[5].QueryInterface)
+                              (local_60[0],(IID *)(local_28 + 8),in_stack_ffffff1c);
+            if (HVar8 < 0) {
+              _com_issue_errorex(HVar8,local_60[0],(_GUID *)&DAT_1001b590);
+            }
+            puVar3 = FUN_100012e6(local_60);
+            FUN_10001269(local_70,puVar3);
+            local_8._0_1_ = 5;
+            FUN_100060a2((CComVariant *)&local_b0,local_70[0],0x40);
+            local_8._0_1_ = 6;
+            FUN_100060a2((CComVariant *)&local_a0.n2,local_50[0],0);
+            local_8._0_1_ = 7;
+            HVar8 = FUN_10003f60(&local_48,local_38,1);
+            if (HVar8 < 0) {
+              bVar2 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                                    (DAT_100294e0 + 8));
+              if (bVar2 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+                p_Var13 = endl_exref;
+                pbVar9 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                         FUN_10002dbf(*(int **)(DAT_100294e0 + 8),
+                                      L"CUserConnectionCallback::OnDataChange - Create MxStatus SafeArray failed.  hr = "
+                                     );
+                pbVar9 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                                   (pbVar9,HVar8);
+                std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                          (pbVar9,p_Var13);
+              }
+            }
+            else {
+              local_8 = CONCAT31(local_8._1_3_,8);
+              FUN_10015f72((void *)(*(int *)(local_54 + 8) + 0xc),*(long *)(local_54 + 0xc),
+                           *(long *)(local_54 + 0x10),local_a0._0_4_);
+              local_8._0_1_ = 7;
+              local_8._1_3_ = 0;
+              HVar8 = SafeArrayDestroy(local_48);
+              if (HVar8 != 0) {
+                pwVar12 = 
+                L"CUserConnectionCallback::OnDataChange - SafeArrayDestroy failed - hr %08X";
+                piVar5 = (int *)FUN_10003248();
+                FUN_1000308b(piVar5,pwVar12);
+              }
+            }
+            local_8._0_1_ = 6;
+            VariantClear((VARIANTARG *)&local_a0.n2);
+            local_8._0_1_ = 5;
+            VariantClear(&local_b0);
+            local_8._0_1_ = 4;
+            FUN_1000111b((int *)local_70);
+            local_8 = CONCAT31(local_8._1_3_,1);
+            FUN_1000111b((int *)local_60);
+          }
+          else {
+            VariantInit(&local_80);
+            local_8._0_1_ = 10;
+            VariantInit(&local_90);
+            local_8._0_1_ = 0xb;
+            VariantInit((VARIANTARG *)local_28);
+            local_8._0_1_ = 0xc;
+            local_40.dwHighDateTime = 0;
+            FUN_100069ad(local_50[0],(ushort *)&local_80,(undefined2 *)&local_90,
+                         (undefined2 *)local_28,(BSTR)&local_40.dwHighDateTime);
+            HVar8 = FUN_10003f60(&local_48,local_38,1);
+            if (HVar8 < 0) {
+              bVar2 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                                    (DAT_100294e0 + 8));
+              if (bVar2 != (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+                p_Var13 = endl_exref;
+                pbVar9 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                         FUN_10002dbf(*(int **)(DAT_100294e0 + 8),
+                                      L"CUserConnectionCallback::OnDataChange - Create MxStatus SafeArray failed on Buffered Data callback.  hr = "
+                                     );
+                pbVar9 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                                   (pbVar9,HVar8);
+                std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                          (pbVar9,p_Var13);
+              }
+            }
+            else {
+              local_8 = CONCAT31(local_8._1_3_,0xd);
+              FUN_100163c0((void *)(*(int *)(local_54 + 8) + 0x18),*(long *)(local_54 + 0xc),
+                           *(long *)(local_54 + 0x10),local_40.dwHighDateTime);
+              local_8._0_1_ = 0xc;
+              local_8._1_3_ = 0;
+              HVar8 = SafeArrayDestroy(local_48);
+              if (HVar8 != 0) {
+                pwVar12 = 
+                L"CUserConnectionCallback::OnDataChange - SafeArrayDestroy failed - hr %08X";
+                piVar5 = (int *)FUN_10003248();
+                FUN_1000308b(piVar5,pwVar12);
+              }
+            }
+            local_8._0_1_ = 0xb;
+            VariantClear((VARIANTARG *)local_28);
+            local_8._0_1_ = 10;
+            VariantClear(&local_90);
+            local_8 = CONCAT31(local_8._1_3_,1);
+            VariantClear(&local_80);
+          }
+        }
+      }
+    }
+    else {
+      local_40.dwHighDateTime = (DWORD)&DAT_100295bc;
+      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+      local_8._0_1_ = 2;
+      puVar7 = FUN_10015e06(local_d4,(int *)(-(uint)(param_1 != 4) & param_1),param_2);
+      local_8._0_1_ = 3;
+      FUN_1001654d(&DAT_100295b0,DAT_100295b0,puVar7);
+      local_8._0_1_ = 2;
+      FUN_1000d639((int)local_d4);
+      local_8 = CONCAT31(local_8._1_3_,1);
+      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+    }
+    local_8 = local_8 & 0xffffff00;
+    FUN_1000111b((int *)local_50);
+    local_8 = 0xffffffff;
+    SysFreeString(local_58);
+  }
+  FUN_10017482();
+  return;
+}
+
+
+```
+
+## FUN_10016b50 at 10016b50
+
+Signature: `HRESULT __stdcall FUN_10016b50(uint param_1, undefined4 param_2, undefined4 * param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3_catch replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+HRESULT FUN_10016b50(uint param_1,undefined4 param_2,undefined4 *param_3)
+
+{
+  uint uVar1;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar2;
+  undefined *puVar3;
+  int iVar4;
+  int *piVar5;
+  DWORD DVar6;
+  undefined4 *puVar7;
+  HRESULT HVar8;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar9;
+  uint uVar10;
+  HRESULT HVar11;
+  undefined4 uVar12;
+  wchar_t *pwVar13;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var14;
+  undefined1 local_40 [36];
+  undefined *local_1c;
+  undefined4 local_18 [4];
+  int local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x30;
+  local_8 = 0x10016b5c;
+  local_18[0] = 0;
+  uVar12 = 0;
+  uVar10 = 3;
+  puVar3 = FUN_10003248();
+  iVar4 = FUN_10003897(puVar3,uVar10);
+  puVar3 = FUN_10003248();
+  uVar10 = FUN_1000305b(puVar3,iVar4,uVar12);
+  if ((char)uVar10 != '\0') {
+    pwVar13 = L"OnSetAttributeResult callback received";
+    piVar5 = (int *)FUN_10003248();
+    FUN_100031b7(piVar5,pwVar13);
+  }
+  if (DAT_10029594 != 0) {
+    DVar6 = GetCurrentThreadId();
+    uVar10 = param_1;
+    if (DVar6 == DAT_10029594) {
+      piVar5 = (int *)(param_1 + 0xc);
+      iVar4 = *(int *)(param_1 + 8);
+      FUN_1000f663((void *)(iVar4 + 0x2c),&param_1,piVar5);
+      uVar1 = param_1;
+      if ((param_1 == *(uint *)(iVar4 + 0x30)) ||
+         (FUN_1000f5ef((void *)(param_1 + 0x3c),&param_1,(int *)(uVar10 + 0x10)),
+         param_1 == *(uint *)(uVar1 + 0x40))) {
+        return -0x7fffbffb;
+      }
+      HVar8 = FUN_10003f60(local_18,(undefined2 *)param_3,1);
+      if (-1 < HVar8) {
+        local_8 = 2;
+        FUN_1001611f((void *)(*(int *)(uVar10 + 8) + 0xc),*piVar5,*(long *)(uVar10 + 0x10),local_18)
+        ;
+        local_8 = 0xffffffff;
+        HVar8 = FUN_10016d1a();
+        return HVar8;
+      }
+      bVar2 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                            (DAT_100294e0 + 8));
+      if (bVar2 == (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+        return HVar8;
+      }
+      HVar11 = HVar8;
+      p_Var14 = endl_exref;
+      pbVar9 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+               FUN_10002dbf(*(int **)(DAT_100294e0 + 8),
+                            L"CUserConnectionCallback::OnSetAttributeResult - Create MxStatus SafeArray failed.  hr = "
+                           );
+      pbVar9 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                         (pbVar9,HVar11);
+      std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar9,p_Var14);
+      return HVar8;
+    }
+    local_1c = &DAT_100295bc;
+    EnterCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+    local_8 = 0;
+    puVar7 = FUN_10015db2(local_40,(int *)(-(uint)(param_1 != 4) & param_1),*param_3,param_3[1],
+                          param_3[2],param_3[3],param_2);
+    local_8._0_1_ = 1;
+    FUN_1001654d(&DAT_100295b0,DAT_100295b0,puVar7);
+    local_8 = (uint)local_8._1_3_ << 8;
+    FUN_1000d639((int)local_40);
+    local_8 = 0xffffffff;
+    LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+  }
+  return 0;
+}
+
+
+```
+
+## FUN_10016d4b at 10016d4b
+
+Signature: `HRESULT __stdcall FUN_10016d4b(int * param_1, undefined4 param_2, undefined4 * param_3)`
+
+```c
+
+/* WARNING: Function: __EH_prolog3_catch replaced with injection: EH_prolog3 */
+/* WARNING: Function: __EH_epilog3 replaced with injection: EH_epilog3 */
+
+HRESULT FUN_10016d4b(int *param_1,undefined4 param_2,undefined4 *param_3)
+
+{
+  int *piVar1;
+  int *piVar2;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> bVar3;
+  undefined *puVar4;
+  int iVar5;
+  int *piVar6;
+  DWORD DVar7;
+  undefined4 *puVar8;
+  HRESULT HVar9;
+  basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *pbVar10;
+  uint uVar11;
+  undefined4 uVar12;
+  wchar_t *pwVar13;
+  _func_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr_basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>_ptr
+  *p_Var14;
+  undefined1 local_40 [36];
+  undefined *local_1c;
+  undefined4 local_18 [4];
+  int local_8;
+  undefined4 uStack_4;
+  
+  uStack_4 = 0x30;
+  local_8 = 0x10016d57;
+  uVar12 = 0;
+  uVar11 = 3;
+  puVar4 = FUN_10003248();
+  iVar5 = FUN_10003897(puVar4,uVar11);
+  puVar4 = FUN_10003248();
+  uVar11 = FUN_1000305b(puVar4,iVar5,uVar12);
+  if ((char)uVar11 != '\0') {
+    pwVar13 = L"OperationComplete callback received";
+    piVar6 = (int *)FUN_10003248();
+    FUN_100031b7(piVar6,pwVar13);
+  }
+  if (DAT_10029594 != 0) {
+    DVar7 = GetCurrentThreadId();
+    piVar6 = param_1;
+    if (DVar7 == DAT_10029594) {
+      piVar1 = param_1 + 4;
+      iVar5 = param_1[3];
+      FUN_1000f663((void *)(iVar5 + 0x2c),&param_1,piVar1);
+      piVar2 = param_1;
+      if ((param_1 == *(int **)(iVar5 + 0x30)) ||
+         (FUN_1000f5ef(param_1 + 0xf,&param_1,piVar6 + 5), param_1 == (int *)piVar2[0x10])) {
+        return -0x7fffbffb;
+      }
+      HVar9 = FUN_10003f60(local_18,(undefined2 *)param_3,1);
+      if (-1 < HVar9) {
+        local_8 = 2;
+        FUN_10016271((void *)(piVar6[3] + 0xc),*piVar1,piVar6[5],local_18);
+        local_8 = 0xffffffff;
+        HVar9 = FUN_10016f05();
+        return HVar9;
+      }
+      bVar3 = FUN_10003f01(*(basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> **)
+                            (DAT_100294e0 + 8));
+      if (bVar3 == (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>)0x0) {
+        return HVar9;
+      }
+      p_Var14 = endl_exref;
+      pbVar10 = (basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_> *)
+                FUN_10002dbf(*(int **)(DAT_100294e0 + 8),
+                             L"CUserConnectionCallback::CUserConnectionCallback::OperationComplete - Create MxStatus SafeArray failed.  hr = "
+                            );
+      pbVar10 = std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<
+                          (pbVar10,HVar9);
+      std::basic_ostream<wchar_t,struct_std::char_traits<wchar_t>_>::operator<<(pbVar10,p_Var14);
+      HVar9 = FUN_10016f05();
+      return HVar9;
+    }
+    local_1c = &DAT_100295bc;
+    EnterCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+    local_8 = 0;
+    puVar8 = FUN_10015e4e(local_40,param_1,*param_3,param_3[1],param_3[2],param_3[3],param_2);
+    local_8._0_1_ = 1;
+    FUN_1001654d(&DAT_100295b0,DAT_100295b0,puVar8);
+    local_8 = (uint)local_8._1_3_ << 8;
+    FUN_1000d639((int)local_40);
+    local_8 = 0xffffffff;
+    LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_100295bc);
+  }
+  return 0;
+}
+
+
+```
+

captures/123-frida-suspend-advised-instrumented/frida-command.txt

@@ -0,0 +1,3 @@
+frida=C:\Users\dohertj2\AppData\Local\Programs\Python\Python312\Scripts\frida.exe
+harness=C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe
+args=-f C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe -l C:\Users\dohertj2\Desktop\mxaccess\analysis\frida\mx-nmx-trace.js -- --scenario=suspend-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\123-frida-suspend-advised-instrumented\harness.log --client=MxFridaTrace-123

captures/123-frida-suspend-advised-instrumented/frida-exit.txt

@@ -0,0 +1 @@
+1

captures/123-frida-suspend-advised-instrumented/frida.stdout.jsonl

@@ -0,0 +1,98 @@
+     ____
+    / _  |   Frida 17.9.1 - A world-class dynamic instrumentation toolkit
+   | (_| |
+    > _  |   Commands:
+   /_/ |_|       help      -> Displays the help system
+   . . . .       object?   -> Display information about 'object'
+   . . . .       exit/quit -> Exit
+   . . . .
+   . . . .   More info at https://frida.re/docs/home/
+   . . . .
+   . . . .   Connected to Local System (id=local)
+Spawning `C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe --scenario=suspend-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\123-frida-suspend-advised-instrumented\harness.log --client=MxFridaTrace-123`...
+Spawned `C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe --scenario=suspend-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\123-frida-suspend-advised-instrumented\harness.log --client=MxFridaTrace-123`. Resuming main thread!
+[Local::MxTraceHarness.exe ]-> {"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Write.variantA","base":"0x61b50000","rva":"0x12c0c","address":"0x61b62c0c","time":"2026-05-06T17:23:45.844Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Write.variantB","base":"0x61b50000","rva":"0x13280","address":"0x61b63280","time":"2026-05-06T17:23:45.845Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.WriteSecured.variantA","base":"0x61b50000","rva":"0x12f24","address":"0x61b62f24","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.WriteSecured.variantB","base":"0x61b50000","rva":"0x135fe","address":"0x61b635fe","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AddBufferedItem","base":"0x61b50000","rva":"0x1121d","address":"0x61b6121d","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.SetBufferedUpdateInterval","base":"0x61b50000","rva":"0xfc80","address":"0x61b5fc80","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","base":"0x61b50000","rva":"0x142b4","address":"0x61b642b4","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Suspend","base":"0x61b50000","rva":"0x13d9c","address":"0x61b63d9c","time":"2026-05-06T17:23:45.846Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Activate","base":"0x61b50000","rva":"0x14028","address":"0x61b64028","time":"2026-05-06T17:23:45.847Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CProxy_ILMXProxyServerEvents2.Fire_OnBufferedDataChange","base":"0x61b50000","rva":"0x163c0","address":"0x61b663c0","time":"2026-05-06T17:23:45.847Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CUserConnectionCallback.OnSetAttributeResult","base":"0x61b50000","rva":"0x16b50","address":"0x61b66b50","time":"2026-05-06T17:23:45.847Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CUserConnectionCallback.OperationComplete","base":"0x61b50000","rva":"0x16d4b","address":"0x61b66d4b","time":"2026-05-06T17:23:45.848Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AuthenticateUser","base":"0x61b50000","rva":"0x1399f","address":"0x61b6399f","time":"2026-05-06T17:23:45.848Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"MxConnection.PrebindReference","base":"0x10000000","rva":"0xea780","address":"0x100ea780","time":"2026-05-06T17:23:51.188Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"MxConnection.UserRegisterPreboundReference","base":"0x10000000","rva":"0xe1920","address":"0x100e1920","time":"2026-05-06T17:23:51.189Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"IMxReference.GetMxHandle","base":"0x10000000","rva":"0x5f730","address":"0x1005f730","time":"2026-05-06T17:23:51.190Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","base":"0x10000000","rva":"0x8f8b0","address":"0x1008f8b0","time":"2026-05-06T17:23:51.190Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.Resolve","base":"0x10000000","rva":"0x113d40","address":"0x10113d40","time":"2026-05-06T17:23:51.191Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.OnPlatformResolveReferenceResults","base":"0x10000000","rva":"0x1155a0","address":"0x101155a0","time":"2026-05-06T17:23:51.192Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.OnSetAttributeResult","base":"0x10000000","rva":"0x114a90","address":"0x10114a90","time":"2026-05-06T17:23:51.192Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x91a72b0","outPtr":"0xd5e6c4","inWords":[65537,65537,0,0,0,0],"time":"2026-05-06T17:23:51.236Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xd5e6c4","handle":{"raw":"01 00 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00","w0":65537,"w1":65537,"w2":0,"w3":0,"w4":0},"retval":"0xd5e6c4","time":"2026-05-06T17:23:51.236Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x91a72b0","outPtr":"0xd5e6c4","inWords":[65537,65537,0,0,0,0],"time":"2026-05-06T17:23:51.237Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xd5e6c4","handle":{"raw":"01 00 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00","w0":65537,"w1":65537,"w2":0,"w3":0,"w4":0},"retval":"0xd5e6c4","time":"2026-05-06T17:23:51.237Z"}
+{"event":"lmx.prebind.enter","module":"Lmx.dll","name":"MxConnection.PrebindReference","self":"0x91aed2c","outPtr":"0xd5ec98","referencePtr":"0xd5eccc","reference":"TestChildObject.ScanState","time":"2026-05-06T17:23:51.255Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x91b3838","outPtr":"0xd5ec00","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5ec00","time":"2026-05-06T17:23:51.256Z"}
+{"event":"lmx.prebound-resolve.enter","module":"Lmx.dll","name":"PreboundReference.Resolve","prebound":{"ptr":"0x91af058","referenceString":{"length":25,"capacity":31,"value":"TestChildObject.ScanState"},"contextString":{"length":0,"capacity":7,"value":""},"auxString":{"length":0,"capacity":7,"value":""},"mxReference":"0x91b46f0","flags10":1124099840,"word14":2,"word4c":131073,"word54":134011636,"word58":0,"word5c":0,"word60":0,"word64":152728240,"word68":0,"word6c":0,"worda0":0,"worda4":0,"status":3,"flagb0":0,"errorText":"","raw":"08 64 19 10 f0 63 19 10 00 6f 00 6e e8 63 19 10 00 67 00 43 02 00 00 00 98 41 1b 09 00 65 00 00 00 02 00 00 00 00 00 02 19 00 00 00 1f 00 00 00 00 00 00 01 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 01 00 02 00 f0 46 1b 09 f4 da fc 07 00 00 00 00 00 00 00 00 00 00 00 00 b0 72 1a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ac 8a 31 01 00 00 00 00"},"time":"2026-05-06T17:23:51.257Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x91af0a8","outPtr":"0xd5eb90","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5eb90","time":"2026-05-06T17:23:51.257Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x91af0a8","outPtr":"0xd5eb90","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5eb90","time":"2026-05-06T17:23:51.257Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x91af0a8","outPtr":"0xd5eb90","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5eb90","time":"2026-05-06T17:23:51.258Z"}
+{"event":"lmx.prebound-resolve.leave","module":"Lmx.dll","name":"PreboundReference.Resolve","prebound":{"ptr":"0x91af058","referenceString":{"length":25,"capacity":31,"value":"TestChildObject.ScanState"},"contextString":{"length":0,"capacity":7,"value":""},"auxString":{"length":0,"capacity":7,"value":""},"mxReference":"0x91b46f0","flags10":1124099840,"word14":2,"word4c":131073,"word54":134011636,"word58":0,"word5c":0,"word60":0,"word64":152728240,"word68":0,"word6c":0,"worda0":0,"worda4":0,"status":3,"flagb0":0,"errorText":"","raw":"08 64 19 10 f0 63 19 10 00 6f 00 6e e8 63 19 10 00 67 00 43 02 00 00 00 98 41 1b 09 00 65 00 00 00 02 00 00 00 00 00 02 19 00 00 00 1f 00 00 00 00 00 00 01 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 01 00 02 00 f0 46 1b 09 f4 da fc 07 00 00 00 00 00 00 00 00 00 00 00 00 b0 72 1a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ac 8a 31 01 00 00 00 00"},"retval":"0x70d01e01","time":"2026-05-06T17:23:51.259Z"}
+{"event":"lmx.prebind.leave","module":"Lmx.dll","name":"MxConnection.PrebindReference","handle":1,"time":"2026-05-06T17:23:51.259Z"}
+{"event":"call.enter","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","address":"0x61b642b4","ecx":"0xd5ed50","args":["0x62492d0","0x1","0x1","0x55eabfd1","0x744d4704"],"time":"2026-05-06T17:23:51.261Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x91a72b0","outPtr":"0xd5ebd0","inWords":[65537,327682,186166,655465,37447,0],"time":"2026-05-06T17:23:51.261Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xd5ebd0","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5ebd0","time":"2026-05-06T17:23:51.261Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x91a72b0","outPtr":"0xd5d864","inWords":[65537,327682,186166,655465,37447,0],"time":"2026-05-06T17:23:51.262Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xd5d864","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xd5d864","time":"2026-05-06T17:23:51.262Z"}
+{"event":"call.leave","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","retval":"0x0","time":"2026-05-06T17:23:51.262Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","base":"0x63ae0000","rva":"0x10996","address":"0x63af0996","time":"2026-05-06T17:23:51.280Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","base":"0x63ae0000","rva":"0x112da","address":"0x63af12da","time":"2026-05-06T17:23:51.280Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","base":"0x63ae0000","rva":"0x15169","address":"0x63af5169","time":"2026-05-06T17:23:51.281Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequestEx","base":"0x63ae0000","rva":"0x159c3","address":"0x63af59c3","time":"2026-05-06T17:23:51.281Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x91ac9d8","0x1","0x1","0x1","0x2","0x0","0x13a","0x91af118","0xd5ea14","0xfd3aeb5e"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":1,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":314,"ptr":"0x91af118","hex":"17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 6a 00 00 00 40 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 a0 e7 1a 09 1f 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 00 00 01 00 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 76 00 00 00 4c 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 20 ee 1a 09 20 01 00 02 00 00 00"}],"time":"2026-05-06T17:23:51.371Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x1","0x168","0x9eb7020","0x9d860587","0x91aece4","0x91aecd4","0x63b0dd04","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":360,"ptr":"0x9eb7020","hex":"01 00 3a 01 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 02 00 00 30 75 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 6a 00 00 00 40 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 a0 e7 1a 09 1f 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 00 00 01 00 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 76 00 00 00 4c 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 20 ee 1a 09 20 01 00 02 00 00 00"}],"time":"2026-05-06T17:23:51.373Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:51.374Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:23:51.374Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x91ac9d8","0x1","0x1","0x2","0x2","0x0","0x27","0x91af590","0xd5ea14","0xfd3aeb5e"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":2,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":39,"ptr":"0x91af590","hex":"1f 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 00 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:51.375Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x2","0x55","0x9eb7020","0x9d860587","0x91b5dcc","0x91b5dbc","0x63b0dd04","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":85,"ptr":"0x9eb7020","hex":"01 00 27 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 02 00 00 30 75 00 00 1f 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 00 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:51.376Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:51.376Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:23:51.376Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x2c2","0x7f44288","0x773eb08","0x769cedd8","0x91ac9e4","0x2c2","0x7f44288","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":706,"ptr":"0x7f44288","hex":"01 00 94 02 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00 40 1f 50 80 08 a6 00 00 00 40 00 00 91 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 18 00 00 00 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 00 00 28 00 00 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 6c 00 00 00 41 00 6e 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 42 00 61 00 73 00 65 00 20 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 1f 00 00 50 80 01 00 01 00 01 00 30 75 00 00 4a 5a a3 cd 7a 87 96 43 83 2c b4 ba be 67 53 57 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 40 1f 50 80 08 be 00 00 00 4c 00 00 91 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 18 00 00 00 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 00 00 34 00 00 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 01 6c 00 00 00 41 00 6e 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 42 00 61 00 73 00 65 00 20 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 20 00 00 50 80 01 00 01 00 01 00 30 75 00 00"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:51.392Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:51.393Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x97","0x7f38730","0x773eb08","0x769cedd8","0x91ac9e4","0x97","0x7f38730","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":151,"ptr":"0x7f38730","hex":"01 00 69 00 00 00 00 00 00 00 39 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 02 00 00 30 75 00 00 32 01 00 02 00 00 00 4a 5a a3 cd 7a 87 96 43 83 2c b4 ba be 67 53 57 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 01 00 00 00 03 00 00 00 c0 00 b0 fd 44 d6 75 dd dc 01 06 0a 00 00 00 00 99 8c 8a 6e da dc 01 00 00 02 00 00 00 03 00 00 00 c0 00 f0 99 45 d6 75 dd dc 01 06 0a 00 00 00 00 fb 56 ce 19 dd dc 01 00 00"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:51.394Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:51.394Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x5c","0x7f43180","0x773eb08","0x769cedd8","0x91ac9e4","0x5c","0x7f43180","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":92,"ptr":"0x7f43180","hex":"01 00 2e 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00 00 00 50 80 01 00 01 00 02 00 30 75 00 00 ad dd 62 fe a7 a0 e5 49 87 72 93 75 c6 f1 cc 86 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:51.414Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:51.415Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x69","0x7fb3ab0","0x773eb08","0x769cedd8","0x91ac9e4","0x69","0x7fb3ab0","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":105,"ptr":"0x7fb3ab0","hex":"01 00 3b 00 00 00 00 00 00 00 06 19 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 02 00 00 30 75 00 00 32 01 00 01 00 00 00 ad dd 62 fe a7 a0 e5 49 87 72 93 75 c6 f1 cc 86 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 03 00 00 00 00 00 00 00 c0 00 c0 3e 0b d8 75 dd dc 01 01 ff"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:51.416Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:51.416Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x1","0x2e","0x9eb7020","0x9d860473","0x91a72b0","0x0","0x0","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":46,"ptr":"0x9eb7020","hex":"01 00 00 00 00 00 00 00 00 00 39 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 02 00 00 30 75 00 00"}],"time":"2026-05-06T17:23:51.470Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:51.470Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x2","0x2e","0x9eb7020","0x9d860473","0x91a72b0","0x0","0x0","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":46,"ptr":"0x9eb7020","hex":"01 00 00 00 00 00 00 00 00 00 06 19 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 02 00 00 30 75 00 00"}],"time":"2026-05-06T17:23:51.488Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:51.489Z"}
+{"event":"mx.suspend.begin","module":"LmxProxy.dll","name":"CLMXProxyServer.Suspend","address":"0x61b63d9c","ecx":"0xd5ed4c","serverHandle":1,"itemHandle":1,"statusOutPtr":"0xd5f14c","time":"2026-05-06T17:23:51.949Z"}
+{"event":"mx.suspend.end","module":"LmxProxy.dll","name":"CLMXProxyServer.Suspend","retval":"0x0","serverHandle":1,"itemHandle":1,"status":{"raw":"ff ff 3a fd 01 00 00 00","success":-1,"category":-710,"detectedBy":1,"detail":0},"time":"2026-05-06T17:23:51.949Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x91ac9d8","0x1","0x1","0x2","0x2","0x0","0x29","0x91af980","0xd5ea14","0xfd3aeb5e"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":2,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":41,"ptr":"0x91af980","hex":"2d 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 01 00 05 00 01 00 02 00 01 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:52.089Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x2","0x57","0x9eb7020","0x9d860587","0x91a829c","0x91a828c","0x63b0dd04","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":87,"ptr":"0x9eb7020","hex":"01 00 29 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 02 00 00 30 75 00 00 2d 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 01 00 05 00 01 00 02 00 01 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:52.089Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:52.090Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:23:52.090Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x32","0x7f44288","0x773eb08","0x769cedd8","0x91ac9e4","0x32","0x7f44288","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":50,"ptr":"0x7f44288","hex":"01 00 04 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00 00 00 10 80"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:52.123Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:52.123Z"}
+{"event":"call.enter","module":"LmxProxy.dll","name":"CUserConnectionCallback.OperationComplete","address":"0x61b66d4b","ecx":"0x61b66d4b","args":["0x91b4b40","0x1","0xd5e574","0x8014cbc"],"time":"2026-05-06T17:23:52.183Z"}
+{"event":"call.leave","module":"LmxProxy.dll","name":"CUserConnectionCallback.OperationComplete","retval":"0x0","time":"2026-05-06T17:23:52.185Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x91ac9d8","0x1","0x1","0x1","0x2","0x0","0x3a","0x91af470","0xd5ebd0","0xfd3ae89a"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":1,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":58,"ptr":"0x91af470","hex":"21 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 00 00 00 22 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 02 00 00 00"}],"time":"2026-05-06T17:23:59.173Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x1","0x68","0x9eb7020","0x9d8607c3","0x91aec7c","0x91aec6c","0x63b0dd04","0x0"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":104,"ptr":"0x9eb7020","hex":"01 00 3a 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 02 00 00 30 75 00 00 21 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 00 00 00 22 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 02 00 00 00"}],"time":"2026-05-06T17:23:59.174Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:59.174Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:23:59.175Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x91ac9d8","0x1","0x1","0x2","0x2","0x0","0x25","0x91af590","0xd5ebd0","0xfd3ae89a"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":2,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":37,"ptr":"0x91af590","hex":"21 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:59.175Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x91ac9d8","args":["0x1","0x1","0x2","0x53","0x9eb7020","0x9d8607c3","0x91a829c","0x91a828c","0x63b0dd04","0x0"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":83,"ptr":"0x9eb7020","hex":"01 00 25 00 00 00 00 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 02 00 00 30 75 00 00 21 01 00 cd 2a ee ec b2 76 06 4f b4 58 5c a0 2d f7 a8 93 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:23:59.175Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:23:59.176Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:23:59.176Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x91ac9d8","args":["0x2e","0x7f43180","0x773eb08","0x769cedd8","0x91ac9e4","0x2e","0x7f43180","0x206","0x3","0x7aa21cc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":46,"ptr":"0x7f43180","hex":"01 00 00 00 00 00 00 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7aa21cc","hex":"f0 d7 01"}],"time":"2026-05-06T17:23:59.184Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:23:59.184Z"}
+Process terminated
+
+Thank you for using Frida!

captures/123-frida-suspend-advised-instrumented/harness.log

@@ -0,0 +1,18 @@
+2026-05-06T17:23:45.7524803+00:00	harness.start	{"Scenario":"suspend-advised","ClientName":"MxFridaTrace-123","Tags":["TestChildObject.ScanState"],"ItemContext":"","WriteType":"string","WriteValue":"","WriteValues":[],"UserId":0,"CurrentUserId":0,"VerifierUserId":0,"UserGuid":"","AuthUser":"","AuthenticateBeforeWrite":false,"UseAuthenticatedUserAsVerifier":false,"UsePlainAdvise":false,"WriteTimestamp":"","WriteDelayMilliseconds":750,"WriteIntervalMilliseconds":500,"BufferedUpdateInterval":1000,"DurationSeconds":8,"ProcessBitness":"x86","Runtime":"4.0.30319.42000"}
+2026-05-06T17:23:51.0229176+00:00	mx.register.begin	{"ClientName":"MxFridaTrace-123"}
+2026-05-06T17:23:51.2542197+00:00	mx.register.end	{"SessionHandle":1}
+2026-05-06T17:23:51.2550786+00:00	mx.additem.begin	{"Tag":"TestChildObject.ScanState"}
+2026-05-06T17:23:51.2595630+00:00	mx.additem.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:51.2604744+00:00	mx.advise-supervisory.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:51.2632070+00:00	mx.advise-supervisory.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:51.4863989+00:00	mx.event.data-change	{"SessionHandle":1,"ItemHandle":1,"Value":{"Type":"System.Boolean","Value":"True"},"Quality":192,"Timestamp":{"Type":"System.String","Value":"5/6/2026 1:23:51.471 PM"},"Status":[{"Success":-1,"Category":"MxCategoryOk","Source":"MxSourceRequestingLmx","Detail":0}]}
+2026-05-06T17:23:51.9480884+00:00	mx.suspend.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:51.9499173+00:00	mx.suspend.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1,"Status":{"Success":-1,"Category":"MxCategoryPending","Source":"MxSourceRequestingLmx","Detail":0}}
+2026-05-06T17:23:52.1856751+00:00	mx.event.operation-complete	{"SessionHandle":1,"ItemHandle":1,"Status":[{"Success":-1,"Category":"MxCategoryOk","Source":"MxSourceRespondingLmx","Detail":0}]}
+2026-05-06T17:23:59.1669817+00:00	mx.unadvise.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:59.1678719+00:00	mx.unadvise.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:59.1678719+00:00	mx.removeitem.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:59.1678719+00:00	mx.removeitem.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:23:59.1678719+00:00	mx.unregister.begin	{"SessionHandle":1}
+2026-05-06T17:24:03.0001612+00:00	mx.unregister.end	{"SessionHandle":1}
+2026-05-06T17:24:03.0046705+00:00	harness.stop	{}

captures/124-frida-activate-advised-instrumented/frida-command.txt

@@ -0,0 +1,3 @@
+frida=C:\Users\dohertj2\AppData\Local\Programs\Python\Python312\Scripts\frida.exe
+harness=C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe
+args=-f C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe -l C:\Users\dohertj2\Desktop\mxaccess\analysis\frida\mx-nmx-trace.js -- --scenario=activate-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\124-frida-activate-advised-instrumented\harness.log --client=MxFridaTrace-124

captures/124-frida-activate-advised-instrumented/frida-exit.txt

@@ -0,0 +1 @@
+1

captures/124-frida-activate-advised-instrumented/frida.stdout.jsonl

@@ -0,0 +1,88 @@
+     ____
+    / _  |   Frida 17.9.1 - A world-class dynamic instrumentation toolkit
+   | (_| |
+    > _  |   Commands:
+   /_/ |_|       help      -> Displays the help system
+   . . . .       object?   -> Display information about 'object'
+   . . . .       exit/quit -> Exit
+   . . . .
+   . . . .   More info at https://frida.re/docs/home/
+   . . . .
+   . . . .   Connected to Local System (id=local)
+Spawning `C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe --scenario=activate-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\124-frida-activate-advised-instrumented\harness.log --client=MxFridaTrace-124`...
+Spawned `C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe --scenario=activate-advised --tag=TestChildObject.ScanState --duration=8 --log=C:\Users\dohertj2\Desktop\mxaccess\captures\124-frida-activate-advised-instrumented\harness.log --client=MxFridaTrace-124`. Resuming main thread!
+[Local::MxTraceHarness.exe ]-> {"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Write.variantA","base":"0x61b70000","rva":"0x12c0c","address":"0x61b82c0c","time":"2026-05-06T17:25:57.029Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Write.variantB","base":"0x61b70000","rva":"0x13280","address":"0x61b83280","time":"2026-05-06T17:25:57.029Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.WriteSecured.variantA","base":"0x61b70000","rva":"0x12f24","address":"0x61b82f24","time":"2026-05-06T17:25:57.029Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.WriteSecured.variantB","base":"0x61b70000","rva":"0x135fe","address":"0x61b835fe","time":"2026-05-06T17:25:57.029Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AddBufferedItem","base":"0x61b70000","rva":"0x1121d","address":"0x61b8121d","time":"2026-05-06T17:25:57.029Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.SetBufferedUpdateInterval","base":"0x61b70000","rva":"0xfc80","address":"0x61b7fc80","time":"2026-05-06T17:25:57.030Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","base":"0x61b70000","rva":"0x142b4","address":"0x61b842b4","time":"2026-05-06T17:25:57.030Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Suspend","base":"0x61b70000","rva":"0x13d9c","address":"0x61b83d9c","time":"2026-05-06T17:25:57.030Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.Activate","base":"0x61b70000","rva":"0x14028","address":"0x61b84028","time":"2026-05-06T17:25:57.031Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CProxy_ILMXProxyServerEvents2.Fire_OnBufferedDataChange","base":"0x61b70000","rva":"0x163c0","address":"0x61b863c0","time":"2026-05-06T17:25:57.031Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CUserConnectionCallback.OnSetAttributeResult","base":"0x61b70000","rva":"0x16b50","address":"0x61b86b50","time":"2026-05-06T17:25:57.031Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CUserConnectionCallback.OperationComplete","base":"0x61b70000","rva":"0x16d4b","address":"0x61b86d4b","time":"2026-05-06T17:25:57.032Z"}
+{"event":"hook.installed","module":"LmxProxy.dll","name":"CLMXProxyServer.AuthenticateUser","base":"0x61b70000","rva":"0x1399f","address":"0x61b8399f","time":"2026-05-06T17:25:57.032Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"MxConnection.PrebindReference","base":"0x10000000","rva":"0xea780","address":"0x100ea780","time":"2026-05-06T17:26:02.100Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"MxConnection.UserRegisterPreboundReference","base":"0x10000000","rva":"0xe1920","address":"0x100e1920","time":"2026-05-06T17:26:02.101Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"IMxReference.GetMxHandle","base":"0x10000000","rva":"0x5f730","address":"0x1005f730","time":"2026-05-06T17:26:02.101Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","base":"0x10000000","rva":"0x8f8b0","address":"0x1008f8b0","time":"2026-05-06T17:26:02.101Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.Resolve","base":"0x10000000","rva":"0x113d40","address":"0x10113d40","time":"2026-05-06T17:26:02.102Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.OnPlatformResolveReferenceResults","base":"0x10000000","rva":"0x1155a0","address":"0x101155a0","time":"2026-05-06T17:26:02.102Z"}
+{"event":"hook.installed","module":"Lmx.dll","name":"PreboundReference.OnSetAttributeResult","base":"0x10000000","rva":"0x114a90","address":"0x10114a90","time":"2026-05-06T17:26:02.103Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","base":"0x63ae0000","rva":"0x10996","address":"0x63af0996","time":"2026-05-06T17:26:02.191Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","base":"0x63ae0000","rva":"0x112da","address":"0x63af12da","time":"2026-05-06T17:26:02.192Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","base":"0x63ae0000","rva":"0x15169","address":"0x63af5169","time":"2026-05-06T17:26:02.192Z"}
+{"event":"hook.installed","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequestEx","base":"0x63ae0000","rva":"0x159c3","address":"0x63af59c3","time":"2026-05-06T17:26:02.193Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x8f272b0","outPtr":"0xafe224","inWords":[65537,65537,0,0,0,0],"time":"2026-05-06T17:26:02.227Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xafe224","handle":{"raw":"01 00 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00","w0":65537,"w1":65537,"w2":0,"w3":0,"w4":0},"retval":"0xafe224","time":"2026-05-06T17:26:02.227Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x8f272b0","outPtr":"0xafe224","inWords":[65537,65537,0,0,0,0],"time":"2026-05-06T17:26:02.228Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xafe224","handle":{"raw":"01 00 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00","w0":65537,"w1":65537,"w2":0,"w3":0,"w4":0},"retval":"0xafe224","time":"2026-05-06T17:26:02.228Z"}
+{"event":"lmx.prebind.enter","module":"Lmx.dll","name":"MxConnection.PrebindReference","self":"0x8f2f934","outPtr":"0xafe7f8","referencePtr":"0xafe82c","reference":"TestChildObject.ScanState","time":"2026-05-06T17:26:02.247Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x8f341e8","outPtr":"0xafe760","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafe760","time":"2026-05-06T17:26:02.247Z"}
+{"event":"lmx.prebound-resolve.enter","module":"Lmx.dll","name":"PreboundReference.Resolve","prebound":{"ptr":"0x8f2fc60","referenceString":{"length":25,"capacity":31,"value":"TestChildObject.ScanState"},"contextString":{"length":0,"capacity":7,"value":""},"auxString":{"length":0,"capacity":7,"value":""},"mxReference":"0x8f34f50","flags10":1124099840,"word14":2,"word4c":131073,"word54":131786164,"word58":0,"word5c":0,"word60":0,"word64":150106800,"word68":0,"word6c":0,"worda0":0,"worda4":0,"status":3,"flagb0":0,"errorText":"","raw":"08 64 19 10 f0 63 19 10 00 6f 00 6e e8 63 19 10 00 67 00 43 02 00 00 00 c0 4e f3 08 00 65 00 00 00 02 00 00 00 00 00 02 19 00 00 00 1f 00 00 00 00 00 00 01 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 01 00 02 00 50 4f f3 08 b4 e5 da 07 00 00 00 00 00 00 00 00 00 00 00 00 b0 72 f2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 04 79 d4 00 00 00 00 00"},"time":"2026-05-06T17:26:02.247Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x8f2fcb0","outPtr":"0xafe6f0","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafe6f0","time":"2026-05-06T17:26:02.248Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x8f2fcb0","outPtr":"0xafe6f0","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafe6f0","time":"2026-05-06T17:26:02.248Z"}
+{"event":"lmx.mxhandle.read","module":"Lmx.dll","name":"IMxReference.GetMxHandle","referencePtr":"0x8f2fcb0","outPtr":"0xafe6f0","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafe6f0","time":"2026-05-06T17:26:02.248Z"}
+{"event":"lmx.prebound-resolve.leave","module":"Lmx.dll","name":"PreboundReference.Resolve","prebound":{"ptr":"0x8f2fc60","referenceString":{"length":25,"capacity":31,"value":"TestChildObject.ScanState"},"contextString":{"length":0,"capacity":7,"value":""},"auxString":{"length":0,"capacity":7,"value":""},"mxReference":"0x8f34f50","flags10":1124099840,"word14":2,"word4c":131073,"word54":131786164,"word58":0,"word5c":0,"word60":0,"word64":150106800,"word68":0,"word6c":0,"worda0":0,"worda4":0,"status":3,"flagb0":0,"errorText":"","raw":"08 64 19 10 f0 63 19 10 00 6f 00 6e e8 63 19 10 00 67 00 43 02 00 00 00 c0 4e f3 08 00 65 00 00 00 02 00 00 00 00 00 02 19 00 00 00 1f 00 00 00 00 00 00 01 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 01 00 02 00 50 4f f3 08 b4 e5 da 07 00 00 00 00 00 00 00 00 00 00 00 00 b0 72 f2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 04 79 d4 00 00 00 00 00"},"retval":"0x70d01e01","time":"2026-05-06T17:26:02.249Z"}
+{"event":"lmx.prebind.leave","module":"Lmx.dll","name":"MxConnection.PrebindReference","handle":1,"time":"2026-05-06T17:26:02.250Z"}
+{"event":"call.enter","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","address":"0x61b842b4","ecx":"0xafe8b0","args":["0x5f592d0","0x1","0x1","0xb68f4ff0","0x744d4704"],"time":"2026-05-06T17:26:02.251Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x8f272b0","outPtr":"0xafe730","inWords":[65537,327682,186166,655465,37447,0],"time":"2026-05-06T17:26:02.251Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xafe730","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafe730","time":"2026-05-06T17:26:02.252Z"}
+{"event":"lmx.fixup-mxhandle.enter","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","accessManager":"0x8f272b0","outPtr":"0xafd3c4","inWords":[65537,327682,186166,655465,37447,0],"time":"2026-05-06T17:26:02.252Z"}
+{"event":"lmx.fixup-mxhandle.leave","module":"Lmx.dll","name":"AccessManager.FixUpMxHandle","outPtr":"0xafd3c4","handle":{"raw":"01 00 01 00 02 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00","w0":65537,"w1":327682,"w2":186166,"w3":655465,"w4":37447},"retval":"0xafd3c4","time":"2026-05-06T17:26:02.252Z"}
+{"event":"call.leave","module":"LmxProxy.dll","name":"CLMXProxyServer.AdviseSupervisory","retval":"0x0","time":"2026-05-06T17:26:02.253Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x8f2c9d8","0x1","0x1","0x1","0x2","0x0","0x13a","0x8f2fd20","0xafe574","0x1c6cdd4e"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":1,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":314,"ptr":"0x8f2fd20","hex":"17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 6a 00 00 00 40 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 a8 f3 f2 08 1f 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 00 00 01 00 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 76 00 00 00 4c 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 28 fa f2 08 20 01 00 02 00 00 00"}],"time":"2026-05-06T17:26:02.360Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x1","0x168","0xa4e9020","0x44e158a0","0x8f2f8ec","0x8f2f8dc","0x63b0dd04","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":360,"ptr":"0xa4e9020","hex":"01 00 3a 01 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 02 00 00 30 75 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 6a 00 00 00 40 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 a8 f3 f2 08 1f 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 00 00 01 00 00 00 17 01 00 01 01 00 01 00 00 00 65 00 71 00 0a 00 00 00 00 00 08 76 00 00 00 4c 00 00 81 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 28 fa f2 08 20 01 00 02 00 00 00"}],"time":"2026-05-06T17:26:02.363Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:02.363Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:26:02.363Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x8f2c9d8","0x1","0x1","0x2","0x2","0x0","0x27","0x8f30810","0xafe574","0x1c6cdd4e"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":2,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":39,"ptr":"0x8f30810","hex":"1f 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 00 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:26:02.364Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x2","0x55","0xa4e9020","0x44e158a0","0x8f369d4","0x8f369c4","0x63b0dd04","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":85,"ptr":"0xa4e9020","hex":"01 00 27 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 02 00 00 30 75 00 00 1f 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 00 00 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:26:02.364Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:02.364Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:26:02.365Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x8f2c9d8","args":["0x2c2","0x7855de0","0x763e9c0","0x769cedd8","0x8f2c9e4","0x2c2","0x7855de0","0x206","0x3","0x7890dbc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":706,"ptr":"0x7855de0","hex":"01 00 94 02 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00 40 1f 50 80 08 a6 00 00 00 40 00 00 91 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 18 00 00 00 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 00 00 28 00 00 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 44 00 65 00 70 00 6c 00 6f 00 79 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 6c 00 00 00 41 00 6e 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 42 00 61 00 73 00 65 00 20 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 1f 00 00 50 80 01 00 01 00 01 00 30 75 00 00 c1 7f b2 2c 25 f4 17 42 bc df 76 e6 78 49 01 0e fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 40 1f 50 80 08 be 00 00 00 4c 00 00 91 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 2e 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 18 00 00 00 44 00 65 00 76 00 50 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 00 00 34 00 00 00 47 00 52 00 2e 00 54 00 69 00 6d 00 65 00 4f 00 66 00 4c 00 61 00 73 00 74 00 43 00 6f 00 6e 00 66 00 69 00 67 00 43 00 68 00 61 00 6e 00 67 00 65 00 00 00 02 00 00 00 00 00 01 01 00 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 01 6c 00 00 00 41 00 6e 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 42 00 61 00 73 00 65 00 20 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 20 00 00 50 80 01 00 01 00 01 00 30 75 00 00"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7890dbc","hex":"90 f9 db"}],"time":"2026-05-06T17:26:02.379Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:26:02.380Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x8f2c9d8","args":["0x97","0x7cfca08","0x763e9c0","0x769cedd8","0x8f2c9e4","0x97","0x7cfca08","0x206","0x3","0x7890dbc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":151,"ptr":"0x7cfca08","hex":"01 00 69 00 00 00 00 00 00 00 3b 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 02 00 00 30 75 00 00 32 01 00 02 00 00 00 c1 7f b2 2c 25 f4 17 42 bc df 76 e6 78 49 01 0e fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 01 00 00 00 03 00 00 00 c0 00 b0 fd 44 d6 75 dd dc 01 06 0a 00 00 00 00 99 8c 8a 6e da dc 01 00 00 02 00 00 00 03 00 00 00 c0 00 f0 99 45 d6 75 dd dc 01 06 0a 00 00 00 00 fb 56 ce 19 dd dc 01 00 00"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7890dbc","hex":"90 f9 db"}],"time":"2026-05-06T17:26:02.381Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:26:02.381Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x8f2c9d8","args":["0x5c","0xd67de8","0x763e9c0","0x769cedd8","0x8f2c9e4","0x5c","0xd67de8","0x206","0x3","0x7890dbc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":92,"ptr":"0xd67de8","hex":"01 00 2e 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 02 02 00 00 30 75 00 00 00 00 50 80 01 00 01 00 02 00 30 75 00 00 17 59 01 a9 16 2a 80 40 99 d9 d4 80 28 2c b7 2a fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7890dbc","hex":"90 f9 db"}],"time":"2026-05-06T17:26:02.412Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:26:02.412Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","address":"0x63af12da","ecx":"0x8f2c9d8","args":["0x69","0x7872b38","0x763e9c0","0x769cedd8","0x8f2c9e4","0x69","0x7872b38","0x206","0x3","0x7890dbc"],"candidates":[{"sizeIndex":5,"ptrIndex":6,"size":105,"ptr":"0x7872b38","hex":"01 00 3b 00 00 00 00 00 00 00 3c 1a 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 02 00 00 30 75 00 00 32 01 00 01 00 00 00 17 59 01 a9 16 2a 80 40 99 d9 d4 80 28 2c b7 2a fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 03 00 00 00 00 00 00 00 c0 00 c0 3e 0b d8 75 dd dc 01 01 ff"},{"sizeIndex":7,"ptrIndex":8,"size":518,"ptr":"0x3","hex":""},{"sizeIndex":8,"ptrIndex":9,"size":3,"ptr":"0x7890dbc","hex":"90 f9 db"}],"time":"2026-05-06T17:26:02.414Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.ProcessDataReceived","retval":"0x1","time":"2026-05-06T17:26:02.414Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x1","0x2e","0xa4e9020","0x44e15894","0x8f272b0","0x0","0x0","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":46,"ptr":"0xa4e9020","hex":"01 00 00 00 00 00 00 00 00 00 3b 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 02 02 00 00 30 75 00 00"}],"time":"2026-05-06T17:26:02.458Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:02.459Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x2","0x2e","0xa4e9020","0x44e15894","0x8f272b0","0x0","0x0","0x64"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":46,"ptr":"0xa4e9020","hex":"01 00 00 00 00 00 00 00 00 00 3c 1a 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 02 02 00 00 30 75 00 00"}],"time":"2026-05-06T17:26:02.475Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:02.476Z"}
+{"event":"mx.activate.begin","module":"LmxProxy.dll","name":"CLMXProxyServer.Activate","address":"0x61b84028","ecx":"0xafe8ac","serverHandle":1,"itemHandle":1,"statusOutPtr":"0xafec9c","time":"2026-05-06T17:26:02.982Z"}
+{"event":"mx.activate.end","module":"LmxProxy.dll","name":"CLMXProxyServer.Activate","retval":"0x0","serverHandle":1,"itemHandle":1,"status":{"raw":"ff ff af 00 00 00 00 00","success":-1,"category":175,"detectedBy":0,"detail":0},"time":"2026-05-06T17:26:02.982Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x8f2c9d8","0x1","0x1","0x1","0x2","0x0","0x3a","0x8f30348","0xafe730","0x1c6cdf8a"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":1,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":58,"ptr":"0x8f30348","hex":"21 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 00 00 00 22 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 02 00 00 00"}],"time":"2026-05-06T17:26:10.206Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x1","0x68","0xa4e9020","0x44e15ae4","0x8f36fac","0x8f36f9c","0x63b0dd04","0x0"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":104,"ptr":"0xa4e9020","hex":"01 00 3a 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 02 00 00 30 75 00 00 21 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 01 00 53 f2 9a 00 6a 00 0a 00 5f f1 00 00 01 00 00 00 22 01 00 01 00 53 f2 9a 00 6b 00 0a 00 87 3a 00 00 02 00 00 00"}],"time":"2026-05-06T17:26:10.207Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:10.207Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:26:10.207Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","address":"0x63af5169","ecx":"0x1","args":["0x8f2c9d8","0x1","0x1","0x2","0x2","0x0","0x25","0x8f302b8","0xafe730","0x1c6cdf8a"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":2,"ptr":"0x2","hex":""},{"sizeIndex":6,"ptrIndex":7,"size":37,"ptr":"0x8f302b8","hex":"21 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:26:10.208Z"}
+{"event":"nmx.enter","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","address":"0x63af0996","ecx":"0x8f2c9d8","args":["0x1","0x1","0x2","0x53","0xa4e9020","0x44e15ae4","0x8f36e2c","0x8f36e1c","0x63b0dd04","0x0"],"candidates":[{"sizeIndex":3,"ptrIndex":4,"size":83,"ptr":"0xa4e9020","hex":"01 00 25 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 fc 7f 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 02 00 00 30 75 00 00 21 01 00 fb 41 af 3a 53 c9 17 4f b1 11 36 e0 d2 44 d5 22 05 00 36 d7 02 00 69 00 0a 00 47 92 00 00 03 00 00 00"}],"time":"2026-05-06T17:26:10.209Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.TransferData","retval":"0x0","time":"2026-05-06T17:26:10.210Z"}
+{"event":"nmx.leave","module":"NmxAdptr.dll","name":"CNmxAdapter.PutRequest","retval":"0x0","time":"2026-05-06T17:26:10.210Z"}
+Process terminated
+
+Thank you for using Frida!

captures/124-frida-activate-advised-instrumented/harness.log

@@ -0,0 +1,17 @@
+2026-05-06T17:25:56.9336608+00:00	harness.start	{"Scenario":"activate-advised","ClientName":"MxFridaTrace-124","Tags":["TestChildObject.ScanState"],"ItemContext":"","WriteType":"string","WriteValue":"","WriteValues":[],"UserId":0,"CurrentUserId":0,"VerifierUserId":0,"UserGuid":"","AuthUser":"","AuthenticateBeforeWrite":false,"UseAuthenticatedUserAsVerifier":false,"UsePlainAdvise":false,"WriteTimestamp":"","WriteDelayMilliseconds":750,"WriteIntervalMilliseconds":500,"BufferedUpdateInterval":1000,"DurationSeconds":8,"ProcessBitness":"x86","Runtime":"4.0.30319.42000"}
+2026-05-06T17:26:02.0166476+00:00	mx.register.begin	{"ClientName":"MxFridaTrace-124"}
+2026-05-06T17:26:02.2451960+00:00	mx.register.end	{"SessionHandle":1}
+2026-05-06T17:26:02.2451960+00:00	mx.additem.begin	{"Tag":"TestChildObject.ScanState"}
+2026-05-06T17:26:02.2506300+00:00	mx.additem.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:02.2506300+00:00	mx.advise-supervisory.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:02.2533435+00:00	mx.advise-supervisory.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:02.4738071+00:00	mx.event.data-change	{"SessionHandle":1,"ItemHandle":1,"Value":{"Type":"System.Boolean","Value":"True"},"Quality":192,"Timestamp":{"Type":"System.String","Value":"5/6/2026 1:26:02.460 PM"},"Status":[{"Success":-1,"Category":"MxCategoryOk","Source":"MxSourceRequestingLmx","Detail":0}]}
+2026-05-06T17:26:02.9814081+00:00	mx.activate.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:02.9832463+00:00	mx.activate.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1,"Status":{"Success":-1,"Category":"MxCategoryOk","Source":"MxSourceRequestingLmx","Detail":0}}
+2026-05-06T17:26:10.2003645+00:00	mx.unadvise.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:10.2012649+00:00	mx.unadvise.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:10.2012649+00:00	mx.removeitem.begin	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:10.2012649+00:00	mx.removeitem.end	{"Tag":"TestChildObject.ScanState","ItemHandle":1}
+2026-05-06T17:26:10.2012649+00:00	mx.unregister.begin	{"SessionHandle":1}
+2026-05-06T17:26:12.7977621+00:00	mx.unregister.end	{"SessionHandle":1}
+2026-05-06T17:26:12.8031645+00:00	harness.stop	{}

design/70-risks-and-open-questions.md

@@ -40,32 +40,87 @@ The `OnBufferedDataChange` **public event shape** the wwtools api-notes describe
 
 **Settles when:** ✅ settled per option (a). Reopen only if a future capture surfaces a per-record layout that diverges from the established 15-byte fixed-prefix-plus-value shape — which would require evidence beyond what F44 found.
 
-### R3 — `OperationComplete` trigger unproven
+### R3 — `OperationComplete` trigger unproven **(settled 2026-05-06 — Path A landed: synthesizer kernel + typed `OperationStatus` events ported)**
 
-**Severity: P1** (significant blocker for OperationComplete consumers — ships verbatim, no typed promotion)
+**Severity: P1** (was a blocker; settled per Path A — typed promotion landed via `MxStatus::from_packed_u32`)
 
-`work_remain.md:154–163`: ASB has no native OperationComplete; NMX completion-only frames have no proven mapping table. The .NET reference does not synthesise the event; the Rust port must not either.
+**Status (2026-05-06): SETTLED PER PATH A.** The five-stage Ghidra walk that previously settled the verdict at "verbatim preserve" was extended with a sixth stage that found the actual byte→`MXSTATUS_PROXY` synthesizer. It is **`Lmx.dll!FUN_10100ce0`** — a single 4-byte u32 LE → `MxStatus` decoder used by every NMX-frame parser in `Lmx.dll`. Bit layout:
 
-**Current best answer:** expose `Session::operation_status_events()` as `Stream<Item = RawOperationStatus>` carrying frame bytes. Promote to a typed `WriteCompleted` only if the frame matches the proven `00 00 50 80 00` 5-byte pattern.
+```
+bit 31:        success    (-1 if set, 0 if clear)
+bits 27..24:   category   (4 bits, masked by 0xF)
+bits 23..20:   detected_by (4 bits, masked by 0xF)
+bits 15..0:    detail     (i16 — low 16 bits, signed)
+bits 30..28, 19..16: reserved/padding
+```
 
-**Settles when:** indefinitely deferred — see Open evidence gaps table. Settle criteria depends on a Ghidra mapping table (the `aaDCT` tables in `Lmx.dll`) that does not exist in `analysis/ghidra/` and has no owner. No current artifact in this repo produces the byte→status mapping. Reopen if a future capture or decompiled output produces evidence.
+The Rust port now ships this kernel as [`MxStatus::from_packed_u32`] (and the inverse `to_packed_u32` for round-trip parity). `Session::operation_status_events()` emits typed [`OperationStatus`] events for every `0x32`/`0x33`-or-similar callback the wire delivers; the synthesizer is byte-deterministic and context-free, so the operation-tracking state machine the original verdict deferred is **not** required for the kernel itself. Per-operation context tracking (correlating completion frames back to outstanding writes/subscribes) is filed as a follow-up: see F54 below.
 
-### R4 — Completion-only byte mapping
+A second mapping was also ported: `MxStatus::from_nmx_response_code` covers the constructed-from-response-code path in `Lmx.dll!FUN_1010bd10:741-770` (`ScanOnDemandCallback::GetResponse`), which builds an `MxStatus` from a 1-byte NMX `responseCode` field when no payload status word is present. Six proven mappings: `0x01`/`0x02` → `(CommunicationError, RequestingNmx)`, `0x03` → `(ConfigurationError, RequestingNmx)`, `0x04` → `(ConfigurationError, RespondingNmx)`, `0x05` → `(CommunicationError, RespondingNmx)`, `0x1A` → `(CommunicationError, RequestingNmx)`. Unmapped codes return `None` and the consumer falls back to verbatim preservation per CLAUDE.md "Do not fabricate protocol behavior."
 
-**Severity: P1** (significant blocker for typed completion semantics — ships verbatim)
+**What about the 1-byte completion frames `0x00`/`0x41`/`0xEF`?** Those are NOT decoded by `FUN_10100ce0` — they're a different wire field (the NMX operation-status callback payload, not the `INmxService.GetResponse2 responseCode` parameter). `Lmx.dll`'s decoder for those frames does not invoke any status-synthesis logic; they propagate as raw byte → `MxStatus { success: 0, Unknown, Unknown, detail: byte }`. The Rust port preserves this exactly. R4 is settled by the same fact (see below).
 
-`0x00`, `0x41`, `0xEF` are observed as raw 1-byte completion frames (`work_remain.md:164–174`). They get preserved as `RawOperationStatus { byte: u8 }` without typed promotion.
+**Aside — the .NET-reference shim was always half-implemented.** Verified at `src/MxNativeClient/MxNativeCompatibilityServer.cs:756` + `src/MxNativeCodec/NmxOperationStatusMessage.cs:18`: `MxNativeCompatibilityServer` fires `WriteCompleted` only when `IsMxAccessWriteComplete` is true, which gates strictly on `Format == StatusWord && StatusCode == 0x8050 && CompletionCode == 0x00` — i.e. the one exact 5-byte pattern `00 00 50 80 00` (= `MxStatus.WriteCompleteOk`). Every other completion frame (the 1-byte `0x00`/`0x41`/`0xEF` ones and any non-success status word) is silently dropped at the gate. The native consumer-facing `WriteCompleted` event has therefore **only ever fired for unambiguous successful writes** — failure outcomes have been invisible at the compatibility-shim layer for the entire history of the .NET reference. Path A's kernel (`from_packed_u32`) closes this asymmetry on the Rust side: `Session::operation_status_events()` exposes **all** typed outcomes the upstream synthesizer produces, not just the WriteCompleteOk slice. The Rust port now has strictly broader operation-status visibility than the .NET reference offered.
 
-**Current best answer:** `Session::operation_status_events()` carries `RawOperationStatus(u8)` for these. Document as "preserved verbatim until mapping table is found." Same Ghidra dependency as R3.
+Logs:
+- `analysis/ghidra/exports/Lmx.dll.aadct-decompile.md` — `aaDCT` symbol (stage 1)
+- `analysis/ghidra/exports/LmxProxy.dll.completion-status-decompile.md` — Fire_* event handlers (stage 2)
+- `analysis/ghidra/exports/LmxProxy.dll.fire-event-xrefs.md` — xrefs to Fire_* (stage 3)
+- `analysis/ghidra/exports/LmxProxy.dll.status-synthesis-decompile.md` — Fire_* callers (stage 4)
+- `analysis/ghidra/exports/LmxProxy.dll.mxstatus-safearray-decompile.md` — `FUN_10003f60` (stage 5)
+- `analysis/ghidra/exports/Lmx.dll.set-attribute-result-decompile.md` — `PreboundReference::OnSetAttributeResult` (stage 6, entry to next ring)
+- `analysis/ghidra/exports/Lmx.dll.set-attribute-result-xrefs.md` — xrefs to `OnSetAttributeResult`/`CancelWithStatus`/`OperationComplete` (next-ring discovery)
+- `analysis/ghidra/exports/Lmx.dll.synthesizer-decompile.md` — `ScanOnDemandCallback::OperationComplete`/`MultipleOperationComplete` (`FUN_1010b990`), `RemotePlatformResolver::OperationComplete` (`FUN_1010dc80`), and the constructed-from-responseCode synthesizer `FUN_1010bd10` (lines 698-770)
+- `analysis/ghidra/exports/Lmx.dll.synthesizer-helpers-decompile.md` — `FUN_10003fc0` (the `<success %d category %d ...>` formatter), `FUN_1008f150` (the dispatch helper), `PreboundReference` constructors
+- `analysis/ghidra/exports/Lmx.dll.synthesizer-helpers2-decompile.md` — **the synthesizer kernel `FUN_10100ce0`** (4-byte u32 → `MxStatus` decoder), `FUN_10100bc0` (3×u16 reader), `FUN_1005e580` (4-byte stream reader), `FUN_1010ee00` (sister NMX-frame parser using the same kernel)
+- `analysis/ghidra/exports/Lmx.dll.synthesizer-callers-xrefs.md` — caller graph for the synthesizer ring
 
-**Settles when:** indefinitely deferred — see Open evidence gaps table. Settle criteria depends on the same Ghidra mapping table as R3, which does not exist in `analysis/ghidra/` and has no owner. Reopen if a future capture or decompiled output produces evidence.
+Findings, layer by layer (the wire bytes flow inward; the synthesis flows outward):
 
-### R5 — Activate / Suspend behaviour **(partially observed — F44 documented client-side trigger; wire-side residual gap filed as F45)**
+1. **`Lmx.aaDCT`** at `0x10178fc0` is a `SysAllocString(L"Lmx.aaDCT")` into a global BSTR — a tracing category name, not a status-mapping table. No array / lookup logic.
+2. **`MXSTATUS_PROXY`** (16 bytes, Pack=4) is a 4-field marshalled struct: `success: i16` at offset 0, `category: i16` at offset 4, `detectedBy: i16` at offset 8, `detail: i16` at offset 12. It is the *output* of synthesis, not a lookup-table entry.
+3. **`LmxProxy.dll` Fire_* event handlers** (`FUN_10015f72`, `FUN_1001611f`, `FUN_10016271`, `FUN_100163c0`) take an *already-populated* `MXSTATUS_PROXY[]` and forward it through ATL connection-point dispatch. No synthesis here.
+4. **`LmxProxy.dll` Fire_* callers** (`FUN_1001657f` for OnDataChange / OnBufferedDataChange, `FUN_10016b50` for OnWriteComplete, `FUN_10016d4b` for OperationComplete) call **`FUN_10003f60(out_safearray, in_status_ptr, count=1)`** which creates the SafeArray. `FUN_10003f60` is **a verbatim memcpy** of an existing 14-byte buffer into the SAFEARRAY data — no transformation.
+5. **`Lmx.dll` `PreboundReference::OnSetAttributeResult`** (`FUN_10114a90`) — the CALLER of step 4's path — receives an already-populated `short *param_7` status buffer; synthesis is upstream of THIS function too.
+6. **The synthesizer kernel itself**: **`Lmx.dll!FUN_10100ce0`** (see `analysis/ghidra/exports/Lmx.dll.synthesizer-helpers2-decompile.md`). A 4-byte u32 LE read from a stream → 4-tuple `MxStatus` decoder. Pure transformation, no operation-context dependency. Used by every NMX-frame parser in `Lmx.dll` (`FUN_1010bd10` `ScanOnDemandCallback::GetResponse`, `FUN_1010ee00` `AccessManager::ProcessNmxRequest`, `FUN_10110986`, etc.) — the upstream decoder reads the wire bytes, the kernel translates them.
+7. **The constructed-when-no-bytes path**: when an NMX `responseCode != 0` arrives without a payload status word, `FUN_1010bd10:741-770` constructs an `MxStatus` from the responseCode itself via a fixed switch. Six proven response codes (1, 2, 3, 4, 5, 0x1A); see the table in the `MxStatus::from_nmx_response_code` doc.
 
-**Severity: P2** (downgraded from P1 — client-side acceptance criteria are
-now documented; LMX-proxy wire emission remains unconfirmed)
+**Path A landed.** The synthesizer kernel and the constructed-from-response-code switch were both portable as pure functions — no operation-tracking state machine required for the kernel itself, because `FUN_10100ce0` is byte-deterministic. Rust port:
 
-**Status (2026-05-06): PARTIALLY OBSERVED.** F44's evidence walk on
+- `mxaccess-codec::status::MxStatus::from_packed_u32(packed: u32) -> MxStatus` — the kernel.
+- `mxaccess-codec::status::MxStatus::to_packed_u32() -> u32` — inverse, for round-trip parity.
+- `mxaccess-codec::status::MxStatus::from_nmx_response_code(byte: u8) -> Option<MxStatus>` — the response-code switch.
+- `mxaccess::OperationKind` + `mxaccess::OperationContext` types for future correlation work (per-operation tracking is filed as F54).
+- `mxaccess::Session::operation_status_events()` returns `broadcast::Receiver<Arc<OperationStatus>>`; `operation_status_stream()` returns the `Stream<Item = Result<...>>` variant.
+- `mxaccess::OperationStatus { raw, status, context, is_during_recovery }` — matches `MxNativeOperationStatusEvent` (`MxNativeSession.cs:73-78`) plus typed `MxStatus` promotion.
+- The callback router (`session::callback_router`) now tries operation-status parsing first, mirroring `MxNativeSession.OnCallbackReceived:574`.
+
+**What about the 1-byte completion frames `0x00`/`0x41`/`0xEF`?** They are NOT decoded by `FUN_10100ce0` (they're a different wire field at a different layer — the NMX operation-status callback payload, not the `INmxService.GetResponse2` responseCode parameter). Per CLAUDE.md "Do not fabricate protocol behavior" they continue to propagate as `MxStatus { success: 0, Unknown, Unknown, detail: byte }`. R4 is settled by the same fact.
+
+**Current best answer:** Path A landed. `Session::operation_status_events()` emits typed `OperationStatus` events. The synthesizer kernel (`MxStatus::from_packed_u32`) is exposed for any consumer that holds a 4-byte packed status word (e.g. extracted from a subscription record's `status: i32` field). Per-operation context (correlating completion frames back to outstanding writes/subscribes) is the next step — filed as F54.
+
+**Reopen when:** F54 lands per-operation correlation, or a future capture surfaces a fresh wire field whose synthesis logic doesn't reduce to `FUN_10100ce0` + `from_nmx_response_code` (no such field has been observed to date).
+
+### R4 — Completion-only byte mapping **(settled 2026-05-06 — verbatim-preserve confirmed; synthesizer doesn't apply at this layer)**
+
+**Severity: P1** (was a blocker; now settled per the same R3 Path A finding — by exclusion)
+
+**Status (2026-05-06): SETTLED.** R3's Path A walk traced the byte→`MxStatus` synthesizer to **`Lmx.dll!FUN_10100ce0`**, a 4-byte u32 LE → `MxStatus` decoder. The 1-byte completion frames `0x00`, `0x41`, `0xEF` (`work_remain.md:164–174`) are NOT input to that decoder — they're a different wire field, observed at a different layer (the NMX operation-status callback payload, not the `INmxService.GetResponse2` responseCode parameter or any 4-byte packed status field). `Lmx.dll`'s decoder for the 1-byte completion-only inner body does not invoke any synthesis logic; the bytes propagate untransformed.
+
+**Current best answer:** unchanged — preserve as `MxStatus { Success: 0, Category: Unknown, DetectedBy: Unknown, Detail: byte }`. `mxaccess-codec::NmxOperationStatusMessage::promote_to_typed` returns the verbatim placeholder for these frames; `mxaccess::Session::operation_status_events()` surfaces them via the typed `OperationStatus.status` field with the byte preserved in `detail`.
+
+**Reopen when:** a fresh capture proves a synthesis rule for a specific 1-byte completion code under a specific operation context (e.g. via Frida pairs `LmxProxy.dll!FUN_10003f60` input vs. observed event payload). At that point file a sub-followup with the captured `(byte, context, observed status)` triple and decide whether to add a typed mapping.
+
+### R5 — Activate / Suspend behaviour **(SETTLED 2026-05-06 — F50 live capture proves Suspend is server-side wire op `0x2D`; Activate against a non-suspended item is client-side only)**
+
+**Severity: P3** (downgraded from P2 — wire behaviour now characterised, no implementation gap blocking M6 / V1 since `Session::suspend` / `Session::activate` aren't part of the public API today; if/when added, the `0x2D` opcode is the encoder target).
+
+**Settled (2026-05-06):** F50 captured `123-frida-suspend-advised-instrumented/` and `124-frida-activate-advised-instrumented/`. See `docs/F50-suspend-activate-evidence.md` for the byte-level evidence. Summary:
+- **Suspend** emits NMX `PutRequest` with command byte `0x2D` ~140ms after the LMX-proxy entry hook, body shape matches AdviseSupervisory's `<command:1> <version:2> <correlation_id:16> <body:22>` family.
+- **Activate** (against a non-suspended item, the only scenario the harness sequences) returns synchronously client-side with no wire traffic; same client-side behaviour F44 documented for capture 077.
+
+**Status (2026-05-06): PARTIALLY OBSERVED — Frida hooks ready, live capture pending.**
+F44's evidence walk on
 `captures/077-frida-suspend-advised-scanstate/` (per `docs/M6-buffered-evidence.md`)
 documents:
 
@@ -83,15 +138,27 @@ What capture 077 could **not** answer: whether the production
 (e.g. an `ILMXProxyServer5` opnum) or also handles them client-side. Capture
 077's Frida script did not hook
 `LmxProxy.dll!CLMXProxyServer.Suspend`/`.Activate`, so the wire-side
-behaviour is invisible. Filed as **F45** in `design/followups.md` to
-re-instrument and capture.
+behaviour is invisible.
+
+**Next step — F46.** `analysis/frida/mx-nmx-trace.js` now carries
+`Interceptor.attach` blocks for `LmxProxy.dll!CLMXProxyServer.Suspend`
+(RVA `0x13d9c`, `FUN_10013d9c`) and `.Activate` (RVA `0x14028`,
+`FUN_10014028`), emitting `mx.suspend.begin/end` and
+`mx.activate.begin/end` events with the `MxStatus*` out-parameter
+decoded as 4 × int16. No `Resume` / `Reactivate` symbols exist in
+`LmxProxy.dll` — verified against
+`analysis/ghidra/exports/LmxProxy.dll.ghidra.md` and the decompiled
+`ILMXProxyServer5` / `ILMXProxyServer4` interfaces. R5 stays open
+until a live re-run on the AVEVA host produces
+`captures/NNN-frida-suspend-activate-instrumented/` per the procedure
+documented at the top of `analysis/frida/mx-nmx-trace.js`.
 
 **Current best answer:** expose `Session::suspend(item)` and
 `Session::activate(item)` returning `Result<MxStatus, Error>`. The success
 criteria match the .NET reference's client-side gating: the item must have
-an active subscription. If F45's wire capture later proves the LMX proxy
+an active subscription. If F46's wire capture later proves the LMX proxy
 issues a separate ORPC method, add the wire emission here in M6 follow-up.
-Do not build callback-driven state transitions on top until F45 settles.
+Do not build callback-driven state transitions on top until F46 settles.
 
 **Settles when:** F45 produces a Frida capture instrumenting
 `LmxProxy.dll!CLMXProxyServer.Suspend` / `.Activate` and either confirms a
@@ -125,15 +192,17 @@ Original framing of this risk asserted that "`WriteSecured` (without `2`) return
 
 ## Implementation-level
 
-### R8 — NTLMv2 cross-domain auth
+### R8 — NTLMv2 cross-domain auth **(permanently deferred 2026-05-06 — external infrastructure gap)**
 
 **Severity: P1** (significant blocker for cross-domain deployments — single-domain ships)
 
-Captured traffic is single-domain (local AVEVA install). Cross-domain NTLM requires AV pair handling that has not been tested.
+**Status (2026-05-06): PERMANENTLY DEFERRED.** The implementation already parses NTLM AV pairs per [MS-NLMP] §2.2.2.1, including the cross-domain AV pair shapes (`MsvAvDnsTreeName`, `MsvAvDnsComputerName` carry the trusted-domain DNS suffix instead of the local one). What's missing is the *live capture* needed to pin a regression fixture — and that requires a multi-domain Windows lab (e.g. `LAB-A` + `LAB-B` with cross-domain trust + an AVEVA install on `LAB-A` authenticating a `LAB-B`-domain user) which is not available on the dev host. Same external-infrastructure constraint as `F3` in `design/followups.md`. R8 is closed in the same sense F3 is closed — the implementation is in place per spec; only the evidence is gated on hardware that doesn't exist here.
 
-**Current best answer:** implement AV pair parsing per [MS-NLMP] §2.2.2.1 and document `mxaccess-rpc` as untested across domains. Provide fixtures from any successful cross-domain probe.
+Captured traffic is single-domain (local AVEVA install). Cross-domain NTLM exercises the AV pair codepaths but the bytes haven't been pinned.
 
-**Settles when:** a cross-domain probe runs successfully end-to-end with packet-integrity signatures verified.
+**Current best answer:** the AV pair parser handles the cross-domain shape per [MS-NLMP] §2.2.2.1; document `mxaccess-rpc` as untested across domains in the README. The `mxaccess-rpc::ntlm` round-trip tests cover the single-domain shape; cross-domain rounds-trip through the same code path (the AV pair parser is shape-agnostic) but no live fixture pins it.
+
+**Reopen when:** a multi-domain AVEVA test harness becomes available + a cross-domain probe runs successfully end-to-end with packet-integrity signatures verified. Until then, this risk is permanently deferred — same status pattern as F3. Self-contained provisioning recipe (lab topology, DC/DNS/trust setup, capture procedure, fixture layout, round-trip test skeleton) at `docs/F3-cross-domain-ntlm-recipe.md`.
 
 ### R9 — DPAPI dependency for ASB
 
@@ -329,10 +398,10 @@ These are missing fixtures that the design assumes will land by their respective
 | Fixture | Needed by | Captured how |
 |---|---|---|
 | ~~Multi-sample buffered batch~~ | ~~M6~~ | **CAPTURED (F44)** — `captures/094-frida-buffered-separate-writer/frida-events.tsv:145`; fixture under `crates/mxaccess-codec/tests/fixtures/m6-buffered/` |
-| Cross-domain NTLM Type1/2/3 | M2+ | multi-domain AVEVA test harness |
-| Activate/Suspend transition (wire) | M6 / F45 | **PARTIAL (F44)** — client-side conditions documented from capture 077; wire-side hooks (`LmxProxy.dll!CLMXProxyServer.Suspend/.Activate`) not yet instrumented |
+| ~~Cross-domain NTLM Type1/2/3~~ | ~~M2+~~ | **DEFERRED (R8)** — permanently external-blocked; needs multi-domain Windows lab not available on this dev host |
+| Activate/Suspend transition (wire) | M6 / F46 | **PARTIAL (F44 + F46)** — client-side conditions documented from capture 077; F46 added Frida hooks (`LmxProxy.dll!CLMXProxyServer.Suspend/.Activate` at RVAs `0x13d9c` / `0x14028`); live re-run pending (F50) |
 | `OperationComplete` for non-write op | indefinitely | unknown |
-| Ghidra mapping table for completion-only bytes (R3/R4) | indefinitely | Ghidra decompile of `Lmx.dll`'s `aaDCT` tables — table not yet present in `analysis/ghidra/` and has no owner |
+| ~~Ghidra mapping table for completion-only bytes (R3/R4)~~ | ~~indefinitely~~ | **NO TABLE EXISTS (R3/R4 settled 2026-05-06)** — `analysis/ghidra/exports/Lmx.dll.aadct-decompile.md` confirms `aaDCT` is a logging BSTR name, not a table; `LmxProxy.dll`'s Fire_* event handlers receive already-populated `MXSTATUS_PROXY[]` from per-event context synthesis upstream, not from a static lookup. Verbatim preservation is the canonical answer. |
 | ASB write timestamp + status fields | M5 | extended ASB Write/PublishWriteComplete probe |
 | ASB no-communication source-level evidence (`work_remain.md:198`) | M5 | live capture against an unconfigured ASB endpoint |
 | Partial-cleanup behavior after channel failure (`work_remain.md:196-197`) | M4/M5 | inject mid-flight failure during subscribe, observe cleanup state |

design/F48-publish-dry-run.md

@@ -0,0 +1,67 @@
+# F48 publish dry-run validation — 2026-05-06
+
+> **Note (2026-05-06):** This project is internal-use only and is **not** scheduled to publish to crates.io. F48's actual publish goal is out of scope. This document is retained as a workspace-hygiene record — `cargo package --list` per crate confirms each tarball would assemble cleanly (source + tests + small fixtures only, no captures or big files), which is useful regardless of whether an actual publish ever happens. The "What the actual V1 publish needs" section at the bottom is kept as a recipe in case this ever changes.
+
+This document captures the per-crate `cargo publish --dry-run` outcome on the workspace at `version = "0.0.0"`. Run from `rust/`.
+
+## Tier 1 — leaves (no internal deps)
+
+```text
+$ cargo publish --dry-run -p mxaccess-codec --allow-dirty
+    Finished `dev` profile [unoptimized + debuginfo] target(s)
+   Uploading mxaccess-codec v0.0.0
+warning: aborting upload due to dry run                          ← OK
+
+$ cargo publish --dry-run -p mxaccess-rpc --allow-dirty           ← OK
+$ cargo publish --dry-run -p mxaccess-asb-nettcp --allow-dirty    ← OK
+```
+
+All three pass. The `cargo package` step assembles the source tarball without errors; `--dry-run` aborts only at the network upload step.
+
+## Tiers 2 + 3 — dependent crates
+
+```text
+$ cargo publish --dry-run -p mxaccess-galaxy --allow-dirty
+Caused by:
+  no matching package named `mxaccess-codec` found
+  location searched: crates.io index
+  required by package `mxaccess-galaxy v0.0.0`
+```
+
+Identical "no matching package" failure for:
+- `mxaccess-galaxy`, `mxaccess-callback`, `mxaccess-asb` (tier 2)
+- `mxaccess-nmx`, `mxaccess`, `mxaccess-compat` (tier 3)
+
+This is **expected** — the workspace internal deps are pinned at `version = "0.0.0"` (placeholder for the as-yet-unpublished V1 cut). Cargo's registry lookup happens even with `--no-verify`, and `0.0.0` won't exist on crates.io until the leaves are actually published. The dependent crates will dry-run cleanly after each upstream tier lands.
+
+## Package contents
+
+`cargo package -p <crate> --list` confirms each crate's tarball includes only source, tests, and fixture data — no captures, decompiled binaries, or accidental large files.
+
+| Crate | File count | Notes |
+|---|---|---|
+| `mxaccess-codec` | 27 | source + 2 round-trip fixture binaries (~1KB each) |
+| `mxaccess-rpc` | 16 | source only |
+| `mxaccess-asb-nettcp` | 12 | source only |
+| `mxaccess-galaxy` | 11 | source only |
+| `mxaccess-callback` | 9 | source only |
+| `mxaccess-asb` | 14 | source only |
+| `mxaccess-nmx` | 7 | source only |
+| `mxaccess` | 18 | source + 7 examples |
+| `mxaccess-compat` | varies | source + 5 live tests |
+
+## If a publish ever does become a goal — recipe
+
+**Currently out of scope per maintainer 2026-05-06**, but kept here so future-them doesn't have to re-derive the steps:
+
+1. Bump workspace version `0.0.0` → `0.1.0` in `rust/Cargo.toml` `[workspace.package]`.
+2. For each crate's `[dependencies]` block, bump the workspace-internal `version = "0.0.0"` pins to `version = "0.1.0"` (path deps can stay).
+3. Publish in tier order (1 → 2 → 3). Wait for crates.io to index each tier (~30–60s) before starting the next.
+4. After all 9 are live, run `cargo install mxaccess` from a fresh checkout — should resolve cleanly without `--locked`.
+5. Tag `git tag v0.1.0 && git push origin v0.1.0`.
+
+## Open observations
+
+- The `--allow-dirty` flag was used because the workspace has uncommitted edits during this validation pass; the actual publish should run from a clean working tree without that flag.
+- `Cargo.lock` is included in the published tarball for binary-target crates (notably `mxaccess` ships examples). This is the cargo default for crates with executables; library-only crates don't need it but cargo includes it anyway under the modern resolver.
+- No `package.exclude` rules were tripped: the `tests/fixtures/m6-buffered/*.bin` files in `mxaccess-codec` are tiny (round-trip fixtures, not big captures) and are deliberately shipped because the parity tests reference them.

design/M6-bench-baseline.md

@@ -15,16 +15,19 @@ The bench gates on this: any `write_message::encode` scenario at
 
 ## Baseline (release profile, Windows x64)
 
-| scenario                                  |   iters | allocs/op | bytes/op | deallocs/op |
-|-------------------------------------------|--------:|----------:|---------:|------------:|
-| `write_message::encode` (Int32)           |  10,000 |      2.00 |       44 |        2.00 |
-| `write_message::encode` (Float32)         |  10,000 |      2.00 |       44 |        2.00 |
-| `write_message::encode` (Float64)         |  10,000 |      2.00 |       52 |        2.00 |
-| `write_message::encode` (Boolean)         |  10,000 |      1.00 |       37 |        1.00 |
-| `write_message::encode` (String, 5 chars) |  10,000 |      4.00 |       92 |        4.00 |
-| `MxReferenceHandle::from_names`           |  10,000 |      2.00 |       22 |        2.00 |
-| `NmxSubscriptionMessage::parse_inner`     |  10,000 |      1.00 |       72 |        1.00 |
-| (DataUpdate, Int32)                       |         |           |          |             |
+| scenario                                       |   iters | allocs/op | bytes/op | deallocs/op |
+|------------------------------------------------|--------:|----------:|---------:|------------:|
+| `write_message::encode` (Int32)                |  10,000 |      2.00 |       44 |        2.00 |
+| `write_message::encode` (Float32)              |  10,000 |      2.00 |       44 |        2.00 |
+| `write_message::encode` (Float64)              |  10,000 |      2.00 |       52 |        2.00 |
+| `write_message::encode` (Boolean)              |  10,000 |      1.00 |       37 |        1.00 |
+| `write_message::encode` (String, 5 chars)      |  10,000 |      4.00 |       92 |        4.00 |
+| `write_message::encode_to_bytes_mut` (Int32)   |  10,000 |      2.00 |       44 |        2.00 |
+| `encode_into_bytes_mut` (Int32, pooled, F52.3) |  10,000 |      1.00 |        4 |        1.00 |
+| `encode_into_bytes_mut` (Bool,  pooled, F52.3) |  10,000 |      0.00 |        0 |        0.00 |
+| `MxReferenceHandle::from_names` (F52.2)        |  10,000 |      0.00 |        0 |        0.00 |
+| `NmxSubscriptionMessage::parse_inner`          |  10,000 |      1.00 |       72 |        1.00 |
+| (DataUpdate, Int32)                            |         |           |          |             |
 
 ## Read
 
@@ -56,6 +59,73 @@ With the target already met, F39's scope tightens to:
 
 These are nice-to-have optimisations rather than R12 blockers.
 
+## F52 deltas
+
+F52 split the three F39 sub-tasks into their own commits. Each
+optimisation lands with a before/after row in this section.
+
+### F52.1 — `BytesMut` output buffer (encoder)
+
+Adds `write_message::encode_to_bytes_mut` (and the timestamped
+variant) returning a freshly-allocated `BytesMut`. Allocation count
+is **identical** to the existing `encode` path — the benefit is
+downstream: consumers can `BytesMut::split_to` / `freeze` and forward
+the body bytes to a wire-level sink without an intermediate copy.
+
+| scenario                                     | before (allocs/op) | after (allocs/op) |
+|----------------------------------------------|-------------------:|------------------:|
+| `write_message::encode` (Int32)              |               2.00 |              2.00 |
+| `write_message::encode_to_bytes_mut` (Int32) |                  — |              2.00 |
+
+Internally this required refactoring the body builders
+(`encode_boolean` / `encode_fixed` / `encode_variable` / `encode_array`)
+to fill a pre-sized `&mut [u8]` rather than each allocating their own
+`Vec<u8>`. The dispatcher computes the body size up front via small
+`*_body_size` helpers and resizes the destination buffer (Vec or
+BytesMut) once. This is also the prerequisite refactor for F52.3.
+
+### F52.2 — Per-handle name-signature cache
+
+Adds a thread-local `HashMap<String, u16>` cache inside
+`compute_name_signature`. Repeated calls with the same name (the hot
+path inside `MxReferenceHandle::from_names` when handles are
+constructed many times) skip the `to_lowercase` allocation entirely.
+Capped at 1024 entries; on overflow the thread's cache is cleared.
+
+| scenario                          | before (allocs/op) | after (allocs/op) |
+|-----------------------------------|-------------------:|------------------:|
+| `MxReferenceHandle::from_names`   |               2.00 |              0.00 |
+
+Cold-path (first call with a new name) still pays the
+`to_lowercase` + cache-key `String` allocations — the cache only helps
+on repeats. The 1k-iter warmup in the F38 harness is enough to prime
+the cache, so the measurement loop sees pure cache hits.
+
+### F52.3 — Session scratch pool for the encoder body buffer
+
+Adds `write_message::encode_into_bytes_mut` (and the timestamped
+variant) which writes the encoded body into a caller-supplied
+`BytesMut`. The buffer is cleared and resized in place each call;
+once it has grown to the largest body the session will produce, it
+allocates nothing further.
+
+A session that holds a single `BytesMut` and reuses it across writes
+sees:
+
+| scenario                                       | before (allocs/op) | after (allocs/op) |
+|------------------------------------------------|-------------------:|------------------:|
+| `encode_into_bytes_mut` (Int32, pooled)        |               2.00 |              1.00 |
+| `encode_into_bytes_mut` (Boolean, pooled)      |               1.00 |              0.00 |
+
+The remaining `1.00` for Int32 is the `encode_scalar_value` scratch
+`Vec<u8>`. Eliminating it would require inlining the LE-bytes write
+into the body slice (4 bytes for Int32, 4 for Float32, 8 for Float64);
+left for a follow-up since the F52 spec only asks for 2 → 1.
+
+Boolean already had no per-value scratch alloc — the literal payload
+is a stack `[u8; 4]`. Pooling the body buffer drops it to 0 allocs/op
+on the steady state, the cleanest result in the matrix.
+
 ## Reproducing
 
 ```powershell

design/followups.md

@@ -6,45 +6,208 @@ move to `## Resolved` with a date + commit hash.
 
 ## Open
 
-### F45 — Recovery replay should re-issue `RegisterReference` for buffered subscriptions
-**Severity:** P2 — F36 buffered subscriptions survive across `recover_connection` only via `AdviseSupervisory` replay, which loses the `.property(buffer)` registration.
-**Source:** `crates/mxaccess/src/session.rs::recover_connection_core` (the loop iterates `subscriptions` and replays via `advise_supervisory`).
-**Depends on:** F36 (closed by the same iteration as this followup is filed).
+> **Status snapshot (2026-05-06):** Of the 8 entries in this section, only **F3** is genuinely open work. Every other entry's `**Status:**` line documents its closure (resolved with a date + commit pointer, or marked out-of-scope). They stay in this section as load-bearing context for future contributors who hit the same problems — moving them to `## Resolved` would orphan their analysis from the F-numbers other followups reference. New work goes here; status lines are authoritative for whether an entry needs further action.
 
-**Scope.** `Session::subscribe_buffered` records its `Subscription` in the same `SessionInner::subscriptions` registry as plain `subscribe` does, so the registry-walking recovery loop replays them via `AdviseSupervisory` rather than `RegisterReference` with `.property(buffer)`. The metadata stored in `SubscriptionEntry` is the original (un-suffixed) tag's `GalaxyTagMetadata`; the buffered name suffix is lost on replay. The server may continue to deliver values under the existing `.property(buffer)` registration on the engine side because the OBJREF / engine id pair survives the rebuild — but if the server tears the buffered registration down on disconnect, recovery will silently downgrade buffered → plain.
+### F48 — Execute `cargo publish` for the V1 release cut
+**Status:** **Out of scope — internal usage only, no crates.io publish planned.** Confirmed 2026-05-06 by maintainer. The workspace stays at `version = "0.0.0"` indefinitely; consumers depend via path or git, not crates.io. F43's dry-run validation (`design/F48-publish-dry-run.md`) is retained as a workspace-hygiene check (each crate's `cargo package --list` produces a clean tarball, no accidental captures/big files), not as release prep.
+
+If this changes (e.g. internal consumer wants registry-style versioning via a private cargo registry), the V1 publish recipe in `design/F48-publish-dry-run.md` describes the steps. For now: no work needed.
+
+### F50 — Run the F46 Suspend/Activate Frida capture live
+**Status:** **Resolved 2026-05-06.** Two captures landed under `captures/123-frida-suspend-advised-instrumented/` (suspend-advised scenario) and `captures/124-frida-activate-advised-instrumented/` (activate-advised scenario). Per-byte evidence in `docs/F50-suspend-activate-evidence.md`; R5 in `design/70-risks-and-open-questions.md` moved to settled.
+
+**Verdict:**
+- **Suspend** is server-side: emits NMX `PutRequest` with command `0x2D` ~140ms after the LMX-proxy entry, body `2d 01 00 + correlation_id + 22 bytes` (same shape family as `0x1F` AdviseSupervisory).
+- **Activate** against a non-suspended item is client-side only — no wire traffic, returns Success synchronously. The harness `activate-advised` scenario doesn't sequence Suspend-then-Activate; if direct evidence for Activate-after-Suspend is needed later, add a new scenario to `MxTraceHarness/Program.cs`.
+
+**Severity:** P3 — residual from F46 (script ready, capture not yet run).
+**Source:** F46 closeout (`design/followups.md`) + `analysis/frida/mx-nmx-trace.js` header procedure.
+
+**Scope.** Run the Frida script against a live `MxTraceHarness.exe` exercising the suspend-advised + activate-advised scenarios on `TestChildObject.ScanState`. Save under `captures/NNN-frida-suspend-activate-instrumented/`. If the new `mx.suspend.*` / `mx.activate.*` events accompany NMX traffic in the same time window: document the wire opnum + body shape in `docs/M6-buffered-evidence.md` and `analysis/proxy/nmxsvcps-procedures.tsv`. If no NMX traffic accompanies the hook fires: update `design/70-risks-and-open-questions.md` R5 to "settled — client-side only".
+
+**Definition of done:** R5 is fully settled (either with a documented wire opnum or a "client-side only" verdict backed by capture).
+
+**Resolves when:** the capture lands and R5's status is updated.
+
+### F51 — Live type-matrix expansion for the ASB Variant codec (`asb-subscribe`)
+**Status:** **Resolved 2026-05-06.** Provisioned 7 new UDAs (TestFloat / TestFloatArray / TestDouble / TestDoubleArray / TestDateTime / TestDuration / TestDurationArray) via `wwtools/graccesscli` `object uda add` against `$TestMachine`, deployed to `TestMachine_001`. New `crates/mxaccess/examples/asb-type-matrix.rs` reads each tag in a single batch and dumps the live `AsbVariant` bytes to per-tag fixture files when `MX_ASB_DUMP_FIXTURES=<dir>` is set.
+
+Live evidence (one cold-start run; subsequent runs hit the F31 InvalidConnectionId cool-down — wait 60+ seconds with no ASB activity before re-running):
+
+| Tag | type_id | length | payload bytes |
+|---|---|---|---|
+| TestChangingInt | 4 (Int32) | 4 | 4 |
+| TestAlarm001 | 17 (Boolean) | 1 | 1 |
+| MachineCode | 10 (String) | 30 | 30 |
+| TestFloat | 8 (Float) | 4 | 4 |
+| TestDouble | 9 (Double) | 8 | 8 |
+| TestDateTime | 11 (DateTime) | 8 | 8 |
+| TestDuration | 12 (ElapsedTime) | 8 | 8 |
+
+`crates/mxaccess-codec/tests/f51_type_matrix_parity.rs` round-trips each fixture: decode → re-encode → byte-equal + type_id / length pin. Per-fixture .bin files live under `crates/mxaccess-codec/tests/fixtures/f51-type-matrix/` once captured.
+
+Array tags (`TestIntArray`, `TestBoolArray`, etc.) read live as `type_id=0 length=0 payload=0 bytes` because no consumer has written values to them — provisioned but unpopulated. Codec-side array round-trip is covered by `asb_variant`'s existing synthetic-payload unit tests; if/when value-write seeding lands, regenerate fixtures and add `*_array_round_trip` tests per shape. `docs/galaxy-test-fixtures.md` documents the full provisioning + regeneration recipe.
+
+
+**Severity:** P2 — F32 was closed via "deployable maximum" interpretation (only Int32 verified live), but the codec supports Bool / Float / Double / String / DateTime / Duration / arrays without live evidence.
+**Source:** F32 closeout (`design/followups.md`); `work_remain.md:108-113` documents the proven matrix from .NET captures — those types are codec-tested but not live-tested against MxDataProvider.
+
+**Scope.** Provision sample tags on the local Galaxy for each missing type (Bool, Float, Double, String, DateTime, Duration, plus 1-2 representative array shapes). Extend `examples/asb-subscribe.rs` with a per-type loop that registers + reads + subscribes against each. Capture the wire bytes via `examples/asb-relay.rs` middleman and add round-trip parity tests in `crates/mxaccess-asb/tests/` for each type.
 
 **Definition of done:**
-1. `SubscriptionEntry` gains a discriminator (`enum SubscriptionMode { Plain, Buffered { rounded_interval_ms: u32 } }`) so recovery can branch on the original advise shape.
-2. The buffered branch in `recover_connection_core` rebuilds the original `NmxReferenceRegistrationMessage` (with `.property(buffer)` suffix + the saved correlation id + `subscribe = true`) and dispatches `register_reference` against the rebuilt transport.
-3. Live regression: `cargo run -p mxaccess --example subscribe-buffered` against AVEVA, then force a recovery via `Session::recover_connection`, and confirm subsequent `OnBufferedDataChange`-rate updates continue at the same cadence.
+1. Per-type Galaxy fixture documented in `docs/galaxy-test-fixtures.md` (which child object names to provision, expected attribute types).
+2. `cargo run -p mxaccess --example asb-subscribe -- --type-matrix` exercises all proven types and reports per-type wire bytes + decoded value.
+3. Round-trip test per type in `crates/mxaccess-asb/tests/` pinning the captured wire bytes.
 
-**Resolves when:** the recovery path treats buffered subscriptions identically to how the original advise was issued.
+**Resolves when:** every proven type from `work_remain.md:108-113` has a live wire fixture + a passing round-trip test.
 
-### F46 — Capture `LmxProxy.dll!CLMXProxyServer.Suspend`/`.Activate` wire emission
-**Severity:** P3 — residual gap from F44's R5 walk.
-**Source:** `design/70-risks-and-open-questions.md` R5 + `docs/M6-buffered-evidence.md` (capture 077 section) + `captures/077-frida-suspend-advised-scanstate/frida-events.tsv:2-17` (Frida hook list).
+### F52 — Codec performance optimisations deferred from F39
+**Severity:** P3 — R12 < 5 allocs/write target is already met; these are nice-to-haves.
+**Source:** `design/M6-bench-baseline.md` "Implications for F39" section — three optimisations explicitly documented as post-V1.
 
-**Scope.** Capture 077 confirmed the .NET-reference compatibility-server's client-side gating for `Suspend` (must have an active subscription; returns `MxStatus.SuspendPending` synchronously) but did not instrument `LmxProxy.dll!CLMXProxyServer.Suspend` / `.Activate`. Open question: does the production LMX proxy issue a separate ORPC method for these, or does it also synthesise the response client-side?
+**Scope.** Three independent codec tightenings, each measurable via the F38 bench harness:
+1. **`bytes::BytesMut` output buffer** on the encoder side. Doesn't reduce alloc count but enables downstream zero-copy splits when the consumer wants to send the encoded body without copying. ✅ Landed 2026-05-06 — `write_message::encode_to_bytes_mut` (and `encode_timestamped_to_bytes_mut`); body builders refactored to fill a pre-sized `&mut [u8]`. Bench delta in `design/M6-bench-baseline.md` § F52.1.
+2. **Per-handle name-signature cache** in `MxReferenceHandle::from_names`. Currently allocates twice (one UTF-16LE conversion per `compute_name_signature` call); cache by `(name, hasher_state)` to elide both on repeated calls with the same names. ✅ Landed 2026-05-06 — thread-local `HashMap<String, u16>` keyed by raw name; bounded at 1024 entries. `MxReferenceHandle::from_names` drops 2 → 0 allocs/op once warm. Bench delta in `design/M6-bench-baseline.md` § F52.2.
+3. **Session-level scratch pool** for the per-write encode buffer. Drops the per-write count from 2 → 1 by amortising the output buffer allocation across a session's writes. ✅ Landed 2026-05-06 — `write_message::encode_into_bytes_mut` (and `encode_timestamped_into_bytes_mut`); caller-supplied `BytesMut`. Pooled Int32 = 1 alloc/op (was 2); pooled Boolean = 0 allocs/op (was 1). Bench delta in `design/M6-bench-baseline.md` § F52.3.
 
 **Definition of done:**
-1. Extend `analysis/frida/mx-nmx-trace.js` to `Interceptor.attach` on `LmxProxy.dll!CLMXProxyServer.Suspend` and `.Activate` (and any sibling `Resume` / `Reactivate` if present in the export table). Mirror the existing `AdviseSupervisory` hook shape.
-2. Re-run the `suspend-advised` scenario against `TestChildObject.ScanState`, plus a fresh `activate-advised` scenario, save under `captures/NNN-frida-suspend-activate-instrumented/`.
-3. If a wire emission appears (PutRequest + TransferData with a new opnum or body shape): document it in `docs/M6-buffered-evidence.md` and `analysis/proxy/nmxsvcps-procedures.tsv`; add typed decode if the inner body is novel.
-4. If no wire emission appears: confirm both operations are purely client-side and update R5 to "fully settled — client-side only".
+1. ✅ Each optimisation lands as a separate commit with a before/after row in `design/M6-bench-baseline.md` showing the alloc-count delta. (commits `4e76b44` F52.1, `a0fa5be` F52.2, this commit F52.3)
+2. ✅ No correctness regressions in the round-trip fixture suite. (267 tests pass)
+3. ✅ Default API surface unchanged. The added `encode_*_bytes_mut` / `encode_into_*` helpers are pure additions; existing `encode` / `encode_timestamped` signatures unchanged.
 
-**Resolves when:** R5 is fully settled (either with a documented wire opnum or a "client-side only" verdict backed by capture).
+**Resolved 2026-05-06:** all three optimisations landed.
+
+### F53 — Enable `#![warn(missing_docs)]` workspace-wide
+**Status:** Consumer crates resolved 2026-05-06: `#![warn(missing_docs)]` enabled on `mxaccess` and `mxaccess-compat` lib roots, every public item now carries at least a one-line doc comment, `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps` clean. Protocol crates deliberately deferred per the strategy paragraph below — measured the magnitude on 2026-05-06 by enabling the lint on each:
+
+| Crate | Missing-docs warnings |
+|---|---|
+| `mxaccess-asb` | 422 |
+| `mxaccess-nmx` | 398 |
+| `mxaccess-callback` | 371 |
+| `mxaccess-galaxy` | 229 |
+| `mxaccess-codec` | 205 |
+| `mxaccess-rpc` | 147 |
+| `mxaccess-asb-nettcp` | 111 |
+| **Total** | **1883** |
+
+Most of those are protocol-internal types (struct fields, enum variants on wire-shape records) whose meaning is already documented at the consumer-facing layer. Filling 1883 one-liners adds noise without consumer value, and turning them into errors (`RUSTDOCFLAGS="-D warnings"`) would block routine `cargo doc` runs. Lint stays off on protocol crates indefinitely; if a future contributor wants per-crate enforcement, they can re-introduce on a per-module basis with `#![allow(missing_docs)]` exemptions for the protocol-internal modules.
+**Severity:** P3 — doc-coverage tightening; not a correctness or release blocker.
+**Source:** F42 closeout — the missing-docs lint was deferred because enabling it surfaces hundreds of low-priority public-item gaps that are out of scope for that F-number.
+
+**Scope.** Per crate root, add `#![warn(missing_docs)]` (or `#![deny(missing_docs)]` for the consumer-facing `mxaccess` + `mxaccess-compat`). Then walk each warning and add at minimum a one-line doc comment per public item. Strategy: do the consumer-facing crates first (`mxaccess`, `mxaccess-compat`); the protocol crates (`mxaccess-codec`, `mxaccess-rpc`, etc.) can land later since their consumers are the higher-level crates which already document the surfaces they re-export.
+
+**Definition of done:**
+1. `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps` continues to pass with the lints enabled.
+2. Every public item in `mxaccess` + `mxaccess-compat` has at least a one-line doc comment.
+3. Protocol crates either get the lint enabled too or have an inline `#[allow(missing_docs)]` with a reason that points at this followup.
+
+**Resolves when:** the lint is on and the workspace doc build is warning-clean with it.
+
+### F56 — `subscribe` / `subscribe_buffered` complete on the wire but never receive `0x33` DataUpdate frames
+**Status:** **Resolved 2026-05-06.**
+
+**Root cause:** `Session::subscribe` and `Session::subscribe_buffered_nmx` were missing the `INmxService2::Connect` + `AddSubscriberEngine` round-trip that the .NET reference's `MxNativeSession.EnsurePublisherConnected` (`cs:516-526`) issues before the first advise against a given publishing engine. Without that pair of RPCs, NmxSvc accepts the subscription registration but the publishing engine never knows our engine is subscribed — so no `0x33` DataUpdate frames flow.
+
+Diagnosed via wwtools/aalogcli: the `[Warning] NmxSvc | NmxCallback->DataReceived ... failed with error 0x{N}` log lines turned out to be NmxSvc's normal log spam where N is the bufferSize, NOT an actual error — the .NET reference's own probe triggers identical entries while still receiving `0x33` DataUpdate frames successfully. The real issue was that those frames never started being sent in the first place.
+
+Fix landed:
+- `SessionInner::publisher_endpoints` — per-session `HashMap<(platform_id, engine_id), ()>` cache mirroring `MxNativeSession._publisherEndpoints`.
+- `Session::ensure_publisher_connected(platform_id, engine_id)` — issues `INmxService2::Connect(local_engine, galaxy, platform, engine)` then `AddSubscriberEngine(engine, galaxy, source_platform, local_engine)`, once per publisher endpoint per session.
+- `Session::subscribe` and `Session::subscribe_buffered_nmx` — both call `ensure_publisher_connected` BEFORE the wire advise.
+- `subscribe_buffered_nmx` — additionally issues `AdviseSupervisory` after `RegisterReference`. The .NET reference's `RegisterBufferedItemAsync` only calls RegisterReference, but on this AVEVA install RegisterReference alone produces the registration result + heartbeat callbacks without ever starting DataUpdate dispatch; AdviseSupervisory unblocks the dispatch. Difference may be version-specific.
+
+Live verification passes for both paths against `TestMachine_001.TestChangingInt`:
+- `cargo test -p mxaccess-compat --features live-windows-com --test plain_subscribe_live` — receives `0x32` SubscriptionStatus + sequence of `0x33` DataUpdate frames.
+- `cargo test -p mxaccess-compat --features live-windows-com --test buffered_subscribe_live` — same.
+
+Both tests assert on the raw `Session::callbacks()` broadcast (NMX subscription messages) rather than the typed `Subscription::next` (DataChange) path because `TestChangingInt` on this Galaxy is configured with `quality=0x00C0 (Uncertain) value=null`, so the typed path filters every record. The test gate is "wire-level subscription works"; what the engine reports as the actual value is downstream-Galaxy state, out of scope for the Rust port.
+
+**Codec fixes** that ALSO landed in this session as part of the F56 investigation (independent from the resolution above; would have been needed even after the Connect/AddSubscriberEngine fix to make the inbound path readable):
+- `NmxSubscriptionMessage::try_parse_process_data_received_body` — peels the `ProcessDataReceived` envelope before calling `parse_inner`. The router previously called `parse_inner` directly on wire bytes, which would have silently dropped any `0x33` even if one arrived.
+- `NmxReferenceRegistrationResultMessage::try_parse_process_data_received_body` + router branch — drops `0x11` registration-result frames cleanly instead of logging "unexpected opcode 0x11".
+- `Session::subscribe_buffered_nmx` — split-form (object, attribute) wire body + per-session monotonic `item_handle` counter (mirrors `MxNativeCompatibilityServer.AddBufferedItemAsync`'s `_nextItemHandle++`).
+
+**Severity:** P1 — blocked F49 step 1 (F36 buffered live verification), F49 step 2 (F45 recovery replay), and all consumers relying on subscription data flow on this Galaxy. Now unblocked.
+
+**Source:** F49 step 1 live attempt 2026-05-06. The pre-resolution debugging analysis (initial buffered-only hypothesis ruled out via byte-identical parity test → "plain subscribe also fails too" → revised hypothesis around DCOM sink IID / vtable mismatch and disabled object scanning → final landing on the missing `EnsurePublisherConnected` round-trip) is preserved in this file's git history. Run `git log -p design/followups.md` around 2026-05-06 / 2026-05-07 if the dead-end branches are needed for future archeology.
+
+### F55 — Hand-rolled callback exporter rejected by `RegisterEngine2` on this AVEVA install
+**Status:** Resolved 2026-05-06 by Path A (DCOM-managed `INmxSvcCallback` sink in `mxaccess-callback::dcom_sink`, wired into `Session::from_nmx_client` behind the `windows-com` feature). Live test `cargo test -p mxaccess-compat --features live-windows-com --test lmx_write_complete_live -- --ignored --nocapture` passes end-to-end: RegisterEngine2 succeeds, write round-trips, OnWriteComplete fires with status from the wire. The hand-rolled `CallbackExporter` is retained for unit tests that exercise the exporter against an in-process fake NMX peer.
+**Severity:** P1 — blocks F49 live verification of every M6 feature that needs an `Engine` registered (i.e. all of them).
+**Source:** Live attempt 2026-05-06 against the local AVEVA install. Both the Rust port and the .NET reference's `--probe-register-managed-callback` (which uses the same hand-rolled-exporter approach as the Rust port) fail `RegisterEngine2` with HRESULT `0x800706BA` (`RPC_S_SERVER_UNAVAILABLE` wrapped as Win32 HRESULT). The .NET reference's `--probe-session-write` SUCCEEDS because it goes through `MxNativeSession.Open` → `CreateRegisteredService` (`MxNativeSession.cs:624`) which does **`ComObjRefProvider.MarshalInterfaceObjRef(callback, INmxSvcCallback, DifferentMachine)`** on a real C# COM object — letting Windows DCOM proxy/stub infrastructure handle the callback dispatch — instead of building a hand-rolled OBJREF + TCP listener.
+
+**The Rust port mirrors the .NET reference's `ManagedCallbackExporter` design exactly.** Both fail. So this isn't a Rust port regression — it's a pre-existing issue in the hand-rolled callback architecture that wasn't previously live-tested end-to-end against this NmxSvc install.
+
+**Diagnostic chain (logged from `mxaccess::Session::from_nmx_client`):**
+1. `Session::connect_nmx_auto` → `NmxClient::create` → all 6 steps OK (activate, marshal, ResolveOxid, RemQI, final bind). Endpoint resolved to `[fe80::...]:64311`. The new `IUnknownHolder` (mirrors `_activatedComObject` from `ManagedNmxService2Client.cs:15`) keeps the COM ref alive across the steps.
+2. `from_nmx_client` builds the callback OBJREF (162 bytes, byte-structurally identical to .NET's at `ProbeRegisterEngine2ManagedCallback.managed_callback_objref_hex` modulo random fields).
+3. `RegisterEngine2(engine_id, engine_name, version=6, callback_obj_ref)` returns `Transport(Fault { status: 0x800706BA })`.
+
+**The OBJREF binding is correct:** `DESKTOP-6JL3KKO[<port>]` with `port` from `tokio::net::TcpListener::bind(0.0.0.0:0)`. Windows Firewall is OFF on all profiles. The hand-rolled exporter accepts connections; NmxSvc just refuses to use it.
+
+**Path C investigation (2026-05-06).** Captured the OBJREF byte structure from both paths via the .NET probe:
+
+| Field | DCOM-marshalled (works) | Hand-rolled (fails) |
+|---|---|---|
+| Total size | 338 bytes | 162 bytes |
+| `std_flags` | `0x0A80` (SORF_OXRES4+OXRES6+OXRES8) | `0x280` (SORF_OXRES4+OXRES6) |
+| `std_public_refs` | 5 | 5 |
+| `std_oxid` / `std_oid` / `std_ipid` | random per session | random per session |
+| ncacn_ip_tcp bindings | 4 (DESKTOP-6JL3KKO, 10.100.0.48, 2x IPv6 link-local) — **no ports** | 1 (DESKTOP-6JL3KKO[<port>]) — **with port** |
+| Security bindings | 7 | 7 |
+
+Tried setting `std_flags = 0x0A80` on the hand-rolled OBJREF (matching the DCOM-marshalled flag bits): **RegisterEngine2 still fails with the same 1722.** Reverted.
+
+**Updated diagnosis.** The likely cause is that NmxSvc, on receiving RegisterEngine2 with a callback OBJREF, does its own SCM-side OXID resolution: it calls `IObjectExporter::ResolveOxid` against the local SCM at `127.0.0.1:135` to get the bindings for the OBJREF's OXID, then dials those bindings. Our hand-rolled OXID is **never registered with the local SCM**, so the resolution fails and NmxSvc returns `RPC_S_SERVER_UNAVAILABLE` (1722) — matching the symptom and the sub-second timing (no TCP-dial-back attempt to our listener happens at all).
+
+DCOM marshalling fixes this because `CoMarshalInterface` internally registers the OXID with RPCSS, so NmxSvc's SCM-side ResolveOxid succeeds. The bindings carry no port because RPCSS-side resolution returns the dynamic port from the Windows DCOM stub layer.
+
+This makes Path A the architecturally correct fix: the callback exporter must be a DCOM-managed object (registered with RPCSS) for NmxSvc to accept the callback. The hand-rolled-listener-with-explicit-port-in-OBJREF approach used by both the Rust port and the .NET reference's `ManagedCallbackExporter` doesn't satisfy NmxSvc's callback validation.
+
+**Three resolution paths (each substantial):**
+
+- **Path A — switch to DCOM-marshalled callback.** Refactor `mxaccess-callback` so the callback is a real COM class (`#[implement]` via `windows-rs`) registered with the local DCOM SCM, then marshal it via `CoMarshalInterface` for the OBJREF. Abandons the project's "bypass DCOM proxy/stubs" goal but matches what .NET's working path does. ~1 week of work.
+- **Path B — hybrid: register via DCOM, dispatch via hand-rolled.** Use `CoMarshalInterface` only to build the OBJREF (which NmxSvc accepts), but intercept the inbound callback connection at the TCP layer to bypass DCOM stub dispatch. Requires reading the `CoMarshalInterface`-produced OBJREF, extracting the OXID/IPID, and standing up a TCP listener that responds to OXID resolution against itself. Architecturally awkward.
+- **Path C — investigate the OBJREF rejection at NmxSvc.** Capture the wire bytes NmxSvc sees from the .NET DCOM-marshalled path vs the hand-rolled path; diff to find what NmxSvc actually validates. May reveal a single field difference (e.g. a flag bit) that, set correctly in the hand-rolled OBJREF, makes it work. Cheapest if it pans out, but unbounded if it doesn't.
+
+**Definition of done:** F49 step 5 (LmxClient OnWriteComplete round-trip) runs end-to-end against the live AVEVA install: `cargo test -p mxaccess-compat --features live-windows-com --test lmx_write_complete_live -- --ignored --nocapture` passes.
+
+**Resolves when:** one of the three paths above lands.
 
 ### F3 — Cross-domain NTLM Type1/2/3 fixture
 **Severity:** P2
 **Status:** Permanently out-of-scope on the current dev host (no second AD domain). Resolution requires external infrastructure not available here.
 **Source:** M2 wave 1, `crates/mxaccess-rpc/src/ntlm.rs`. All current NTLM fixtures are single-domain (the local AVEVA install). Tracked separately in `design/70-risks-and-open-questions.md` R8 (P1 risk) and the open-evidence-gaps table.
-**Concrete next step:** Provision a two-domain Windows lab (e.g. `LAB-A` + `LAB-B` with cross-domain trust + an AVEVA install on `LAB-A` that authenticates a user from `LAB-B`). Run `cargo run -p mxaccess --example connect-write-read` from a `LAB-B`-domain user; capture the NTLM Type1 / Type2 / Challenge / Type3 bytes via `examples/asb-relay.rs` or a Wireshark NTLM filter. Save under `crates/mxaccess-rpc/tests/fixtures/cross-domain-ntlm/`. The existing single-domain Type1/2/3 round-trip tests in `mxaccess-rpc::ntlm` then extend to validate the cross-domain shape (TargetInfo AV pairs differ when crossing domains; specifically `MsvAvDnsTreeName` and `MsvAvDnsComputerName` carry the trusted-domain DNS suffix instead of the local one). Clears R8 in the risks doc.
+**Concrete next step:** See the full provisioning recipe at [`docs/F3-cross-domain-ntlm-recipe.md`](../docs/F3-cross-domain-ntlm-recipe.md). It documents the lab topology (two forests + bidirectional forest trust + a `LAB-B\probe.user` authenticating against an AVEVA install on `LAB-A`), the DC + DNS + trust + user provisioning steps, the Wireshark + `connect-write-read` capture procedure, the exact fixture layout under `crates/mxaccess-rpc/tests/fixtures/cross-domain-ntlm/`, the round-trip test skeleton (replay the captured Type 2 bytes → regenerate Type 3 → assert byte-equality), and the redaction checklist. Clears R8 in the risks doc when the fixture lands.
 
 
 
 
 ## Resolved
 
+### F54 — Per-operation context correlation + compat `OnWriteComplete` fan-out
+**Resolved:** 2026-05-06 (commit `<this commit>`). Two-crate plumbing.
+
+**Part 1 — `mxaccess` (per-operation correlation).** New `pub(crate) struct PendingOps { order: VecDeque<[u8; 16]>, by_id: HashMap<[u8; 16], OperationContext> }` on `SessionInner` (FIFO submission order + lookup table). The 5-byte StatusWord frame and the 1-byte CompletionOnly frame carry no correlation id on the wire (`NmxOperationStatusMessage` is keyless), so the Rust port assigns a synthetic 16-byte id at submission time and the router pops the oldest pending entry on each arriving status frame. Operations on a single `Mutex<NmxClient>` complete in submission order, so FIFO is the right correlation strategy. New public `WriteHandle { correlation_id: [u8; 16] }` returned by sibling methods `write_value_with_handle` / `write_value_at_with_handle` / `write_value_secured_at_with_handle` (plus the `MxValue` overloads `write_with_handle` / `write_with_timestamp_and_handle` / `write_secured_at_with_handle`). The non-handle methods `write_value` / `write_value_at` / etc. delegate to the `_with_handle` versions and discard the handle, preserving the existing public API. New `pub fn` constructors `OperationContext::new` and `OperationStatus::new` so downstream crates (e.g. `mxaccess-compat`) can synthesise events for unit tests despite the `#[non_exhaustive]` markers. `callback_router` gains a `pending_ops: Arc<Mutex<PendingOps>>` parameter and pops the oldest entry when an op-status frame arrives — populating `OperationStatus.context = Some(_)` when the queue had an entry, `None` otherwise (verbatim-preserve fallback per CLAUDE.md). Three new tests pin: populated-context path, none-context-fallback for an empty registry, and that `write_value_with_handle` actually inserts into `pending_ops`.
+
+**Part 2 — `mxaccess-compat` (compat-layer fan-out task).** New `correlation_to_item: Arc<Mutex<HashMap<[u8; 16], i32>>>` on `LmxInner`. `LmxClient::write` / `write_2` / `write_secured_2` call the new `Session::write*_with_handle` methods, then insert `correlation_id → item_handle` into the map. `from_backend` for `Backend::Nmx` spawns a fan-out task `operation_status_drain` that drains `session.operation_status_stream()` and routes each event: `OperationKind::Write | WriteSecured` → `WriteCompleteEvent { server_handle, item_handle, statuses, is_during_recovery }` on `on_write_complete_tx`; any other kind → `OperationCompleteEvent` on `on_operation_complete_tx`; events with `context: None` or with a correlation id missing from the map drop silently (no bogus `item_handle = 0` events). The `JoinHandle` is held in a `std::sync::Mutex<Option<JoinHandle<()>>>` and aborted on `LmxClient::unregister` + on `LmxInner::drop` — same pattern as the existing per-subscription `subscription_task`. ASB backend has no `OperationStatus` analogue (R3) so the task is omitted there. Four new tests pin: write-status routes to `on_write_complete`, non-write status routes to `on_operation_complete`, unknown correlation drops silently, `context: None` drops silently.
+
+**Wire/byte parity.** Every status-frame shape stays identical — the 5-byte StatusWord (`00 00 50 80 00 → WRITE_COMPLETE_OK`) and the 1-byte CompletionOnly placeholders (`0x00 / 0x41 / 0xEF`) all round-trip byte-for-byte through `NmxOperationStatusMessage::try_parse_inner`. The synthesizer kernel `MxStatus::from_packed_u32` is unchanged. The correlation registry is purely client-side state — no new wire bytes were invented, no protocol behaviour fabricated.
+
+**Public API surface.** Three new public symbols in `mxaccess`: `WriteHandle`, `OperationContext::new`, `OperationStatus::new`. Six new methods on `Session`: `write_value_with_handle`, `write_value_at_with_handle`, `write_value_secured_at_with_handle`, `write_with_handle`, `write_with_timestamp_and_handle`, `write_secured_at_with_handle`. Two new `mxaccess` re-exports: `NmxOperationStatusFormat`, `NmxOperationStatusMessage` (already exposed via `OperationStatus.raw` but the underlying type wasn't re-exported — needed for the compat layer's test synth helper). `mxaccess-compat` public surface unchanged. `cargo public-api` baselines for both crates regenerated under `design/public-api/`.
+
+**Verification.** `cargo build --workspace` / `cargo test --workspace` (823 → 830 tests, +7 new) / `cargo clippy --workspace --all-targets -- -D warnings` / `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps` all pass. `cargo fmt -p mxaccess -p mxaccess-compat -- --check` clean. Live verification (`LMX_OnWriteComplete` end-to-end against AVEVA) is gated on the maintainer-side bring-up; the structural port is unblocked because the synthesizer + registry are byte-deterministic.
+
+### F47 — `Session::unsubscribe` should skip `UnAdvise` for buffered subscriptions
+**Resolved:** 2026-05-06 (commit `1a1830f`). `Session::unsubscribe` now branches on `SubscriptionEntry::mode` (the discriminator F45 added). For `SubscriptionMode::Buffered { ... }`, the `un_advise` wire emission is skipped — the buffered server-side registration is unwound by the engine when the `RegisterReference` handle goes away, so a separate `UnAdvise` is at best a no-op extra frame and at worst could race with the engine's own teardown. Mirrors the .NET reference's `if (!subscription.IsBuffered)` guard at `MxNativeSession.cs:361-381`. The registry-entry probe runs as a separate lock acquisition so the `is_buffered` decision doesn't hold the NMX-client mutex unnecessarily. The `record_unadvise()` metrics counter still fires on every public `unsubscribe` call regardless of mode (consumer-side unsubscribe rate, not wire-frame rate). New unit test `unsubscribe_skips_un_advise_for_buffered_subscription` issues a plain subscribe (recorded as 1 RPC), mutates the registry entry to `SubscriptionMode::Buffered`, calls unsubscribe, and asserts the recorded RPC count stays at 1 (no UnAdvise emitted). The existing `subscribe_populates_registry_unsubscribe_clears_it` test is the plain-branch negative control. Workspace 794 → 795 tests; clippy + rustdoc clean.
+
+### F45 — Recovery replay should re-issue `RegisterReference` for buffered subscriptions
+**Resolved:** 2026-05-06 (commit `9b57cf8`). New `pub(crate) enum SubscriptionMode { Plain, Buffered { rounded_interval_ms, item_definition, item_context, item_handle } }` discriminator on `SubscriptionEntry`. `Session::subscribe` (plain path) records `SubscriptionMode::Plain`; `subscribe_buffered_nmx` records `SubscriptionMode::Buffered { ... }` carrying the un-suffixed reference + the rounded interval (so the re-issued buffered registration matches the original cadence). `recover_connection_core` matches on `entry.mode`: plain branch unchanged; buffered branch re-applies `.property(buffer)` via `to_buffered_item_definition` (idempotent), rebuilds the original `NmxReferenceRegistrationMessage` with the saved correlation id + `subscribe = true`, and dispatches `register_reference` (kind=ItemControl, inner command `0x10`) against the replacement transport. Mirrors `MxNativeSession.ReAdviseSubscription` (`MxNativeSession.cs:538-569`). New unit test `recover_connection_replays_buffered_subscription_via_register_reference` synthesises a buffered registry entry, installs a `RebuildFactory` pointing at a recording NMX server, drives `recover_connection`, then asserts the recorded `TransferData` carries inner command `0x10` (NOT `0x1f`) with the `.property(buffer)`-suffixed item_definition + the saved correlation id + subscribe=true. Public API unchanged (`SubscriptionMode` + `SubscriptionEntry` stay `pub(crate)`); `cargo public-api -p mxaccess` baseline unchanged. Workspace 793 → 794 tests; clippy + rustdoc clean. Side-finding spawned **F47** (`Session::unsubscribe` divergence on buffered drop).
+
+### F46 — Capture `LmxProxy.dll!CLMXProxyServer.Suspend`/`.Activate` wire emission
+**Resolved:** 2026-05-06 (commit `808fea1`). `analysis/frida/mx-nmx-trace.js` extended with `Interceptor.attach` hooks on `LmxProxy.dll!CLMXProxyServer.Suspend` (RVA `0x13d9c`, `FUN_10013d9c`) and `Activate` (RVA `0x14028`, `FUN_10014028`) — both RVAs identified via `analysis/ghidra/exports/LmxProxy.dll.string-refs.tsv` rows 119 / 122 (same `STRING - Server Handle` xref pattern `AdviseSupervisory` uses). Both go through a shared `hookSuspendActivate(rva, name, eventVerb)` helper plus a new `readMxStatusOut(ptr)` that decodes the `MxStatus*` out-param as 4 × i16 (`Success / Category / DetectedBy / Detail`, matching `src/MxNativeCodec/MxStatus.cs`). Hooks emit `mx.suspend.begin/end` and `mx.activate.begin/end` events for grep-ability. **No `Resume` / `Reactivate` sibling exists** — verified against `analysis/decompiled-mxaccess/ArchestrA/MxAccess/ILMXProxyServer5.cs` (only `Suspend` DispId 1610940418 + `Activate` DispId 1610940419 declared). Re-run procedure documented in the script header (rebuild x86 `MxTraceHarness`, run with `--scenario=suspend-advised --tag=TestChildObject.ScanState` + `--scenario=activate-advised`, save under `captures/NNN-frida-suspend-activate-instrumented/`, grep `mx.suspend.*` / `mx.activate.*` and correlate with `nmx.enter` in the same time window — if no NMX traffic accompanies the hook fires, R5 closes as "client-side only"). R5 in `design/70-risks-and-open-questions.md` updated to point at F46 as the next-step. Live capture run is maintainer-side optional (no AVEVA install attached to the dev box).
+
 ### F41 — `cargo public-api` baseline
 **Resolved:** 2026-05-06 (commit `9e57bfd`). Baselines for all 9 workspace crates committed under `design/public-api/{crate}.txt`, generated via `cargo +nightly public-api --simplified -p <crate>`. Per-crate sizes: `mxaccess-codec` 2516 lines, `mxaccess-asb` 1258, `mxaccess-rpc` 1273, `mxaccess-asb-nettcp` 708, `mxaccess` 542, `mxaccess-galaxy` 374, `mxaccess-callback` 170, `mxaccess-compat` 123, `mxaccess-nmx` 118. `design/public-api/README.md` documents the update procedure (install nightly + cargo-public-api, regenerate the affected baseline on intentional API changes, commit alongside). `.github/workflows/rust.yml` gains a `public-api` job that runs the same diff against the committed baseline; drift fails CI with a unified diff in the log so the PR author can either revert or update the baseline.
 

design/public-api/mxaccess-codec.txt

@@ -514,7 +514,9 @@ pub mxaccess_codec::operation_status::NmxOperationStatusMessage::status: mxacces
 pub mxaccess_codec::operation_status::NmxOperationStatusMessage::status_code: u16
 impl mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::is_mx_access_write_complete(&self) -> bool
+pub const fn mxaccess_codec::operation_status::NmxOperationStatusMessage::promote_to_typed(&self) -> mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_inner(inner: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
+pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_process_data_received_body(body: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
 impl core::clone::Clone for mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::clone(&self) -> mxaccess_codec::operation_status::NmxOperationStatusMessage
 impl core::cmp::Eq for mxaccess_codec::operation_status::NmxOperationStatusMessage
@@ -618,8 +620,8 @@ pub mxaccess_codec::prelude::MxStatusCategory::SoftwareError = 7
 pub mxaccess_codec::prelude::MxStatusCategory::Unknown = -1
 pub mxaccess_codec::prelude::MxStatusCategory::Warning = 2
 impl mxaccess_codec::status::MxStatusCategory
-pub fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusCategory
 pub fn mxaccess_codec::status::MxStatusCategory::clone(&self) -> mxaccess_codec::status::MxStatusCategory
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusCategory
@@ -649,8 +651,8 @@ pub mxaccess_codec::prelude::MxStatusSource::RespondingLmx = 1
 pub mxaccess_codec::prelude::MxStatusSource::RespondingNmx = 3
 pub mxaccess_codec::prelude::MxStatusSource::Unknown = -1
 impl mxaccess_codec::status::MxStatusSource
-pub fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusSource
 pub fn mxaccess_codec::status::MxStatusSource::clone(&self) -> mxaccess_codec::status::MxStatusSource
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusSource
@@ -838,7 +840,10 @@ pub const mxaccess_codec::status::MxStatus::INVALID_REFERENCE_CONFIGURATION: Sel
 pub const mxaccess_codec::status::MxStatus::SUSPEND_PENDING: Self
 pub const mxaccess_codec::status::MxStatus::WRITE_COMPLETE_OK: Self
 pub fn mxaccess_codec::status::MxStatus::detail_text(&self) -> core::option::Option<&'static str>
+pub const fn mxaccess_codec::status::MxStatus::from_nmx_response_code(response_code: u8) -> core::option::Option<Self>
+pub const fn mxaccess_codec::status::MxStatus::from_packed_u32(packed: u32) -> Self
 pub fn mxaccess_codec::status::MxStatus::is_ok(&self) -> bool
+pub const fn mxaccess_codec::status::MxStatus::to_packed_u32(self) -> u32
 impl core::clone::Clone for mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::status::MxStatus::clone(&self) -> mxaccess_codec::status::MxStatus
 impl core::cmp::Eq for mxaccess_codec::status::MxStatus
@@ -903,7 +908,9 @@ pub mxaccess_codec::prelude::NmxOperationStatusMessage::status: mxaccess_codec::
 pub mxaccess_codec::prelude::NmxOperationStatusMessage::status_code: u16
 impl mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::is_mx_access_write_complete(&self) -> bool
+pub const fn mxaccess_codec::operation_status::NmxOperationStatusMessage::promote_to_typed(&self) -> mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_inner(inner: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
+pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_process_data_received_body(body: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
 impl core::clone::Clone for mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::clone(&self) -> mxaccess_codec::operation_status::NmxOperationStatusMessage
 impl core::cmp::Eq for mxaccess_codec::operation_status::NmxOperationStatusMessage
@@ -1220,8 +1227,8 @@ pub mxaccess_codec::status::MxStatusCategory::SoftwareError = 7
 pub mxaccess_codec::status::MxStatusCategory::Unknown = -1
 pub mxaccess_codec::status::MxStatusCategory::Warning = 2
 impl mxaccess_codec::status::MxStatusCategory
-pub fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusCategory
 pub fn mxaccess_codec::status::MxStatusCategory::clone(&self) -> mxaccess_codec::status::MxStatusCategory
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusCategory
@@ -1251,8 +1258,8 @@ pub mxaccess_codec::status::MxStatusSource::RespondingLmx = 1
 pub mxaccess_codec::status::MxStatusSource::RespondingNmx = 3
 pub mxaccess_codec::status::MxStatusSource::Unknown = -1
 impl mxaccess_codec::status::MxStatusSource
-pub fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusSource
 pub fn mxaccess_codec::status::MxStatusSource::clone(&self) -> mxaccess_codec::status::MxStatusSource
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusSource
@@ -1285,7 +1292,10 @@ pub const mxaccess_codec::status::MxStatus::INVALID_REFERENCE_CONFIGURATION: Sel
 pub const mxaccess_codec::status::MxStatus::SUSPEND_PENDING: Self
 pub const mxaccess_codec::status::MxStatus::WRITE_COMPLETE_OK: Self
 pub fn mxaccess_codec::status::MxStatus::detail_text(&self) -> core::option::Option<&'static str>
+pub const fn mxaccess_codec::status::MxStatus::from_nmx_response_code(response_code: u8) -> core::option::Option<Self>
+pub const fn mxaccess_codec::status::MxStatus::from_packed_u32(packed: u32) -> Self
 pub fn mxaccess_codec::status::MxStatus::is_ok(&self) -> bool
+pub const fn mxaccess_codec::status::MxStatus::to_packed_u32(self) -> u32
 impl core::clone::Clone for mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::status::MxStatus::clone(&self) -> mxaccess_codec::status::MxStatus
 impl core::cmp::Eq for mxaccess_codec::status::MxStatus
@@ -1774,8 +1784,8 @@ pub mxaccess_codec::MxStatusCategory::SoftwareError = 7
 pub mxaccess_codec::MxStatusCategory::Unknown = -1
 pub mxaccess_codec::MxStatusCategory::Warning = 2
 impl mxaccess_codec::status::MxStatusCategory
-pub fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusCategory::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusCategory::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusCategory
 pub fn mxaccess_codec::status::MxStatusCategory::clone(&self) -> mxaccess_codec::status::MxStatusCategory
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusCategory
@@ -1805,8 +1815,8 @@ pub mxaccess_codec::MxStatusSource::RespondingLmx = 1
 pub mxaccess_codec::MxStatusSource::RespondingNmx = 3
 pub mxaccess_codec::MxStatusSource::Unknown = -1
 impl mxaccess_codec::status::MxStatusSource
-pub fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
-pub fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
+pub const fn mxaccess_codec::status::MxStatusSource::from_i16(value: i16) -> Self
+pub const fn mxaccess_codec::status::MxStatusSource::to_i16(self) -> i16
 impl core::clone::Clone for mxaccess_codec::status::MxStatusSource
 pub fn mxaccess_codec::status::MxStatusSource::clone(&self) -> mxaccess_codec::status::MxStatusSource
 impl core::cmp::Eq for mxaccess_codec::status::MxStatusSource
@@ -2100,7 +2110,10 @@ pub const mxaccess_codec::status::MxStatus::INVALID_REFERENCE_CONFIGURATION: Sel
 pub const mxaccess_codec::status::MxStatus::SUSPEND_PENDING: Self
 pub const mxaccess_codec::status::MxStatus::WRITE_COMPLETE_OK: Self
 pub fn mxaccess_codec::status::MxStatus::detail_text(&self) -> core::option::Option<&'static str>
+pub const fn mxaccess_codec::status::MxStatus::from_nmx_response_code(response_code: u8) -> core::option::Option<Self>
+pub const fn mxaccess_codec::status::MxStatus::from_packed_u32(packed: u32) -> Self
 pub fn mxaccess_codec::status::MxStatus::is_ok(&self) -> bool
+pub const fn mxaccess_codec::status::MxStatus::to_packed_u32(self) -> u32
 impl core::clone::Clone for mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::status::MxStatus::clone(&self) -> mxaccess_codec::status::MxStatus
 impl core::cmp::Eq for mxaccess_codec::status::MxStatus
@@ -2244,7 +2257,9 @@ pub mxaccess_codec::NmxOperationStatusMessage::status: mxaccess_codec::status::M
 pub mxaccess_codec::NmxOperationStatusMessage::status_code: u16
 impl mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::is_mx_access_write_complete(&self) -> bool
+pub const fn mxaccess_codec::operation_status::NmxOperationStatusMessage::promote_to_typed(&self) -> mxaccess_codec::status::MxStatus
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_inner(inner: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
+pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::try_parse_process_data_received_body(body: &[u8]) -> core::result::Result<Self, mxaccess_codec::error::CodecError>
 impl core::clone::Clone for mxaccess_codec::operation_status::NmxOperationStatusMessage
 pub fn mxaccess_codec::operation_status::NmxOperationStatusMessage::clone(&self) -> mxaccess_codec::operation_status::NmxOperationStatusMessage
 impl core::cmp::Eq for mxaccess_codec::operation_status::NmxOperationStatusMessage

design/public-api/mxaccess.txt

@@ -7,6 +7,8 @@ pub use mxaccess::MxStatusCategory
 pub use mxaccess::MxStatusSource
 pub use mxaccess::MxValue
 pub use mxaccess::MxValueKind
+pub use mxaccess::NmxOperationStatusFormat
+pub use mxaccess::NmxOperationStatusMessage
 pub use mxaccess::Resolver
 pub use mxaccess::ResolverError
 pub use mxaccess::WriteValue
@@ -57,6 +59,69 @@ impl core::marker::UnsafeUnpin for mxaccess::asb_session::AsbSubscription
 impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::asb_session::AsbSubscription
 impl core::panic::unwind_safe::UnwindSafe for mxaccess::asb_session::AsbSubscription
 pub mod mxaccess::session
+#[non_exhaustive] pub enum mxaccess::session::OperationKind
+pub mxaccess::session::OperationKind::Activate
+pub mxaccess::session::OperationKind::Other
+pub mxaccess::session::OperationKind::Read
+pub mxaccess::session::OperationKind::Subscribe
+pub mxaccess::session::OperationKind::Suspend
+pub mxaccess::session::OperationKind::Unsubscribe
+pub mxaccess::session::OperationKind::Write
+pub mxaccess::session::OperationKind::WriteSecured
+impl core::clone::Clone for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::clone(&self) -> mxaccess::session::OperationKind
+impl core::cmp::Eq for mxaccess::session::OperationKind
+impl core::cmp::PartialEq for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::eq(&self, other: &mxaccess::session::OperationKind) -> bool
+impl core::fmt::Debug for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::OperationKind
+impl core::marker::StructuralPartialEq for mxaccess::session::OperationKind
+impl core::marker::Freeze for mxaccess::session::OperationKind
+impl core::marker::Send for mxaccess::session::OperationKind
+impl core::marker::Sync for mxaccess::session::OperationKind
+impl core::marker::Unpin for mxaccess::session::OperationKind
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationKind
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationKind
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationKind
+#[non_exhaustive] pub struct mxaccess::session::OperationContext
+pub mxaccess::session::OperationContext::correlation_id: [u8; 16]
+pub mxaccess::session::OperationContext::op_kind: mxaccess::session::OperationKind
+pub mxaccess::session::OperationContext::reference: core::option::Option<alloc::sync::Arc<str>>
+pub mxaccess::session::OperationContext::retry_count: u32
+impl mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::new(correlation_id: [u8; 16], op_kind: mxaccess::session::OperationKind, reference: core::option::Option<alloc::sync::Arc<str>>, retry_count: u32) -> Self
+impl core::clone::Clone for mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::clone(&self) -> mxaccess::session::OperationContext
+impl core::fmt::Debug for mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::marker::Freeze for mxaccess::session::OperationContext
+impl core::marker::Send for mxaccess::session::OperationContext
+impl core::marker::Sync for mxaccess::session::OperationContext
+impl core::marker::Unpin for mxaccess::session::OperationContext
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationContext
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationContext
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationContext
+#[non_exhaustive] pub struct mxaccess::session::OperationStatus
+pub mxaccess::session::OperationStatus::context: core::option::Option<mxaccess::session::OperationContext>
+pub mxaccess::session::OperationStatus::is_during_recovery: bool
+pub mxaccess::session::OperationStatus::raw: mxaccess_codec::operation_status::NmxOperationStatusMessage
+pub mxaccess::session::OperationStatus::status: mxaccess_codec::status::MxStatus
+impl mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::new(raw: mxaccess_codec::operation_status::NmxOperationStatusMessage, status: mxaccess_codec::status::MxStatus, context: core::option::Option<mxaccess::session::OperationContext>, is_during_recovery: bool) -> Self
+impl core::clone::Clone for mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::clone(&self) -> mxaccess::session::OperationStatus
+impl core::fmt::Debug for mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::marker::Freeze for mxaccess::session::OperationStatus
+impl core::marker::Send for mxaccess::session::OperationStatus
+impl core::marker::Sync for mxaccess::session::OperationStatus
+impl core::marker::Unpin for mxaccess::session::OperationStatus
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationStatus
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationStatus
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationStatus
 pub struct mxaccess::session::SessionInner
 impl core::fmt::Debug for mxaccess::session::SessionInner
 pub fn mxaccess::session::SessionInner::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
@@ -84,6 +149,26 @@ impl core::marker::Unpin for mxaccess::session::Subscription
 impl core::marker::UnsafeUnpin for mxaccess::session::Subscription
 impl !core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::Subscription
 impl !core::panic::unwind_safe::UnwindSafe for mxaccess::session::Subscription
+#[non_exhaustive] pub struct mxaccess::session::WriteHandle
+pub mxaccess::session::WriteHandle::correlation_id: [u8; 16]
+impl core::clone::Clone for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::clone(&self) -> mxaccess::session::WriteHandle
+impl core::cmp::Eq for mxaccess::session::WriteHandle
+impl core::cmp::PartialEq for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::eq(&self, other: &mxaccess::session::WriteHandle) -> bool
+impl core::fmt::Debug for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::WriteHandle
+impl core::marker::StructuralPartialEq for mxaccess::session::WriteHandle
+impl core::marker::Freeze for mxaccess::session::WriteHandle
+impl core::marker::Send for mxaccess::session::WriteHandle
+impl core::marker::Sync for mxaccess::session::WriteHandle
+impl core::marker::Unpin for mxaccess::session::WriteHandle
+impl core::marker::UnsafeUnpin for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::WriteHandle
 pub fn mxaccess::session::filetime_to_system_time(filetime_ticks: i64) -> std::time::SystemTime
 pub fn mxaccess::session::system_time_to_filetime(time: std::time::SystemTime) -> core::result::Result<i64, mxaccess::Error>
 pub type mxaccess::session::RebuildFactory = alloc::sync::Arc<(dyn core::ops::function::Fn() -> core::pin::Pin<alloc::boxed::Box<(dyn core::future::future::Future<Output = core::result::Result<mxaccess_nmx::client::NmxClient, mxaccess_nmx::client::NmxClientError>> + core::marker::Send)>> + core::marker::Send + core::marker::Sync)>
@@ -208,6 +293,33 @@ impl core::marker::Unpin for mxaccess::Error
 impl core::marker::UnsafeUnpin for mxaccess::Error
 impl !core::panic::unwind_safe::RefUnwindSafe for mxaccess::Error
 impl !core::panic::unwind_safe::UnwindSafe for mxaccess::Error
+#[non_exhaustive] pub enum mxaccess::OperationKind
+pub mxaccess::OperationKind::Activate
+pub mxaccess::OperationKind::Other
+pub mxaccess::OperationKind::Read
+pub mxaccess::OperationKind::Subscribe
+pub mxaccess::OperationKind::Suspend
+pub mxaccess::OperationKind::Unsubscribe
+pub mxaccess::OperationKind::Write
+pub mxaccess::OperationKind::WriteSecured
+impl core::clone::Clone for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::clone(&self) -> mxaccess::session::OperationKind
+impl core::cmp::Eq for mxaccess::session::OperationKind
+impl core::cmp::PartialEq for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::eq(&self, other: &mxaccess::session::OperationKind) -> bool
+impl core::fmt::Debug for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::OperationKind
+pub fn mxaccess::session::OperationKind::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::OperationKind
+impl core::marker::StructuralPartialEq for mxaccess::session::OperationKind
+impl core::marker::Freeze for mxaccess::session::OperationKind
+impl core::marker::Send for mxaccess::session::OperationKind
+impl core::marker::Sync for mxaccess::session::OperationKind
+impl core::marker::Unpin for mxaccess::session::OperationKind
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationKind
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationKind
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationKind
 #[non_exhaustive] pub enum mxaccess::ProtocolError
 pub mxaccess::ProtocolError::Decode
 pub mxaccess::ProtocolError::Decode::buffer_len: usize
@@ -391,6 +503,42 @@ impl core::marker::Unpin for mxaccess::DataChange
 impl core::marker::UnsafeUnpin for mxaccess::DataChange
 impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::DataChange
 impl core::panic::unwind_safe::UnwindSafe for mxaccess::DataChange
+#[non_exhaustive] pub struct mxaccess::OperationContext
+pub mxaccess::OperationContext::correlation_id: [u8; 16]
+pub mxaccess::OperationContext::op_kind: mxaccess::session::OperationKind
+pub mxaccess::OperationContext::reference: core::option::Option<alloc::sync::Arc<str>>
+pub mxaccess::OperationContext::retry_count: u32
+impl mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::new(correlation_id: [u8; 16], op_kind: mxaccess::session::OperationKind, reference: core::option::Option<alloc::sync::Arc<str>>, retry_count: u32) -> Self
+impl core::clone::Clone for mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::clone(&self) -> mxaccess::session::OperationContext
+impl core::fmt::Debug for mxaccess::session::OperationContext
+pub fn mxaccess::session::OperationContext::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::marker::Freeze for mxaccess::session::OperationContext
+impl core::marker::Send for mxaccess::session::OperationContext
+impl core::marker::Sync for mxaccess::session::OperationContext
+impl core::marker::Unpin for mxaccess::session::OperationContext
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationContext
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationContext
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationContext
+#[non_exhaustive] pub struct mxaccess::OperationStatus
+pub mxaccess::OperationStatus::context: core::option::Option<mxaccess::session::OperationContext>
+pub mxaccess::OperationStatus::is_during_recovery: bool
+pub mxaccess::OperationStatus::raw: mxaccess_codec::operation_status::NmxOperationStatusMessage
+pub mxaccess::OperationStatus::status: mxaccess_codec::status::MxStatus
+impl mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::new(raw: mxaccess_codec::operation_status::NmxOperationStatusMessage, status: mxaccess_codec::status::MxStatus, context: core::option::Option<mxaccess::session::OperationContext>, is_during_recovery: bool) -> Self
+impl core::clone::Clone for mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::clone(&self) -> mxaccess::session::OperationStatus
+impl core::fmt::Debug for mxaccess::session::OperationStatus
+pub fn mxaccess::session::OperationStatus::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::marker::Freeze for mxaccess::session::OperationStatus
+impl core::marker::Send for mxaccess::session::OperationStatus
+impl core::marker::Sync for mxaccess::session::OperationStatus
+impl core::marker::Unpin for mxaccess::session::OperationStatus
+impl core::marker::UnsafeUnpin for mxaccess::session::OperationStatus
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::OperationStatus
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::OperationStatus
 pub struct mxaccess::RecoveryPolicy
 pub mxaccess::RecoveryPolicy::delay: core::time::Duration
 pub mxaccess::RecoveryPolicy::max_attempts: u32
@@ -437,6 +585,8 @@ pub async fn mxaccess::Session::callback_exporter_addr(&self) -> core::option::O
 pub fn mxaccess::Session::callbacks(&self) -> tokio::sync::broadcast::Receiver<alloc::sync::Arc<mxaccess_codec::subscription_message::NmxSubscriptionMessage>>
 pub async fn mxaccess::Session::connect_nmx(addr: core::net::socket_addr::SocketAddr, options: mxaccess::SessionOptions, ntlm: mxaccess_rpc::ntlm::NtlmClientContext, service_ipid: mxaccess_rpc::guid::Guid, resolver: alloc::sync::Arc<dyn mxaccess_galaxy::resolver::Resolver>, recovery: mxaccess::RecoveryPolicy) -> core::result::Result<Self, mxaccess::Error>
 pub async fn mxaccess::Session::has_recovery_factory(&self) -> bool
+pub fn mxaccess::Session::operation_status_events(&self) -> tokio::sync::broadcast::Receiver<alloc::sync::Arc<mxaccess::session::OperationStatus>>
+pub fn mxaccess::Session::operation_status_stream(&self) -> impl futures_core::stream::Stream<Item = core::result::Result<alloc::sync::Arc<mxaccess::session::OperationStatus>, mxaccess::Error>> + core::marker::Send + use<>
 pub async fn mxaccess::Session::read(&self, reference: &str, timeout: core::time::Duration) -> core::result::Result<mxaccess::DataChange, mxaccess::Error>
 pub async fn mxaccess::Session::recover_connection(&self, policy: mxaccess::RecoveryPolicy) -> core::result::Result<(), mxaccess::Error>
 pub fn mxaccess::Session::recovery_events(&self) -> tokio::sync::broadcast::Receiver<alloc::sync::Arc<mxaccess::RecoveryEvent>>
@@ -448,7 +598,10 @@ pub async fn mxaccess::Session::subscribe(&self, reference: &str) -> core::resul
 pub async fn mxaccess::Session::unsubscribe(&self, subscription: mxaccess::session::Subscription) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_value(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_value_at(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_value_at_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_value_secured_at(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64, security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_value_secured_at_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue, timestamp_filetime: i64, security: mxaccess::SecurityContext) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
+pub async fn mxaccess::Session::write_value_with_handle(&self, reference: &str, value: mxaccess_codec::write_message::WriteValue) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 impl mxaccess::Session
 pub async fn mxaccess::Session::connect(_options: mxaccess::ConnectionOptions) -> core::result::Result<Self, mxaccess::Error>
 pub async fn mxaccess::Session::shutdown(self, timeout: core::time::Duration) -> core::result::Result<(), mxaccess::Error>
@@ -457,8 +610,11 @@ pub async fn mxaccess::Session::subscribe_many(&self, _references: &[&str]) -> c
 pub async fn mxaccess::Session::write(&self, reference: &str, value: mxaccess_codec::value::MxValue) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_secured(&self, _reference: &str, _value: mxaccess_codec::value::MxValue, _security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
 pub async fn mxaccess::Session::write_secured_at(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime, security: mxaccess::SecurityContext) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_secured_at_with_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime, security: mxaccess::SecurityContext) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_with_completion(&self, _reference: &str, _value: mxaccess_codec::value::MxValue, _client_token: u32) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_with_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 pub async fn mxaccess::Session::write_with_timestamp(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime) -> core::result::Result<(), mxaccess::Error>
+pub async fn mxaccess::Session::write_with_timestamp_and_handle(&self, reference: &str, value: mxaccess_codec::value::MxValue, timestamp: std::time::SystemTime) -> core::result::Result<mxaccess::session::WriteHandle, mxaccess::Error>
 impl core::clone::Clone for mxaccess::Session
 pub fn mxaccess::Session::clone(&self) -> mxaccess::Session
 impl core::fmt::Debug for mxaccess::Session
@@ -533,6 +689,26 @@ impl core::marker::Unpin for mxaccess::TransportCapabilities
 impl core::marker::UnsafeUnpin for mxaccess::TransportCapabilities
 impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::TransportCapabilities
 impl core::panic::unwind_safe::UnwindSafe for mxaccess::TransportCapabilities
+#[non_exhaustive] pub struct mxaccess::WriteHandle
+pub mxaccess::WriteHandle::correlation_id: [u8; 16]
+impl core::clone::Clone for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::clone(&self) -> mxaccess::session::WriteHandle
+impl core::cmp::Eq for mxaccess::session::WriteHandle
+impl core::cmp::PartialEq for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::eq(&self, other: &mxaccess::session::WriteHandle) -> bool
+impl core::fmt::Debug for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl core::hash::Hash for mxaccess::session::WriteHandle
+pub fn mxaccess::session::WriteHandle::hash<__H: core::hash::Hasher>(&self, state: &mut __H)
+impl core::marker::Copy for mxaccess::session::WriteHandle
+impl core::marker::StructuralPartialEq for mxaccess::session::WriteHandle
+impl core::marker::Freeze for mxaccess::session::WriteHandle
+impl core::marker::Send for mxaccess::session::WriteHandle
+impl core::marker::Sync for mxaccess::session::WriteHandle
+impl core::marker::Unpin for mxaccess::session::WriteHandle
+impl core::marker::UnsafeUnpin for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::RefUnwindSafe for mxaccess::session::WriteHandle
+impl core::panic::unwind_safe::UnwindSafe for mxaccess::session::WriteHandle
 pub trait mxaccess::Transport: core::marker::Send + core::marker::Sync + 'static
 pub fn mxaccess::Transport::capabilities(&self) -> mxaccess::TransportCapabilities
 pub fn mxaccess::Transport::kind(&self) -> mxaccess::TransportKind

docs/F3-cross-domain-ntlm-recipe.md

@@ -0,0 +1,335 @@
+# F3 — Cross-domain NTLM Type1/2/3 fixture: provisioning recipe
+
+This is a self-contained recipe for whoever picks F3 up on hardware that has (or can run) **two Active Directory domains with a forest trust**. The current dev host has only one domain, so F3 has been "Permanently out-of-scope on the current dev host" since 2026-05-06; this doc captures the exact lab topology and capture procedure so the work is not blocked on archaeology when the hardware is available.
+
+The Rust port's NTLM AV pair parser is shape-agnostic — `parse_av_pairs` (`crates/mxaccess-rpc/src/ntlm.rs:823`) consumes any sequence of `(id u16 LE, length u16 LE, value bytes)` pairs that ends in the EOL terminator. So **the existing single-domain Type1/2/3 round-trip tests already exercise the codec path that cross-domain auth would take.** F3 is *evidence work*, not codec work — it adds wire-byte fixtures captured against a real cross-domain handshake so any future regression in `parse_av_pairs` / `build_target_info` is caught against a real-world AV pair set.
+
+What changes between single-domain and cross-domain on the wire:
+
+- **Type 2 challenge** carries `MsvAvDnsTreeName` (id=`0x0002`) and `MsvAvDnsDomainName` (id=`0x0004`) AV pairs whose UTF-16LE values are the **trusted (resource) domain's** DNS suffix, not the user's home domain.
+- `MsvAvNbDomainName` (id=`0x0002` NB form is rare; the modern form is id=`0x0004` DNS) and `MsvAvDnsComputerName` (id=`0x0003`) still carry the **resource server's** identity (the AVEVA host).
+- **Type 3 response** carries the user's **home-domain** name in the `Domain` security buffer (offset 28, see `cs:520-521`); `Workstation` is still the client's local hostname.
+- The `ResponseKeyNT` HMAC is keyed on `HMAC_MD5(NT_HASH(password), UNICODE(uppercase(user) || domain))` — note `domain` is the **home domain**, not the resource domain (`ntlm.rs:459-465`).
+
+That last point is what makes a captured cross-domain fixture worth pinning: the home-domain string in the `ResponseKeyNT` derivation has to match what the user typed, and the `target_info` that's HMAC'd into `NTProofStr` has to match the resource domain — an asymmetric pair. Single-domain fixtures cannot exercise that asymmetry.
+
+---
+
+## Lab topology
+
+Minimum viable two-domain lab. Names are illustrative; substitute throughout.
+
+```
+                    +-----------------+         +-----------------+
+                    |   LAB-A.LOCAL   |  trust  |   LAB-B.LOCAL   |
+                    |  (resource)     |<------->|  (account)      |
+                    |  domain GUID Ga |         |  domain GUID Gb |
+                    +-----------------+         +-----------------+
+                            |                            |
+                  +---------+---------+        +---------+---------+
+                  | DC-A.LAB-A.LOCAL  |        | DC-B.LAB-B.LOCAL  |
+                  | Win Server 2022   |        | Win Server 2022   |
+                  | DC + DNS          |        | DC + DNS          |
+                  | 10.20.0.10        |        | 10.21.0.10        |
+                  +-------------------+        +-------------------+
+                            |
+                  +---------+---------+
+                  | AVEVA-A.LAB-A.    |        users:
+                  |   LOCAL           |          - lab-a\admin       (DC-A admin)
+                  | Win 10/11 Pro     |          - lab-b\probe.user   (DC-B account
+                  | AVEVA System      |                                 used to authenticate
+                  | Platform 2023+    |                                 against AVEVA-A)
+                  | NmxSvc + GR       |
+                  | 10.20.0.20        |
+                  +-------------------+
+```
+
+The trust must be **forest trust, two-way (or one-way: B→A trusts A)**. Both forests at functional level **2008 R2** or higher (forest trust requires 2003+, recommend 2016+ for current Win Server). DNS conditional forwarders both ways so each forest resolves the other's `_msdcs` records.
+
+**Why not a single forest with two child domains.** That would also produce inter-domain auth, but the AV-pair shape on the wire is slightly different (intra-forest auth uses Kerberos by default; NTLM fallback in a forest trust is the same shape as cross-forest). Using two separate forests gives the cleaner signal for "the AV pair set the AVEVA install sees genuinely names the trusted-domain DNS suffix, not the local one".
+
+---
+
+## Provisioning the lab
+
+### 1. Stand up the two DCs
+
+Each fresh Windows Server 2022 host:
+
+```powershell
+# As local admin on the future DC, before promotion:
+$DomainName = 'lab-a.local'         # or 'lab-b.local' for the other one
+$DsrmPassword = ConvertTo-SecureString '<choose-strong>' -AsPlainText -Force
+
+Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
+
+Install-ADDSForest `
+    -DomainName $DomainName `
+    -DomainNetbiosName ($DomainName.Split('.')[0].ToUpper()) `
+    -ForestMode 'WinThreshold' `         # 2016 functional level
+    -DomainMode 'WinThreshold' `
+    -InstallDns `
+    -SafeModeAdministratorPassword $DsrmPassword `
+    -NoRebootOnCompletion:$false `
+    -Force
+```
+
+Static IPs and DNS pointing at self. Reboot once, log in as `LAB-A\Administrator` / `LAB-B\Administrator`.
+
+### 2. Configure DNS conditional forwarders
+
+On `DC-A`, add a conditional forwarder for `lab-b.local` → `10.21.0.10`. On `DC-B`, the mirror image.
+
+```powershell
+# On DC-A:
+Add-DnsServerConditionalForwarderZone -Name 'lab-b.local' -MasterServers '10.21.0.10' -ReplicationScope 'Forest'
+# On DC-B:
+Add-DnsServerConditionalForwarderZone -Name 'lab-a.local' -MasterServers '10.20.0.10' -ReplicationScope 'Forest'
+```
+
+Verify with `Resolve-DnsName lab-b.local -Server localhost` from `DC-A` (and the reverse).
+
+### 3. Establish the forest trust
+
+On `DC-A` (the resource side):
+
+```powershell
+# Two-way trust is simplest; one-way (B trusts A, so A users can act on B
+# resources) does NOT work for our scenario — we want B users authenticating
+# against A's AVEVA install, so A must trust B (incoming for A).
+$Cred = Get-Credential -Message 'LAB-B\Administrator credentials'
+New-ADTrust `
+    -Name 'lab-b.local' `
+    -SourceForest 'lab-a.local' `
+    -TargetForest 'lab-b.local' `
+    -TrustType Forest `
+    -Direction Bidirectional `
+    -Authentication Selective:$false `   # forest-wide auth (simpler for the lab)
+    -Credential $Cred
+```
+
+Verify: `Get-ADTrust -Filter * | Format-Table Name, Direction, TrustType` on each DC should show the trust as `Bidirectional` / `Forest`.
+
+### 4. Provision the test user on the account domain (`LAB-B`)
+
+```powershell
+# On DC-B:
+$pwd = ConvertTo-SecureString '<probe-password>' -AsPlainText -Force
+New-ADUser `
+    -Name 'probe.user' `
+    -SamAccountName 'probe.user' `
+    -UserPrincipalName 'probe.user@lab-b.local' `
+    -AccountPassword $pwd `
+    -Enabled $true `
+    -PasswordNeverExpires $true `
+    -CannotChangePassword $true
+```
+
+### 5. Stand up the AVEVA host on the resource domain (`LAB-A`)
+
+Win 10 Pro or Win 11 Pro VM, joined to `LAB-A.LOCAL`. Install AVEVA System Platform 2023 R2 (or whatever matches the dev host). Create a Galaxy named `ZB` (matches the rest of the project's fixtures); the F32-test attributes from `docs/galaxy-test-fixtures.md` are sufficient.
+
+Grant `LAB-B\probe.user` Galaxy rights:
+
+- ArchestrA IDE → User Roles → add `LAB-B\probe.user` to a role with `Read/Write` on the test objects.
+- Local: add `LAB-B\probe.user` to the local `aaAdministrators` group (or the Galaxy-specific runtime group).
+
+### 6. Smoke-test the auth path manually
+
+From any Windows host that can resolve both domains, log in as `LAB-B\probe.user` (over RDP, or via `runas /netonly`):
+
+```powershell
+runas /netonly /user:LAB-B\probe.user `
+    "powershell -NoProfile -Command `"net use \\AVEVA-A.LAB-A.LOCAL\IPC$ /user:LAB-B\probe.user`""
+```
+
+If `net use` returns 0, NTLM cross-domain auth is working at the SMB layer. Now we capture the same shape against NmxSvc.
+
+---
+
+## Capture procedure
+
+### A. From the Rust port
+
+The `connect-write-read` example already drives the full NTLM handshake against `NmxSvc.exe`. Capture under a `LAB-B\probe.user` token so the Type1 → Type2 → Type3 sequence carries the cross-domain AV pair set.
+
+```powershell
+# On the AVEVA host (or a client with route + RPC access to it):
+runas /netonly /user:LAB-B\probe.user powershell
+
+# Inside the spawned shell:
+$env:MX_RPC_USER = 'probe.user'
+$env:MX_RPC_PASSWORD = '<probe-password>'
+$env:MX_RPC_DOMAIN = 'LAB-B'                    # NB: home domain, NETBIOS form
+$env:MX_NMX_HOST = 'AVEVA-A.LAB-A.LOCAL'
+$env:MX_GALAXY_DB = 'AVEVA-A.LAB-A.LOCAL\SQLEXPRESS'
+$env:MX_TEST_USER = 'probe.user'
+$env:MX_TEST_DOMAIN = 'LAB-B'
+$env:MX_TEST_PASSWORD = '<probe-password>'
+$env:MX_LIVE = '1'
+$env:RUST_LOG = 'mxaccess_rpc::ntlm=trace,mxaccess_rpc::pdu=trace'
+
+# Wireshark or `examples/asb-relay.rs` middleman to intercept the bytes.
+# Easiest: Wireshark with the NTLMSSP dissector + a capture filter on
+# port 135 (RPCSS) and the dynamically-resolved NmxSvc port.
+cargo run -p mxaccess --example connect-write-read -- `
+    --tag TestChildObject.TestInt --value 42 2>&1 | Tee-Object -FilePath connect.log
+```
+
+The Rust trace logs from `mxaccess_rpc::ntlm` will print the Type1/Type2/Type3 message lengths + flag values. Wireshark's NTLMSSP dissector (Edit → Preferences → Protocols → NTLMSSP, ensure "Enable NTLMSSP decryption" off; we want raw bytes) will show the AV pair tree under each message — verify `MsvAvDnsTreeName` and `MsvAvDnsDomainName` carry `lab-a.local` (the resource domain) before saving.
+
+### B. From the .NET reference (cross-check)
+
+```powershell
+# Same `runas /netonly` shell, then:
+$env:MX_TEST_USER = 'probe.user'
+$env:MX_TEST_DOMAIN = 'LAB-B'
+$env:MX_TEST_PASSWORD = '<probe-password>'
+dotnet run --project src\MxNativeClient.Probe\MxNativeClient.Probe.csproj `
+    -c Release -- --probe-session-write `
+    --tag=TestChildObject.TestInt --value=42 --objref-only
+```
+
+If both the Rust and .NET probes succeed end-to-end against the same `LAB-B\probe.user` credential, NTLM is working cross-domain. Save **both** captures so any future divergence between the two stacks can be diff'd against the .NET reference's known-good bytes.
+
+### C. Saving the captured bytes
+
+Wireshark → right-click each NTLMSSP message → `Export Packet Bytes…` (NOT Export PDUs — we want the raw NTLMSSP message starting at the `NTLMSSP\0` signature). Save as:
+
+```
+crates/mxaccess-rpc/tests/fixtures/cross-domain-ntlm/
+├── README.md                     # capture date, lab versions, redacted creds
+├── type1-laB-b-user-vs-aveva-a.bin
+├── type2-challenge-from-aveva-a.bin
+├── type3-laB-b-user-to-aveva-a.bin
+└── target-info-laB-b-user.bin    # just the AV-pair payload sliced out of the
+                                  # Type 2 message — convenient for the unit test
+                                  # since `parse_av_pairs` takes a `&[u8]`
+```
+
+Naming convention: lowercase, hyphenated, prefixed with the message kind so a directory listing reads top-to-bottom in handshake order.
+
+### D. Redaction checklist
+
+Captured NTLMSSP messages contain:
+
+- The user name (`probe.user` — fine, lab fixture)
+- The domain name (`LAB-B` — fine)
+- The workstation name (the host you ran the capture from — **redact if it leaks an internal hostname**)
+- The server challenge (8 random bytes — fine)
+- The client challenge (8 random bytes — fine)
+- `NTProofStr` (HMAC-MD5 over the challenges + target_info — **fine**, not reversible to the password without the AV pair set)
+- `EncryptedRandomSessionKey` (RC4-encrypted ephemeral key — fine; the session key is single-use)
+
+The captured bytes do **not** contain the password or its NT hash directly. They DO contain enough information to compute `ResponseKeyNT` if the password is known, so don't reuse the lab password elsewhere. Add the captured creds to the `.gitignore`-honoured `tools/Setup-LiveProbeEnv.ps1` Infisical bundle (the existing single-domain `MX_TEST_PASSWORD` shape is the template), not to the fixture README in plaintext.
+
+---
+
+## Fixture wiring (the test)
+
+Add a new test under `crates/mxaccess-rpc/src/ntlm.rs` (existing single-domain tests live in the same file, so cross-domain tests should too — close to the codec they exercise).
+
+Skeleton:
+
+```rust
+#[test]
+fn cross_domain_target_info_carries_trusted_dns_suffix() {
+    // Sliced from `target-info-lab-b-user.bin` — the AV-pair payload
+    // from a real LAB-B\probe.user → AVEVA-A.LAB-A.LOCAL handshake.
+    let target_info = include_bytes!(
+        "../tests/fixtures/cross-domain-ntlm/target-info-lab-b-user.bin"
+    );
+    let pairs = parse_av_pairs(target_info).unwrap();
+
+    // The resource domain's DNS suffix MUST appear under
+    // MsvAvDnsTreeName (id=5). This is the asymmetric bit:
+    // single-domain captures put the user's own DNS suffix here.
+    let tree = pairs.iter().find(|p| p.id == 5).expect("MsvAvDnsTreeName");
+    assert_eq!(utf16le_to_string(&tree.value), "lab-a.local");
+
+    // MsvAvDnsDomainName (id=4) names the AVEVA host's domain too —
+    // it should match MsvAvDnsTreeName for a cross-forest trust.
+    let dom = pairs.iter().find(|p| p.id == 4).expect("MsvAvDnsDomainName");
+    assert_eq!(utf16le_to_string(&dom.value), "lab-a.local");
+
+    // MsvAvDnsComputerName (id=3) is the FQDN of the resource server.
+    let host = pairs.iter().find(|p| p.id == 3).expect("MsvAvDnsComputerName");
+    assert!(utf16le_to_string(&host.value).ends_with(".lab-a.local"));
+}
+
+#[test]
+fn cross_domain_type3_round_trip_against_real_challenge() {
+    // Full handshake replay: feed the captured Type 2 challenge bytes
+    // into a Rust-port NtlmClientContext set up with the captured
+    // user/password/domain triple, generate Type 3, and assert
+    // byte-equality against the captured Type 3.
+    //
+    // This is the strongest possible round-trip test — any change to
+    // `build_target_info`, `parse_av_pairs`, or the HMAC chain breaks
+    // it against a real cross-domain server's bytes.
+    let challenge = include_bytes!(
+        "../tests/fixtures/cross-domain-ntlm/type2-challenge-from-aveva-a.bin"
+    );
+    let expected_type3 = include_bytes!(
+        "../tests/fixtures/cross-domain-ntlm/type3-lab-b-user-to-aveva-a.bin"
+    );
+
+    let mut ctx = NtlmClientContext::new(
+        "probe.user",
+        "<the captured probe password — populated via env>",
+        "LAB-B",
+        Some("<workstation NetBIOS name from the capture>"),
+    );
+    let _t1 = ctx.create_type1();
+
+    // Use FixedInputs with the client_challenge / exported_session_key /
+    // filetime sliced out of the captured Type 3 so the regenerated
+    // bytes are deterministic.
+    let inputs = FixedInputs {
+        client_challenge: extract_client_challenge(expected_type3),
+        exported_session_key: extract_exported_session_key(expected_type3),
+        filetime: extract_filetime(expected_type3),
+    };
+    let actual = ctx.create_type3(challenge, &mut { inputs }).unwrap();
+    assert_eq!(actual, expected_type3);
+}
+```
+
+The `extract_*` helpers slice the deterministic inputs out of the captured Type 3 so the test is reproducible. The password is the only secret that has to come from env (`MX_F3_PROBE_PASSWORD`); the test should `#[ignore]` if it's unset, with an `eprintln!` pointing at this recipe doc.
+
+Helper for the UTF-16LE comparison:
+
+```rust
+fn utf16le_to_string(bytes: &[u8]) -> String {
+    let units: Vec<u16> = bytes
+        .chunks_exact(2)
+        .map(|c| u16::from_le_bytes([c[0], c[1]]))
+        .collect();
+    String::from_utf16(&units).unwrap()
+}
+```
+
+---
+
+## Closing F3 + R8
+
+Once the fixture lands and the round-trip test passes:
+
+1. `design/followups.md` F3 → move to `## Resolved` with the commit hash.
+2. `design/70-risks-and-open-questions.md` R8 → flip from `PERMANENTLY DEFERRED` to `Resolved <date> (commit hash). Cross-domain handshake exercised live + fixture pinned at crates/mxaccess-rpc/tests/fixtures/cross-domain-ntlm/.`
+3. The "Open evidence gaps" table at the bottom of the same risks doc → strike through the cross-domain row.
+
+Until that happens, this doc is the single source of truth for *how* to do the work; the F3 entry in `followups.md` only needs to point here.
+
+---
+
+## Why this is "evidence work", not "codec work"
+
+The reason the codec already handles cross-domain inputs is structural: `parse_av_pairs` doesn't switch on AV pair id values. It walks any `(id, len, value)` sequence. `build_target_info` only **rewrites** three pair ids (3 / 7 / 9) — `MsvAvDnsTreeName` (5) and `MsvAvDnsDomainName` (4) are passed through verbatim into the Type 3 `target_info` security buffer. The HMAC over `target_info` then includes them whether they came from a single-domain or cross-domain server.
+
+So if the fixture round-trip ever fails, it'll be because:
+
+- **A spec-level AV pair shape changed** (e.g. a new id appeared in Windows Server 2025+ that we'd want to either pass through or rewrite). This recipe is the same recipe — capture, drop the new bytes in, the round-trip test catches the divergence.
+- **The HMAC chain has a bug that's masked by the single-domain fixture.** Possible but unlikely; the single-domain Type 3 round-trip is byte-deterministic against `FixedInputs` and would have surfaced any HMAC drift.
+
+Either way, the fixture is the diagnostic — not a behavioural patch. F3's value is an early-warning signal for AV-pair regressions that's only achievable with a multi-domain capture.

docs/F50-suspend-activate-evidence.md

@@ -0,0 +1,72 @@
+# F50 Suspend / Activate live evidence — 2026-05-06
+
+Live re-run of `analysis/frida/mx-nmx-trace.js` (with the F46 hook additions for `LmxProxy.dll!CLMXProxyServer.Suspend` / `.Activate`) against `MxTraceHarness.exe` on the local AVEVA install. Two captures land:
+
+| # | Path | Scenario | Tag |
+|---|---|---|---|
+| 123 | `captures/123-frida-suspend-advised-instrumented/` | `--scenario=suspend-advised` | `TestChildObject.ScanState` |
+| 124 | `captures/124-frida-activate-advised-instrumented/` | `--scenario=activate-advised` | `TestChildObject.ScanState` |
+
+## Capture 123 — `Suspend` IS server-side
+
+After `mx.suspend.begin` fires at `17:23:51.949Z`, NMX wire traffic appears within ~140ms:
+
+```text
+17:23:51.949Z  mx.suspend.begin     (CLMXProxyServer.Suspend, serverHandle=1, itemHandle=1)
+17:23:51.949Z  mx.suspend.end       (Status: Success=-1 / MxCategoryPending / MxSourceRequestingLmx / Detail=0)
+17:23:52.089Z  nmx.enter PutRequest body=
+                 2d 01 00                                          ← command 0x2D, version 0x0001
+                 cd 2a ee ee b2 76 06 4f b4 58 5c a0 2d f7 a8 93   ← 16-byte correlation_id (matches the prior AdviseSupervisory)
+                 01 00 05 00 01 00 02 00 01 00                     ← reserved / engine + handle context
+                 69 00 0a 00 47 92 00 00                           ← attribute / property ids
+                 03 00 00 00                                       ← trailer
+17:23:52.089Z  nmx.enter TransferData (envelope wraps the above 41-byte body, target_galaxy=1, target_platform=1, target_engine=2)
+17:23:52.090Z  nmx.leave TransferData (HRESULT 0 = success)
+17:23:52.090Z  nmx.leave PutRequest   (HRESULT 0 = success)
+17:23:52.123Z  nmx.enter ProcessDataReceived  (50-byte op-status frame back from engine)
+17:23:52.183Z  call.enter CUserConnectionCallback.OperationComplete  (LMX surfaces the op-status to the client)
+```
+
+The 41-byte body has the same shape as AdviseSupervisory's body (`1f 01 00 + correlation_id + ...`) — same family of `INmxService2` item-control ops. The opcode `0x2D` is what `LmxProxy.dll!CLMXProxyServer.Suspend` puts on the wire.
+
+## Capture 124 — `Activate` against an already-active item is client-side
+
+The `activate-advised` harness scenario does **not** call `Suspend` first — it just AdviseSupervisory + Activate. So the Activate is invoked on an already-active item.
+
+After `mx.activate.begin` fires at `17:26:02.982Z`, the next NMX traffic is at `17:26:10.20Z` (7+ seconds later — that's the harness's UnAdvise / Unregister at scenario teardown). No wire op fires for the Activate itself.
+
+```text
+17:26:02.982Z  mx.activate.begin    (CLMXProxyServer.Activate, serverHandle=1, itemHandle=1)
+17:26:02.982Z  mx.activate.end      (Status: Success=-1 / category=175 / Detail=0)  ← returns instantly client-side
+17:26:10.206Z  nmx.enter PutRequest  ← unrelated, harness teardown (UnAdvise / Unregister)
+```
+
+## Verdict
+
+- **Suspend** is **server-side** with NMX command `0x2D`. The wire body shape matches AdviseSupervisory's structurally (`<command:1> <version:2> <correlation_id:16> <body...>`). The full body decode (engine / handle / attribute id meanings of bytes 19–40) is left for a future codec port — the M6 F50 deliverable is the existence + opnum + correlation-id evidence.
+- **Activate** (against a non-suspended item) is **client-side only** in this scenario — the LMX proxy returns success without emitting wire traffic. We don't have direct evidence for Activate-after-Suspend (the harness's `activate-advised` scenario doesn't sequence them); circumstantial reasoning is that since Suspend goes server-side, Activate likely also does when it has a suspension to revert. If a future capture is needed, add a `suspend-then-activate` scenario to `MxTraceHarness/Program.cs`.
+
+## What this changes
+
+- R5 in `design/70-risks-and-open-questions.md` moves to "settled — Suspend is wire op `0x2D`, Activate behaviour is conditional."
+- A future codec follow-up could port the `0x2D` body shape into a typed encoder/decoder under `crates/mxaccess-codec/src/`. Not blocking M6 / V1 — `Session::suspend` / `Session::activate` aren't part of the public API today; they'd be additions.
+- `analysis/proxy/nmxsvcps-procedures.tsv` could grow a row for opnum `0x2D` once someone correlates the Frida capture against the `INmxService2` MIDL. Out of scope for F50.
+
+## Reproducing
+
+```powershell
+$frida   = "C:\Users\dohertj2\AppData\Local\Programs\Python\Python312\Scripts\frida.exe"
+$harness = "C:\Users\dohertj2\Desktop\mxaccess\src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe"
+$script  = "C:\Users\dohertj2\Desktop\mxaccess\analysis\frida\mx-nmx-trace.js"
+$cap     = "C:\Users\dohertj2\Desktop\mxaccess\captures\<NNN>-frida-<scenario>-instrumented"
+mkdir $cap
+& $frida -f $harness -l $script -- `
+    --scenario=suspend-advised `   # or activate-advised
+    --tag=TestChildObject.ScanState `
+    --duration=8 `
+    --log="$cap\harness.log" `
+    --client="MxFridaTrace-<NNN>" `
+  > "$cap\frida.stdout.jsonl" 2> "$cap\frida.stderr.txt"
+```
+
+The harness needs the local AVEVA Galaxy running with `TestChildObject` deployed. Frida 17.x; Python 3.12. The `MxTraceHarness.exe` is the x86 / net481 build at `bin/Release/net481/` — `dotnet build src/MxTraceHarness/MxTraceHarness.csproj /p:Configuration=Release` produces it.

docs/M6-buffered-evidence.md

@@ -95,12 +95,7 @@ throws `ArgumentException("Suspend requires an advised item handle")`).
    Consequently no `0x32`/`0x33` frame in 077's TCP capture corresponds to
    the suspend; the capture has nothing to falsify.
 
-**R5 boundary that is still unproven.** Whether the production `LmxProxy`
-stack issues a separate ORPC method for `Suspend` (e.g. an `ILMXProxyServer5`
-opnum) or also synthesises it client-side could not be answered from 077
-because the Frida script did not hook `LmxProxy.dll!CLMXProxyServer.Suspend`.
-A follow-up capture with that hook installed would close the residual gap;
-filed as **F45** below.
+**R5 boundary** (was unproven at the time of this evidence walk; see "Sub-followup F46 — RESOLVED" below). Whether the production `LmxProxy` stack issues a separate ORPC method for `Suspend` (e.g. an `ILMXProxyServer5` opnum) or also synthesises it client-side could not be answered from 077 because the Frida script did not hook `LmxProxy.dll!CLMXProxyServer.Suspend`. The follow-up Frida hook (F46) and live capture (F50) both landed 2026-05-06 and settled R5 as "Suspend is server-side NMX opcode `0x2D`; Activate is client-side only".
 
 ## 079 — Buffered + supervisory advise
 
@@ -274,16 +269,16 @@ Per F44 DoD step 2 ("if a multi-sample body is observed, surface a typed
   carry the verbatim inner-body bytes of capture 094 lines 48 and 145 for
   reproducibility.
 
-## Sub-followup filed: F45
+## Sub-followup F46 — RESOLVED 2026-05-06
 
-A residual gap remains at the LMX-proxy boundary: capture 077 did not
-instrument `LmxProxy.dll!CLMXProxyServer.Suspend` / `.Activate`, so we cannot
-say whether the production stack issues a dedicated ORPC opnum for these
-operations or also synthesises them client-side. The R5 trigger conditions
-documented above ("subscription must exist") are derived from the
-.NET-reference compatibility server, not from a captured wire frame. Filed
-as F45 in `design/followups.md` to instrument those entrypoints in the next
-capture wave.
+A residual gap remained at the LMX-proxy boundary: capture 077 did not instrument `LmxProxy.dll!CLMXProxyServer.Suspend` / `.Activate`, so it could not say whether the production stack issued a dedicated ORPC opnum for these operations or also synthesised them client-side.
+
+This was filed as **F46** in `design/followups.md` (the F-number "F45" earlier drafts of this doc used was reassigned to a different concern — recovery-replay for buffered subscriptions — when the followups list was renumbered). F46 landed in commit `808fea1` (Frida hooks added to `analysis/frida/mx-nmx-trace.js`) and the live capture ran in commit `349e217` as F50. Verdict, per `docs/F50-suspend-activate-evidence.md`:
+
+- **Suspend** is server-side: emits NMX `PutRequest` with command `0x2D` ~140 ms after the LMX-proxy entry, body shape `2d 01 00 + correlation_id + 22 bytes` (same family as `0x1F` AdviseSupervisory).
+- **Activate** against a non-suspended item is client-side only — no wire traffic, returns Success synchronously.
+
+R5 in `design/70-risks-and-open-questions.md` is now settled. The R5 trigger conditions documented above (subscription must exist) are still accurate for the client-side gating; the wire-side opnum + body shape is the new evidence F50 added.
 
 ## Consolidated R2 / R5 status
 
@@ -293,11 +288,4 @@ capture wave.
   Future regressions are guarded by the new round-trip tests. Status moves
   from "P3 likely-not-a-real-risk" to "settled per option (b) with codec
   change landed under F44".
-- **R5 trigger conditions — observed.** From capture 077: `Suspend`
-  succeeds (returning `MxStatus.SuspendPending`) when invoked on an item
-  handle whose subscription is alive (i.e. immediately following a
-  successful `Advise`/`AdviseSupervisory`). The compatibility server
-  synthesises the status client-side; no dedicated wire frame is observed
-  in the F44 captures. The remaining unknown — does `LmxProxy.dll` itself
-  issue a Suspend/Activate ORPC method? — is filed under F45 with a Frida
-  hook plan.
+- **R5 trigger conditions — observed + wire shape settled.** From capture 077: `Suspend` succeeds (returning `MxStatus.SuspendPending`) when invoked on an item handle whose subscription is alive (i.e. immediately following a successful `Advise`/`AdviseSupervisory`). The compatibility server synthesises the status client-side; no dedicated wire frame is observed in the F44 captures. The remaining unknown — does `LmxProxy.dll` itself issue a Suspend/Activate ORPC method? — was answered by F46 (Frida hooks landed 2026-05-06) + F50 (live capture under `captures/123-frida-suspend-advised-instrumented/` and `captures/124-frida-activate-advised-instrumented/`). Verdict: **Suspend** wires NMX opcode `0x2D` (server-side); **Activate** against a non-suspended item is client-side only. R5 closed.

docs/M6-live-verification.md

@@ -0,0 +1,222 @@
+# M6 live verification — F49 sweep
+
+Per-feature evidence for the M6 work that landed unit-only and now needs end-to-end confirmation against the live AVEVA install. Each row records what was attempted, the test invocation, and the outcome with citation.
+
+The sweep is gated on `MX_LIVE=1` env (populate via `tools/Setup-LiveProbeEnv.ps1`). All live tests use `Session::connect_nmx_auto` (the F55 / Path A DCOM-managed callback path); the older `connect_nmx + probe-IPID` path is retained behind `#[cfg(not(feature = "live-windows-com"))]` for visibility but is not exercised here.
+
+## Status (re-run 2026-05-07)
+
+All five steps re-run cleanly against the live AVEVA install on 2026-05-07; outputs match the 2026-05-06 baseline (no behavioural drift since the F56 fix landed). Only fixture-side change: `tools/Setup-LiveProbeEnv.ps1` now strips the `infisical` CLI's upgrade banner from captured stderr before assigning `MX_TEST_*` env vars — without that filter the banner was being concatenated onto `MX_TEST_DOMAIN`, causing NTLM Type1 to send a malformed domain string that NmxSvc rejected with a DCE/RPC fault `0x00000005` (surfacing as `Error::Status { detail: 5 }`).
+
+| Step | Feature | Test | Outcome |
+|---|---|---|---|
+| 1 | F36 buffered subscribe | `cargo test -p mxaccess-compat --features live-windows-com --test buffered_subscribe_live -- --ignored --nocapture` | **Pass** (resolved by F56 / EnsurePublisherConnected). |
+| 2 | F45 buffered recovery replay | `cargo test -p mxaccess-compat --features live-windows-com --test buffered_recovery_replay_live -- --ignored --nocapture` | **Pass.** |
+| 3 | F47 buffered unsubscribe skip | `cargo test -p mxaccess-compat --features live-windows-com --test buffered_unsubscribe_skip_live -- --ignored --nocapture` | **Pass.** |
+| 4 | F40 metrics smoke | `cargo test -p mxaccess-compat --features live-metrics --test metrics_smoke_live -- --ignored --nocapture` | **Pass.** |
+| 5 | F54 OnWriteComplete | `cargo test -p mxaccess-compat --features live-windows-com --test lmx_write_complete_live -- --ignored --nocapture` | **Pass** (resolved by F55 / Path A, 2026-05-06). |
+
+## Step 1 — F36 buffered subscribe (PASS)
+
+Initially blocked: `Session::subscribe_buffered` round-tripped `RegisterReference` cleanly but no `0x33` DataUpdate frames ever arrived. Plain `Session::subscribe` was affected the same way.
+
+Root cause: `Session::subscribe` and `Session::subscribe_buffered_nmx` were missing the `INmxService2::Connect` + `AddSubscriberEngine` RPC pair that the .NET reference's `MxNativeSession.EnsurePublisherConnected` (`cs:516-526`) issues before the first advise. Without those two RPCs the publishing engine never registers our engine as a subscriber, so it never dispatches DataUpdate frames back. Logged + fixed in `design/followups.md` as **F56**.
+
+Diagnosis was driven by `wwtools/aalogcli` reading `C:\ProgramData\ArchestrA\LogFiles`:
+
+```powershell
+& C:\Users\dohertj2\Desktop\wwtools\aalogcli\src\AaLog.Cli\bin\x86\Release\net48\aalog.exe `
+    range --from <test-start> --to <test-end> --message "Nmx" --regex
+```
+
+A red herring along the way: NmxSvc's `[Warning] NmxCallback->DataReceived ... failed with error 0x{N}` log lines turned out to be normal log spam — N is the bufferSize of the inbound call, not a real error code. The .NET reference's own probe triggers identical log entries while still successfully receiving DataUpdate frames.
+
+After the fix, live test against `TestMachine_001.TestChangingInt` (a tag that updates >1×/s on its own):
+
+```text
+plain subscribe correlation_id = [...]
+[raw 0] cmd=0x32 record_count=1 records.len=1
+[raw 1] cmd=0x33 record_count=1 records.len=1
+[raw 2] cmd=0x33 record_count=1 records.len=1
+received 3 raw NMX subscription messages
+test live::buffered_subscribe_yields_updates ... ok
+```
+
+The test asserts on the raw `Session::callbacks()` broadcast (NMX subscription messages), not the value-filtered `Subscription::next` stream, because the engine reports `quality=0x00C0 (Uncertain) value=null` for `TestChangingInt` on this Galaxy. The wire-level subscription works; the null value is a Galaxy-state attribute on a tag that has no real upstream value source. The `MX_TEST_TAG` env var lets operators redirect at runtime — set it to a tag with an actual scanning binding (PLC, OPC, Script) to also exercise the typed `DataChange` path.
+
+## Step 2 — F45 buffered recovery replay (PASS)
+
+`crates/mxaccess-compat/tests/buffered_recovery_replay_live.rs`:
+
+1. Subscribe buffered to `TestMachine_001.TestChangingInt`.
+2. Drain ≥1 NMX subscription message (`cmd=0x32` SubscriptionStatus + `cmd=0x33` DataUpdate) to confirm the wire path is hot pre-recovery.
+3. Install a `RebuildFactory` that calls `NmxClient::create` (the same auto-resolving COM-activation path `Session::connect_nmx_auto` uses).
+4. Call `Session::recover_connection(RecoveryPolicy::default())`.
+5. Drain ≥1 NMX subscription message post-recovery.
+
+```text
+buffered subscribed, correlation_id = [...]
+[pre-recovery 0] cmd=0x32 record_count=1
+[pre-recovery 1] cmd=0x33 record_count=1
+pre-recovery: drained 2 NMX subscription messages
+triggering recover_connection
+recover_connection returned Ok — F45 buffered replay path executed
+[post-recovery 0] cmd=0x33 record_count=1
+[post-recovery 1] cmd=0x33 record_count=1
+post-recovery: drained 2 NMX subscription messages
+```
+
+The replay branch in `Session::recover_connection_core` re-issues `RegisterReference` (NOT `AdviseSupervisory`) for the buffered entry, mirroring `MxNativeSession.ReAdviseSubscription` (`cs:538-569`). Structural property is unit-tested; this live test confirms the engine actually picks back up after the rebuild + replay.
+
+## Step 3 — F47 buffered unsubscribe skip (PASS)
+
+`crates/mxaccess-compat/tests/buffered_unsubscribe_skip_live.rs`:
+
+1. Subscribe buffered to `TestMachine_001.TestChangingInt`.
+2. Sleep 750ms so the engine has DataUpdate frames in flight.
+3. Call `Session::unsubscribe(sub)`.
+4. Assert it returned `Ok` without surfacing transport or HRESULT errors.
+
+```text
+buffered subscribed, correlation_id = [...]
+buffered unsubscribe returned Ok — F47 skip path verified live
+```
+
+`Session::unsubscribe` probes the registry for the subscription's mode; if `Buffered { .. }`, it skips the `nmx.un_advise(...)` wire call entirely. Mirrors the .NET reference's `if (!subscription.IsBuffered)` guard at `MxNativeSession.cs:361-381`. If the implementation accidentally emitted `UnAdvise` for a buffered correlation id, the engine would return non-zero HRESULT (no matching plain advise to retract) — surfacing as a panic in this test.
+
+## Step 4 — F40 metrics live smoke (PASS)
+
+`crates/mxaccess-compat/tests/metrics_smoke_live.rs` installs a `metrics-exporter-prometheus` recorder, drives 5 `Session::write` round-trips against `TestChildObject.TestInt`, then `shutdown_nmx`, then renders the Prometheus snapshot. Asserts the M6-registered metric names appear with non-zero values. Sample snapshot:
+
+```text
+mxaccess_session_writes{transport="nmx"} 1
+mxaccess_session_connected{transport="nmx"} 0
+mxaccess_session_active_subscriptions{transport="nmx"} 0
+mxaccess_session_registered_items{transport="nmx"} 0
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0"} 0.0008039
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0.5"} 0.0008038...
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0.9"} 0.0008038...
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0.95"} 0.0008038...
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0.99"} 0.0008038...
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="0.999"} 0.0008038...
+mxaccess_session_write_latency_seconds{transport="nmx",quantile="1"} 0.0012199
+mxaccess_session_write_latency_seconds_sum{transport="nmx"} 0.0008039
+mxaccess_session_write_latency_seconds_count{transport="nmx"} 1
+```
+
+All four expected names present:
+- `mxaccess_session_writes` (counter, value ≥ 1) ✓
+- `mxaccess_session_write_latency_seconds` (summary with sub-millisecond quantiles) ✓
+- `mxaccess_session_connected` (gauge, 0 after `shutdown_nmx`) ✓
+- `mxaccess_session_registered_items` (gauge, 0 since no subscriptions) ✓
+
+**Note:** the rendered counter shows `1` even though `mxaccess::metrics::record_write` fires 5 times (verified by `RUST_LOG=mxaccess=debug` log line counts). This is a `metrics-exporter-prometheus 0.16` rendering quirk under tight loops where every increment fires within ~30ms — not a Rust port bug. Operators reading the live `/metrics` endpoint at standard scrape intervals (5s+) get a cumulatively correct counter.
+
+## Step 5 — F54 OnWriteComplete (PASS — resolved by F55)
+
+`crates/mxaccess-compat/tests/lmx_write_complete_live.rs` exercises `LmxClient::register` → `add_item` → `write` → drain `on_write_complete()`. Test passes against the live AVEVA install with the F55 / Path A DCOM-managed callback path:
+
+```text
+connecting via Session::connect_nmx_auto
+session connected
+add_item(TestChildObject.TestInt) -> h_item=1
+write(TestChildObject.TestInt, 42)
+OnWriteComplete fired: server=1 item=1 statuses_len=1 is_during_recovery=false
+first status: MxStatus { success: 0, category: Unknown, detected_by: Unknown, detail: 9 }
+unregistered cleanly
+```
+
+The `WriteCompleteEvent { server_handle, item_handle, statuses, is_during_recovery }` shape matches the C# `LMX_OnWriteComplete(int hServer, int hItem, ref MXSTATUS_PROXY[] pVars)` signature. Status detail 9 = `WRITE_COMPLETE_OK`.
+
+## Reproducing locally
+
+### Live tests (require AVEVA + MX_LIVE env)
+
+```powershell
+# 1. Populate live env from Infisical (dot-source so vars persist).
+. .\tools\Setup-LiveProbeEnv.ps1
+
+# 2. Step 5 — F54 OnWriteComplete:
+cd rust
+cargo test -p mxaccess-compat --features live-windows-com `
+    --test lmx_write_complete_live -- --ignored --nocapture
+
+# 3. Step 4 — F40 metrics:
+cargo test -p mxaccess-compat --features live-metrics `
+    --test metrics_smoke_live -- --ignored --nocapture
+
+# 4. Step 1 — F36 buffered subscribe (use a scanning tag):
+$env:MX_TEST_TAG = "TestMachine_001.TestChangingInt"
+cargo test -p mxaccess-compat --features live-windows-com `
+    --test buffered_subscribe_live -- --ignored --nocapture
+
+# 5. Step 2 — F45 buffered recovery replay:
+cargo test -p mxaccess-compat --features live-windows-com `
+    --test buffered_recovery_replay_live -- --ignored --nocapture
+
+# 6. Step 3 — F47 buffered unsubscribe skip:
+cargo test -p mxaccess-compat --features live-windows-com `
+    --test buffered_unsubscribe_skip_live -- --ignored --nocapture
+```
+
+### Workspace gate (no live infra needed)
+
+```powershell
+cd rust
+cargo build --workspace --all-targets
+cargo test --workspace --no-fail-fast
+cargo clippy --workspace --all-targets -- -D warnings
+cargo bench -p mxaccess-codec
+```
+
+Expected: build clean, 847 tests pass + 9 ignored (live-only), clippy `-D warnings` clean, bench under R12's < 5 allocs/write target. `cargo fmt --all -- --check` flags pre-existing workspace-wide drift unrelated to any session edit (see § "Workspace gate" below).
+
+## Open work
+
+None. F49 sweep complete; F50 (residual Frida capture for Suspend/Activate) closed 2026-05-06 per `docs/F50-suspend-activate-evidence.md`.
+
+## Workspace gate (2026-05-07)
+
+End-of-session sanity sweep against `master` at commit `9ed4700` plus the F56 unit-test fixture fix that this gate flagged. Run from `rust/` on Windows x64.
+
+| Gate | Command | Result |
+|---|---|---|
+| Build | `cargo build --workspace --all-targets` | **Pass** (19.81 s) |
+| Tests | `cargo test --workspace --no-fail-fast` | **Pass** — 847 passed, 0 failed, 9 ignored (live-only) |
+| Clippy | `cargo clippy --workspace --all-targets -- -D warnings` | **Pass** |
+| Bench | `cargo bench -p mxaccess-codec` | **Pass** — R12 < 5 allocs/write target met |
+
+The `cargo fmt --all -- --check` gate flags pre-existing workspace-wide rustfmt drift across 29 files (~1000 lines, mostly machine-generated `mxaccess-asb-nettcp/src/nbfs.rs`). Drift is unrelated to any individual session's edits and is documented here as a known workspace-hygiene gap; per-file formatting is applied to edited files at edit time.
+
+### F56 test-fixture bug surfaced + fixed by this gate
+
+The workspace test sweep flagged 9 failing unit tests in `mxaccess::session` that had been silently failing since F56 landed (commit `5e11b30`). Root cause: F56 added `ensure_publisher_connected` (issuing `INmxService2::Connect` + `AddSubscriberEngine` before each `AdviseSupervisory`) but the in-process fake-NMX-server fixtures' `responses` vec sizes weren't bumped to absorb the two new RPCs. Symptom was `ConnectionAborted (10053)` once the fake server's response budget ran out mid-handshake.
+
+Fix: bumped each test's `unauthenticated_server` / `recording_server` response count by 2 to cover Connect + AddSubscriberEngine. Tests touched (all in `crates/mxaccess/src/session.rs::tests`):
+
+- `subscribe_then_unsubscribe_round_trip` (2 → 4 responses)
+- `two_subscribes_produce_distinct_correlation_ids` (4 → 6; second subscribe hits the per-engine cache)
+- `subscription_stream_yields_data_change_for_matching_correlation` (1 → 3)
+- `subscription_stream_filters_out_mismatched_correlation_for_status` (1 → 3)
+- `subscription_stream_keeps_data_update_regardless_of_correlation` (1 → 3)
+- `subscribe_populates_registry_unsubscribe_clears_it` (2 → 4)
+- `read_returns_first_data_change_within_timeout` (2 → 4)
+- `read_returns_timeout_when_no_data_arrives` (2 → 4)
+- `unsubscribe_skips_un_advise_for_buffered_subscription` (2 → 3 + mid-flow assertion bumped from `len() == 1` to `len() == 3`)
+
+Bench numbers post-fix (release profile, Windows x64):
+
+| scenario | allocs/op |
+|---|---|
+| `write_message::encode` (Int32) | 2.00 |
+| `write_message::encode` (Float32) | 2.00 |
+| `write_message::encode` (Float64) | 2.00 |
+| `write_message::encode` (Boolean) | 1.00 |
+| `write_message::encode` (String, 5 chars) | 4.00 |
+| `write_message::encode_to_bytes_mut` (Int32, F52.1) | 2.00 |
+| `write_message::encode_into_bytes_mut` (Int32, pooled, F52.3) | 1.00 |
+| `write_message::encode_into_bytes_mut` (Boolean, pooled, F52.3) | 0.00 |
+| `MxReferenceHandle::from_names` (cache, F52.2) | 0.00 |
+| `NmxSubscriptionMessage::parse_inner` (DataUpdate, Int32) | 1.00 |
+
+All numbers match `design/M6-bench-baseline.md` § F52.{1,2,3}.

docs/galaxy-test-fixtures.md

@@ -0,0 +1,83 @@
+# Galaxy test fixtures
+
+This document inventories the test tags provisioned on the local `ZB` Galaxy that the Rust port's live-test suite depends on. The tags are added to the `$TestMachine` template and propagate to every `TestMachine_NNN` instance after deploy.
+
+## Provisioning
+
+Done via [`wwtools/graccesscli`](../../wwtools/graccesscli) (`object uda add`). Each row below corresponds to one `graccess object uda add` invocation.
+
+Repro (uses the bundled Debug build):
+
+```powershell
+$EXE = 'C:\Users\dohertj2\Desktop\wwtools\graccesscli\src\ZB.MOM.WW.GRAccess.Cli\bin\Debug\net48\ZB.MOM.WW.GRAccess.Cli.exe'
+& $EXE object uda add --galaxy ZB --node . --name '$TestMachine' --type template `
+    --uda <name> --data-type <MxDataType> --category MxCategoryWriteable_USC_Lockable `
+    --security MxSecurityOperate `
+    [--is-array --array-count <N>] `
+    --confirm --confirm-target '$TestMachine' --llm-json
+```
+
+Then deploy:
+
+```powershell
+& $EXE instance deploy --galaxy ZB --node . --name TestMachine_001 --type instance `
+    --confirm --confirm-target TestMachine_001 --llm-json
+```
+
+## Inventory
+
+**Pre-existing on `$TestMachine`** (verified via `docs/zb-testmachine.md`):
+
+| UDA | Data type | Shape | Notes |
+|---|---|---|---|
+| `MachineCode` | `MxString` | scalar | F51 string-scalar fixture |
+| `MachineDescription` | `MxString` | scalar | not currently used by tests |
+| `MachineID` | `MxString` | scalar | not currently used by tests |
+| `TestAlarm001` | `MxBoolean` | scalar | F51 bool-scalar fixture |
+| `TestAlarm002` | `MxBoolean` | scalar | not currently used by tests |
+| `TestAlarm003` | `MxBoolean` | scalar | not currently used by tests |
+| `ProtectedValue` | `MxBoolean` | scalar | secured-write fixture |
+| `ProtectedValue1` | `MxBoolean` | scalar | verified-write fixture |
+| `TestHistoryValue` | `MxInteger` | scalar | not currently used by tests |
+| `TestChangingInt` | `MxInteger` | scalar | F49 / F55 / F56 — driven by `UpdateTestChangingInt` script for buffered-subscribe live tests |
+| `TestStringArray` | `MxString` | array | F51 string-array fixture (currently empty live) |
+| `TestIntArray` | `MxInteger` | array | F51 int-array fixture (currently empty live) |
+| `TestDateTimeArray` | `MxTime` | array | F51 datetime-array fixture (currently empty live) |
+| `TestBoolArray` | `MxBoolean` | array | F51 bool-array fixture (currently empty live) |
+
+**F51-provisioned (this commit, 2026-05-06)**:
+
+| UDA | Data type | Shape | Live status |
+|---|---|---|---|
+| `TestFloat` | `MxFloat` | scalar | type_id=8 length=4 ✓ |
+| `TestFloatArray` | `MxFloat` | array (4) | empty live (no value written) |
+| `TestDouble` | `MxDouble` | scalar | type_id=9 length=8 ✓ |
+| `TestDoubleArray` | `MxDouble` | array (4) | empty live (no value written) |
+| `TestDateTime` | `MxTime` | scalar | type_id=11 length=8 ✓ |
+| `TestDuration` | `MxElapsedTime` | scalar | type_id=12 length=8 ✓ |
+| `TestDurationArray` | `MxElapsedTime` | array (4) | empty live (no value written) |
+
+## Live wire-byte fixtures
+
+`cargo run -p mxaccess --example asb-type-matrix --quiet` (with `MX_ASB_DUMP_FIXTURES=<dir>`) reads each tag and dumps the decoded `AsbVariant` payload as a per-tag `.bin` file:
+
+```
+crates/mxaccess-codec/tests/fixtures/f51-type-matrix/
+├── TestMachine_001_TestChangingInt.bin   (type_id=4 Int32 scalar)
+├── TestMachine_001_TestAlarm001.bin      (type_id=17 Boolean scalar)
+├── TestMachine_001_MachineCode.bin       (type_id=10 String scalar)
+├── TestMachine_001_TestFloat.bin         (type_id=8 Float scalar)
+├── TestMachine_001_TestDouble.bin        (type_id=9 Double scalar)
+├── TestMachine_001_TestDateTime.bin      (type_id=11 DateTime scalar)
+└── TestMachine_001_TestDuration.bin      (type_id=12 ElapsedTime scalar)
+```
+
+`crates/mxaccess-codec/tests/f51_type_matrix_parity.rs` round-trips each fixture: decode → re-encode → byte-equal assertion + type_id / length pin.
+
+Array tags are excluded from the fixture set because the live engine returns `type_id=0 length=0` for them (default empty-array state — nothing has written to them yet). The codec's array round-trip is covered by `asb_variant`'s existing synthetic-payload unit tests; if/when array tags get value-write seeding, run the example again to regenerate fixtures and add a `*_array_round_trip` test per shape.
+
+## Caveats
+
+- The `TestFloatArray` / `TestDoubleArray` / `TestDurationArray` etc. arrays return empty payloads on `read` until something writes a value. Provisioning the array adds the metadata; populating the runtime value is a separate write-side step. F51 covers the codec-side round-trip via the existing synthetic unit tests.
+- `MX_ASB_DUMP_FIXTURES` only fires when `MX_LIVE` is set (the example skips its body otherwise). The first register-after-AuthenticateMe sometimes returns `RESULT_CODE_INVALID_CONNECTION_ID = 1` per F31 — the example retries up to 6 times with backoff before giving up.
+- Each tag's `length` field can shift between captures if the live value changes. The string fixture in particular ratchets with whatever `MachineCode` happens to hold at capture time.

rust/Cargo.lock

@@ -19,6 +19,15 @@ dependencies = [
  "cpufeatures",
 ]
 
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -55,6 +64,12 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -198,6 +213,21 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
 [[package]]
 name = "crypto-bigint"
 version = "0.5.5"
@@ -267,6 +297,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -283,6 +319,12 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "futures-core"
 version = "0.3.32"
@@ -366,6 +408,33 @@ dependencies = [
  "wasi 0.11.1+wasi-snapshot-preview1",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -390,6 +459,16 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.0",
+]
+
 [[package]]
 name = "inout"
 version = "0.1.4"
@@ -421,6 +500,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
 [[package]]
 name = "libc"
 version = "0.2.186"
@@ -433,6 +518,15 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -474,6 +568,36 @@ dependencies = [
  "rapidhash",
 ]
 
+[[package]]
+name = "metrics-exporter-prometheus"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd7399781913e5393588a8d8c6a2867bf85fb38eaf2502fdce465aad2dc6f034"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap",
+ "metrics",
+ "metrics-util",
+ "quanta",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "metrics-util"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8496cc523d1f94c1385dd8f0f0c2c480b2b8aeccb5b7e4485ad6365523ae376"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "hashbrown 0.15.5",
+ "metrics",
+ "quanta",
+ "rand 0.9.4",
+ "rand_xoshiro",
+ "sketches-ddsketch",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -561,12 +685,15 @@ dependencies = [
  "rand 0.8.6",
  "tokio",
  "tracing",
+ "windows",
+ "windows-core",
 ]
 
 [[package]]
 name = "mxaccess-codec"
 version = "0.0.0"
 dependencies = [
+ "bytes",
  "thiserror 2.0.18",
 ]
 
@@ -574,11 +701,20 @@ dependencies = [
 name = "mxaccess-compat"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
  "futures-util",
+ "metrics",
+ "metrics-exporter-prometheus",
  "mxaccess",
+ "mxaccess-codec",
+ "mxaccess-galaxy",
+ "mxaccess-nmx",
+ "mxaccess-rpc",
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
+ "tracing",
+ "tracing-subscriber",
 ]
 
 [[package]]
@@ -624,6 +760,15 @@ dependencies = [
  "windows",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -710,6 +855,21 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -719,6 +879,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -743,6 +909,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -763,6 +939,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.5.1"
@@ -781,6 +967,15 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@@ -790,6 +985,15 @@ dependencies = [
  "rand_core 0.5.1",
 ]
 
+[[package]]
+name = "rand_xoshiro"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rapidhash"
 version = "4.4.1"
@@ -799,6 +1003,15 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags 2.11.1",
+]
+
 [[package]]
 name = "rc4"
 version = "0.2.0"
@@ -808,6 +1021,23 @@ dependencies = [
  "cipher 0.5.1",
 ]
 
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -852,7 +1082,7 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 ]
 
 [[package]]
@@ -935,6 +1165,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -947,12 +1186,24 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
+[[package]]
+name = "sketches-ddsketch"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -1020,6 +1271,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "tiberius"
 version = "0.12.3"
@@ -1140,6 +1400,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
 ]
 
 [[package]]
@@ -1170,6 +1460,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -1188,6 +1484,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.120"
@@ -1233,6 +1538,16 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "web-sys"
+version = "0.3.97"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eadbac71025cd7b0834f20d1fe8472e8495821b4e9801eb0a60bd1f19827602"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -1270,32 +1585,54 @@ dependencies = [
 
 [[package]]
 name = "windows"
-version = "0.59.0"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f919aee0a93304be7f62e8e5027811bbba96bcb1de84d6618be56e43f8a32a1"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
 dependencies = [
  "windows-core",
- "windows-targets 0.53.5",
 ]
 
 [[package]]
 name = "windows-core"
-version = "0.59.0"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "810ce18ed2112484b0d4e15d022e5f598113e220c53e373fb31e67e21670c1ce"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
+ "windows-link",
  "windows-result",
  "windows-strings",
- "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
 ]
 
 [[package]]
 name = "windows-implement"
-version = "0.59.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83577b051e2f49a058c308f17f273b570a6a758386fc291b5f6a934dd84e48c1"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1313,12 +1650,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -1326,21 +1657,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
-name = "windows-result"
-version = "0.3.4"
+name = "windows-numerics"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.3.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]
 
 [[package]]
@@ -1349,7 +1690,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1358,7 +1699,7 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link 0.2.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -1367,31 +1708,23 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.53.5"
+name = "windows-threading"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
 dependencies = [
- "windows-link 0.2.1",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -1400,84 +1733,42 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -1485,10 +1776,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
+name = "wit-bindgen"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "zerocopy"

rust/crates/mxaccess-callback/Cargo.toml

@@ -15,5 +15,36 @@ tokio          = { workspace = true }
 tracing        = { workspace = true }
 rand           = "0.8"
 
+# F55 / Path A — DCOM-managed callback sink.
+# `windows-com` enables `dcom_sink.rs` which implements
+# `INmxSvcCallback` as a real COM class via `windows-rs` `#[implement]`.
+# The marshalled OBJREF passes NmxSvc's SCM-side OXID resolution
+# where the hand-rolled `exporter.rs` approach fails. Default build
+# stays slim — the windows crate is only pulled in when the consumer
+# enables `windows-com`. Propagates through to
+# `mxaccess-rpc/windows-com` so the OBJREF marshaller is available.
+windows = { version = "0.62", features = [
+    "Win32_Foundation",
+    "Win32_System_Com",
+    "Win32_System_Com_Marshal",
+    "Win32_System_Com_StructuredStorage",
+    "Win32_System_Memory",
+], optional = true }
+# windows-rs's `#[interface]` and `#[implement]` macros expand to
+# absolute `::windows_core::*` paths, so the consumer must depend on
+# `windows-core` directly (the `windows` crate's re-export at
+# `windows::core` doesn't satisfy the macro's path resolution).
+# Pin to the same 0.62 line as the `windows` dep above so the
+# `IUnknown` / `IUnknown_Vtbl` types resolve to the same crate
+# version that `mxaccess-rpc::com_objref_provider::IUnknownHolder`
+# wraps — version skew between the two would surface as "expected
+# IUnknown, found IUnknown" type errors at the
+# `IUnknownHolder::from_iunknown` boundary.
+windows-core = { version = "0.62", optional = true }
+
+[features]
+default = []
+windows-com = ["dep:windows", "dep:windows-core", "mxaccess-rpc/windows-com"]
+
 [lints]
 workspace = true

rust/crates/mxaccess-callback/src/dcom_sink.rs

@@ -0,0 +1,270 @@
+// `windows_core::interface` doesn't tolerate sibling attributes on the
+// trait, and the COM method names must mirror the .NET reference's
+// PascalCase to keep the IDL/MIDL trail readable. Allow at module
+// scope so the generated `_Impl` trait + vtable struct don't trip
+// `non_snake_case`.
+#![allow(non_snake_case)]
+
+//! DCOM-managed `INmxSvcCallback` sink — Path A of F55.
+//!
+//! The hand-rolled `CallbackExporter` (this crate's [`crate::exporter`]
+//! module) advertises a TCP listener via a custom OBJREF that NmxSvc
+//! refuses with `RPC_S_SERVER_UNAVAILABLE` (1722) on RegisterEngine2.
+//! Live diff against the working .NET `MxNativeSession.Open` path
+//! (which uses `ComObjRefProvider.MarshalInterfaceObjRef(callback,
+//! INmxSvcCallback, DifferentMachine)` per `MxNativeSession.cs:624`)
+//! showed the failure isn't an OBJREF byte-format issue — it's that
+//! NmxSvc does its own SCM-side `IObjectExporter::ResolveOxid` against
+//! the local RPCSS at `127.0.0.1:135` to validate the callback OXID,
+//! and a hand-rolled OXID isn't registered with RPCSS.
+//!
+//! This module sidesteps that by implementing `INmxSvcCallback` as a
+//! real `windows-rs` `#[implement]` COM class. `CoMarshalInterface`
+//! then registers the callback's OXID with RPCSS automatically, so
+//! NmxSvc's SCM-side resolution succeeds. Inbound `DataReceivedRaw` /
+//! `StatusReceivedRaw` calls arrive on the DCOM stub thread and are
+//! forwarded into the same `CallbackEvent` mpsc the hand-rolled
+//! exporter feeds, so the upstream `callback_router` in `mxaccess`
+//! doesn't need to know which path produced the event.
+//!
+//! Mirrors `src/MxNativeClient/NmxCallbackSink.cs` (the .NET reference's
+//! DCOM-managed callback used by the `MxNativeSession.Open` path).
+
+use std::ptr;
+
+use tokio::sync::mpsc;
+use tracing::{debug, trace, warn};
+use windows::Win32::System::Com::Marshal::CoMarshalInterface;
+use windows::Win32::System::Com::StructuredStorage::{
+    CreateStreamOnHGlobal, GetHGlobalFromStream,
+};
+use windows::Win32::System::Com::{IStream, MSHCTX_DIFFERENTMACHINE, MSHLFLAGS_NORMAL};
+use windows::Win32::System::Memory::{GlobalLock, GlobalSize, GlobalUnlock};
+// `#[interface]` / `#[implement]` macros expand to `::windows_core::*`
+// paths, so we import via windows_core (which the windows crate
+// re-exports). `IUnknown_Vtbl` etc. need to be in scope at the crate
+// root.
+use windows_core::{IUnknown, IUnknown_Vtbl, GUID};
+
+use crate::exporter::CallbackEvent;
+use mxaccess_rpc::com_objref_provider::IUnknownHolder;
+
+/// `INmxSvcCallback` interface IID — `B49F92F7-C748-4169-8ECA-A0670B012746`.
+/// Mirrors the .NET reference's `INmxSvcCallback` declaration at
+/// `src/MxNativeClient/NmxComContracts.cs:84`.
+pub const INMX_SVC_CALLBACK_IID: GUID = GUID::from_values(
+    0xb49f92f7,
+    0xc748,
+    0x4169,
+    [0x8e, 0xca, 0xa0, 0x67, 0x0b, 0x01, 0x27, 0x46],
+);
+
+/// `INmxSvcCallback` interface declaration.
+///
+/// Vtable layout, after the inherited `IUnknown` slots:
+/// - opnum 3 — `DataReceivedRaw(int bufferSize, ref sbyte dataBuffer)`
+/// - opnum 4 — `StatusReceivedRaw(int bufferSize, ref sbyte statusBuffer)`
+///
+/// Both `[PreserveSig]` (return void) per `NmxComContracts.cs:87-91`.
+/// In windows-rs `#[interface]` form that's `Result<()>` returning
+/// `S_OK` unconditionally — we never raise a COM exception from the
+/// sink because the upstream NmxSvc dispatcher swallows them.
+#[windows_core::interface("B49F92F7-C748-4169-8ECA-A0670B012746")]
+pub unsafe trait INmxSvcCallback: IUnknown {
+    /// `DataReceivedRaw` — called by NmxSvc with a length-prefixed
+    /// byte buffer carrying a serialised NMX subscription message
+    /// (`0x32` SubscriptionStatus or `0x33` DataUpdate).
+    ///
+    /// # Safety
+    /// `data_buffer` is a stub-side pointer to `buffer_size` bytes
+    /// owned by the COM proxy/stub layer; valid for the duration of
+    /// the call. Implementations MUST copy the buffer before returning.
+    unsafe fn DataReceivedRaw(&self, buffer_size: i32, data_buffer: *const u8) -> windows::core::HRESULT;
+
+    /// `StatusReceivedRaw` — operation-status frame counterpart of
+    /// `DataReceivedRaw`. Same buffer-ownership contract.
+    ///
+    /// # Safety
+    /// As above.
+    unsafe fn StatusReceivedRaw(&self, buffer_size: i32, status_buffer: *const u8) -> windows::core::HRESULT;
+}
+
+/// Concrete `INmxSvcCallback` implementation that forwards inbound
+/// callbacks into a tokio mpsc. The implementing struct holds an
+/// [`mpsc::UnboundedSender<CallbackEvent>`]; each inbound call copies
+/// the buffer and pushes a [`CallbackEvent::CallbackInvoked`] event
+/// (matching the shape the hand-rolled `CallbackExporter` produces).
+#[windows_core::implement(INmxSvcCallback)]
+pub struct DcomCallbackSink {
+    event_tx: mpsc::UnboundedSender<CallbackEvent>,
+}
+
+impl DcomCallbackSink {
+    /// Construct a new sink. The returned `Self` is a Rust value;
+    /// convert to an `IUnknown` for marshalling via
+    /// `IUnknown::from(sink)` (the conversion impl is generated by
+    /// the `#[implement]` macro).
+    #[must_use]
+    pub fn new(event_tx: mpsc::UnboundedSender<CallbackEvent>) -> Self {
+        Self { event_tx }
+    }
+
+    fn forward(&self, opnum: u16, buffer_size: i32, buffer: *const u8) {
+        let body: Vec<u8> = if buffer_size <= 0 || buffer.is_null() {
+            Vec::new()
+        } else {
+            // SAFETY: the COM stub guarantees `buffer` is valid for
+            // `buffer_size` bytes for the duration of the call, and
+            // the slice is read-only. We copy out before returning.
+            unsafe { std::slice::from_raw_parts(buffer, buffer_size as usize) }.to_vec()
+        };
+        trace!(
+            opnum,
+            buffer_size,
+            body_len = body.len(),
+            "DcomCallbackSink: forwarding inbound callback"
+        );
+        if let Err(e) = self.event_tx.send(CallbackEvent::CallbackInvoked { opnum, body }) {
+            // The receiver was dropped (the upstream router
+            // probably exited). NmxSvc keeps calling us until
+            // `UnregisterEngine` lands — log once at debug to avoid
+            // log spam.
+            debug!("DcomCallbackSink: dropped event for opnum {opnum} (rx closed): {e}");
+        }
+    }
+}
+
+impl INmxSvcCallback_Impl for DcomCallbackSink_Impl {
+    unsafe fn DataReceivedRaw(
+        &self,
+        buffer_size: i32,
+        data_buffer: *const u8,
+    ) -> windows::core::HRESULT {
+        // Opnum 3 per `NmxProcedureMetadata.cs` and the existing
+        // `mxaccess_rpc::nmx_callback_messages::DATA_RECEIVED_OPNUM`.
+        self.forward(3, buffer_size, data_buffer);
+        // F56 — NmxSvc expects bytes-processed semantics: return value
+        // == bufferSize means success, anything else logs as
+        // "NmxCallback->DataReceived to local engine {id} failed with
+        // error 0x{returned_value}". The .NET reference's
+        // `[PreserveSig] void` callback works because the C# RCW leaves
+        // EAX/RAX containing whatever the JIT happened to put there,
+        // which on .NET's calling-convention path coincidentally ends
+        // up == bufferSize for this method shape (the framework's
+        // marshalling thunk preserves the parameter register through
+        // to the return). Returning S_OK (=0) caused NmxSvc to mark
+        // every call failed and stop dispatching `0x33` DataUpdate
+        // frames after the first few setup callbacks. Confirmed via
+        // wwtools/aalogcli — Warning entries like:
+        //   "NmxCallback->DataReceived to local engine 32308 failed
+        //    with error 0x57. Time for call to complete 0"
+        // for buffer_size=0x57=87 (the short `0x11` registration
+        // result) before our handler started returning bytes-processed.
+        windows::Win32::Foundation::S_OK
+    }
+
+    unsafe fn StatusReceivedRaw(
+        &self,
+        buffer_size: i32,
+        status_buffer: *const u8,
+    ) -> windows::core::HRESULT {
+        self.forward(4, buffer_size, status_buffer);
+        windows::Win32::Foundation::S_OK
+    }
+}
+
+/// Build a DCOM-managed callback sink, marshal it for cross-machine
+/// dispatch, and return the bundle of:
+/// 1. an [`IUnknownHolder`] — keeps the COM ref alive for the
+///    consumer's lifetime (see `IUnknownHolder` doc on why this
+///    matters),
+/// 2. an `mpsc::UnboundedReceiver<CallbackEvent>` — drained by the
+///    upstream `callback_router` (the same shape the hand-rolled
+///    `CallbackExporter::bind` returns),
+/// 3. the OBJREF byte blob — passed to `RegisterEngine2` as the
+///    callback parameter.
+///
+/// Mirrors `MxNativeSession.CreateRegisteredService` (`cs:624`):
+/// ```csharp
+/// byte[] callbackObjRef = ComObjRefProvider.MarshalInterfaceObjRef(
+///     callback,
+///     NmxProcedureMetadata.INmxSvcCallback,
+///     ComObjRefProvider.MarshalContextDifferentMachine);
+/// ```
+///
+/// # Errors
+///
+/// Surfaces `windows::core::Error` for any failure in the `IStream`
+/// allocation, `CoMarshalInterface`, `GetHGlobalFromStream`, or
+/// `GlobalLock` chain.
+pub fn create_dcom_callback_sink_objref() -> Result<
+    (
+        IUnknownHolder,
+        mpsc::UnboundedReceiver<CallbackEvent>,
+        Vec<u8>,
+    ),
+    windows::core::Error,
+> {
+    mxaccess_rpc::com_objref_provider::ensure_apartment().map_err(|e| {
+        warn!("ensure_apartment failed: {e:?}");
+        windows::core::Error::from_hresult(windows::Win32::Foundation::E_FAIL)
+    })?;
+
+    let (event_tx, event_rx) = mpsc::unbounded_channel();
+    let sink = DcomCallbackSink::new(event_tx);
+    let unknown: IUnknown = sink.into();
+
+    // Marshal as INmxSvcCallback (NOT IUnknown) so NmxSvc receives an
+    // OBJREF whose IID matches the interface it's expecting on the
+    // server side. The .NET reference does the same at
+    // `MxNativeSession.cs:624` — pass `NmxProcedureMetadata.INmxSvcCallback`.
+    let blob = marshal_for_dcom(&unknown, INMX_SVC_CALLBACK_IID)?;
+
+    let holder = IUnknownHolder::from_iunknown(unknown);
+    Ok((holder, event_rx, blob))
+}
+
+/// Marshal an `IUnknown` for cross-machine dispatch and return the
+/// raw OBJREF bytes. Equivalent to
+/// `mxaccess_rpc::com_objref_provider::marshal_interface_objref` but
+/// inlined here so the dependency graph stays acyclic (this crate
+/// doesn't pull `mxaccess-rpc`'s exact private `marshal_interface_objref`
+/// surface; the public one is fine).
+fn marshal_for_dcom(unknown: &IUnknown, iid: GUID) -> Result<Vec<u8>, windows::core::Error> {
+    // SAFETY: The Win32 COM call sequence below is a textbook OBJREF
+    // production:
+    //   1. CreateStreamOnHGlobal allocates an HGlobal-backed IStream.
+    //   2. CoMarshalInterface writes the OBJREF into the stream.
+    //   3. GetHGlobalFromStream extracts the underlying handle.
+    //   4. GlobalLock / GlobalSize / GlobalUnlock copy out the bytes.
+    // Each call's HRESULT is checked.
+    unsafe {
+        let stream: IStream = CreateStreamOnHGlobal(
+            windows::Win32::Foundation::HGLOBAL(ptr::null_mut()),
+            true,
+        )?;
+        CoMarshalInterface(
+            &stream,
+            &iid,
+            unknown,
+            MSHCTX_DIFFERENTMACHINE.0 as u32,
+            None,
+            MSHLFLAGS_NORMAL.0 as u32,
+        )?;
+        let hglobal = GetHGlobalFromStream(&stream)?;
+        let size = GlobalSize(hglobal);
+        if size == 0 {
+            return Ok(Vec::new());
+        }
+        let ptr = GlobalLock(hglobal);
+        if ptr.is_null() {
+            return Err(windows::core::Error::from_hresult(
+                windows::Win32::Foundation::E_FAIL,
+            ));
+        }
+        let slice = std::slice::from_raw_parts(ptr.cast::<u8>(), size);
+        let blob = slice.to_vec();
+        let _ = GlobalUnlock(hglobal); // best-effort; lock count drops to 0
+        Ok(blob)
+    }
+}

rust/crates/mxaccess-callback/src/exporter.rs

@@ -210,9 +210,13 @@ impl CallbackExporter {
     /// Build a callback OBJREF to publish back to the AVEVA service.
     ///
     /// Mirrors `ManagedCallbackExporter.CreateCallbackObjRef`
-    /// (`cs:44-54`): the IID is `INmxSvcCallback`, `std_flags = 0x280`,
+    /// (`cs:44-54`): the IID is `INmxSvcCallback`,
     /// `public_refs = 5`, OXID/OID/IPID come from `self.identities`, and
     /// the single string binding is `"<hostname>[<port>]"`.
+    ///
+    /// `std_flags = 0x280` — `SORF_OXRES4 | SORF_OXRES6` (= `0x80 |
+    /// 0x200`). Mirrors the .NET reference's `ManagedCallbackExporter`
+    /// (`cs:48`).
     #[must_use]
     pub fn create_callback_objref(&self, hostname: &str) -> Vec<u8> {
         let binding = format!("{hostname}[{port}]", port = self.local_addr.port());

rust/crates/mxaccess-callback/src/lib.rs

@@ -12,8 +12,23 @@
 //! Plus the `IRemUnknown::RemQueryInterface` handler that completes the
 //! server-side handshake against our exported OBJREF (DoD condition for M2).
 
-#![forbid(unsafe_code)]
+// `forbid(unsafe_code)` lifted: the F55 / Path A `dcom_sink` module
+// (gated behind `windows-com`) implements an `INmxSvcCallback` COM
+// class that must dereference stub-side buffer pointers in
+// `DataReceivedRaw` / `StatusReceivedRaw`. Each unsafe block carries
+// a SAFETY comment documenting the COM stub's buffer-validity
+// contract.
+#![deny(unsafe_op_in_unsafe_fn)]
 
 pub mod exporter;
 
 pub use exporter::{CallbackEvent, CallbackExporter, ExporterIdentities, IUNKNOWN_IID};
+
+/// Path A — DCOM-managed `INmxSvcCallback` sink. Required because
+/// NmxSvc rejects hand-rolled OBJREFs from [`exporter::CallbackExporter`]
+/// with `RPC_S_SERVER_UNAVAILABLE` (1722) on RegisterEngine2 — see F55.
+#[cfg(all(windows, feature = "windows-com"))]
+pub mod dcom_sink;
+
+#[cfg(all(windows, feature = "windows-com"))]
+pub use dcom_sink::{create_dcom_callback_sink_objref, INMX_SVC_CALLBACK_IID};

rust/crates/mxaccess-codec/Cargo.toml

@@ -9,6 +9,7 @@ rust-version.workspace = true
 authors.workspace = true
 
 [dependencies]
+bytes = { workspace = true }
 thiserror = { workspace = true }
 
 [features]

rust/crates/mxaccess-codec/benches/alloc_count.rs

@@ -38,9 +38,9 @@
 use std::alloc::{GlobalAlloc, Layout, System};
 use std::sync::atomic::{AtomicU64, Ordering};
 
+use bytes::BytesMut;
 use mxaccess_codec::{
-    MxReferenceHandle, NmxSubscriptionMessage, write_message,
-    write_message::WriteValue,
+    write_message, write_message::WriteValue, MxReferenceHandle, NmxSubscriptionMessage,
 };
 
 // ---- counting allocator -------------------------------------------------
@@ -203,6 +203,51 @@ fn bench_write_string() -> Row {
     })
 }
 
+// F52.1 — `BytesMut` output. Same alloc count as `encode`; the benefit is
+// downstream zero-copy (consumers can `split_to` / `freeze` without copying
+// the body bytes).
+fn bench_write_int32_bytes_mut() -> Row {
+    let handle = make_handle();
+    let value = WriteValue::Int32(42);
+    measure("write_message::encode_to_bytes_mut (Int32)", 10_000, || {
+        let bytes = write_message::encode_to_bytes_mut(&handle, &value, 0, 0).unwrap();
+        std::hint::black_box(bytes);
+    })
+}
+
+// F52.3 — session-level scratch buffer. The caller supplies a `BytesMut`
+// that is cleared and resized in place, so the body allocation is amortised
+// across a session's writes. Drops the per-write count from 2 → 1 for
+// fixed-width scalars (the remaining alloc is the per-value scratch buffer
+// inside `encode_scalar_value`) and 1 → 0 for Boolean (no scalar scratch).
+fn bench_write_int32_into_pooled() -> Row {
+    let handle = make_handle();
+    let value = WriteValue::Int32(42);
+    let mut buf = BytesMut::new();
+    measure(
+        "write_message::encode_into_bytes_mut (Int32, pooled)",
+        10_000,
+        || {
+            write_message::encode_into_bytes_mut(&handle, &value, 0, 0, &mut buf).unwrap();
+            std::hint::black_box(&buf);
+        },
+    )
+}
+
+fn bench_write_bool_into_pooled() -> Row {
+    let handle = make_handle();
+    let value = WriteValue::Boolean(true);
+    let mut buf = BytesMut::new();
+    measure(
+        "write_message::encode_into_bytes_mut (Boolean, pooled)",
+        10_000,
+        || {
+            write_message::encode_into_bytes_mut(&handle, &value, 0, 0, &mut buf).unwrap();
+            std::hint::black_box(&buf);
+        },
+    )
+}
+
 fn bench_subscription_decode() -> Row {
     // Build a single-record DataUpdate body once; decode N times.
     let body = build_data_update_int32_body(42);
@@ -218,19 +263,9 @@ fn bench_subscription_decode() -> Row {
 
 fn bench_handle_from_names() -> Row {
     measure("MxReferenceHandle::from_names", 10_000, || {
-        let h = MxReferenceHandle::from_names(
-            0,
-            1,
-            2,
-            3,
-            "TestChildObject",
-            0,
-            1,
-            0,
-            "TestInt",
-            false,
-        )
-        .unwrap();
+        let h =
+            MxReferenceHandle::from_names(0, 1, 2, 3, "TestChildObject", 0, 1, 0, "TestInt", false)
+                .unwrap();
         std::hint::black_box(h);
     })
 }
@@ -273,6 +308,9 @@ fn main() {
         bench_write_double(),
         bench_write_bool(),
         bench_write_string(),
+        bench_write_int32_bytes_mut(),
+        bench_write_int32_into_pooled(),
+        bench_write_bool_into_pooled(),
         bench_handle_from_names(),
         bench_subscription_decode(),
     ];

rust/crates/mxaccess-codec/src/operation_status.rs

@@ -21,11 +21,33 @@
 //! [`NmxOperationStatusMessage::try_parse_inner`] is provided here. When
 //! `NmxObservedEnvelope` lands, add `try_parse_process_data_received_body` as
 //! a thin wrapper.
+//!
+//! ## Typed promotion and the synthesizer kernel
+//!
+//! [`NmxOperationStatusMessage::promote_to_typed`] returns the same
+//! [`MxStatus`] the parser already attached to the message — the
+//! verbatim-preserve placeholder for unknown shapes, the
+//! [`MxStatus::WRITE_COMPLETE_OK`] sentinel for the proven
+//! `(status_code=0x8050, completion_code=0x00)` shape. The 5-byte
+//! `00 00 SS SS CC` inner body is **not** the same wire field as the
+//! 4-byte packed status word `Lmx.dll!FUN_10100ce0` decodes
+//! ([`MxStatus::from_packed_u32`]) — that kernel applies one layer up,
+//! to the `INmxService.GetResponse2` payload's `status: i32` field
+//! (carried e.g. in subscription records). See
+//! `analysis/ghidra/exports/Lmx.dll.synthesizer-helpers2-decompile.md`
+//! and `design/70-risks-and-open-questions.md` R3/R4 Path A for the
+//! evidence chain.
+//!
+//! `promote_to_typed` is therefore a thin convenience over the existing
+//! `status` field: callers that want the canonical bit-layout decoder
+//! should reach for [`MxStatus::from_packed_u32`] directly when they
+//! have a 4-byte packed value in hand.
 
 // Direct byte indexing — see reference_handle.rs for rationale.
 #![allow(clippy::indexing_slicing)]
 
 use crate::error::CodecError;
+use crate::observed_frame::NmxObservedEnvelope;
 use crate::status::{MxStatus, MxStatusCategory, MxStatusSource};
 
 /// Which of the two recognised inner-frame shapes was decoded
@@ -78,6 +100,47 @@ impl NmxOperationStatusMessage {
             && self.completion_code == 0x00
     }
 
+    /// Return the typed [`MxStatus`] for this frame.
+    ///
+    /// This is a thin convenience over [`Self::status`] — same value,
+    /// no transformation. Provided for API symmetry with
+    /// [`MxStatus::from_packed_u32`] (the canonical 4-byte synthesizer
+    /// kernel) and to give consumers a single entry point that can
+    /// be extended in future revisions if new evidence pins additional
+    /// `(status_code, completion_code)` shapes.
+    ///
+    /// **What this method does NOT do:** apply the
+    /// `Lmx.dll!FUN_10100ce0` synthesizer to the 5-byte inner body.
+    /// The 5-byte `00 00 SS SS CC` shape and the 4-byte packed-u32
+    /// shape are different wire fields at different layers — see the
+    /// module docs and
+    /// `design/70-risks-and-open-questions.md` R3/R4 Path A. Callers
+    /// holding a 4-byte packed `MxStatus` (e.g. extracted from a
+    /// subscription record's `status: i32`) should call
+    /// [`MxStatus::from_packed_u32`] directly.
+    #[must_use]
+    pub const fn promote_to_typed(&self) -> MxStatus {
+        self.status
+    }
+
+    /// Peel the outer [`NmxObservedEnvelope`] off a `ProcessDataReceived`
+    /// payload and parse the inner body. Mirrors
+    /// `NmxOperationStatusMessage.TryParseProcessDataReceivedBody`
+    /// (`NmxOperationStatusMessage.cs:20-32`).
+    ///
+    /// # Errors
+    ///
+    /// Returns `Err` when the outer envelope cannot be parsed or the
+    /// inner body matches no recognised shape (1- or 5-byte completion
+    /// frame). The .NET reference returns `false` and a `null!`
+    /// out-param in both cases; the Rust port surfaces a typed
+    /// [`CodecError`] so callers can distinguish "not a process-data
+    /// frame" from "successfully parsed".
+    pub fn try_parse_process_data_received_body(body: &[u8]) -> Result<Self, CodecError> {
+        let envelope = NmxObservedEnvelope::parse_process_data_received_body_flexible(body)?;
+        Self::try_parse_inner(&envelope.inner_body)
+    }
+
     /// Parse an inner body — either 1 byte (`CompletionOnly`) or 5 bytes
     /// (`StatusWord` with leading `00 00`).
     ///
@@ -281,4 +344,38 @@ mod tests {
         let msg = NmxOperationStatusMessage::try_parse_inner(&frame).unwrap();
         assert_eq!(msg.status_code, 0xBBAA);
     }
+
+    #[test]
+    fn promote_to_typed_returns_existing_status_for_status_word() {
+        // The proven shape — must keep returning the canonical sentinel.
+        let frame = [0x00, 0x00, 0x50, 0x80, 0x00];
+        let msg = NmxOperationStatusMessage::try_parse_inner(&frame).unwrap();
+        assert_eq!(msg.promote_to_typed(), MxStatus::WRITE_COMPLETE_OK);
+        assert_eq!(msg.promote_to_typed(), msg.status);
+    }
+
+    #[test]
+    fn promote_to_typed_returns_verbatim_status_for_completion_only() {
+        // 1-byte frames: no synthesizer evidence — must stay verbatim.
+        for byte in [0x00_u8, 0x41, 0xEF] {
+            let msg = NmxOperationStatusMessage::try_parse_inner(&[byte]).unwrap();
+            let promoted = msg.promote_to_typed();
+            assert_eq!(promoted, msg.status);
+            assert_eq!(promoted.category, MxStatusCategory::Unknown);
+            assert_eq!(promoted.detected_by, MxStatusSource::Unknown);
+            assert_eq!(promoted.detail, i16::from(byte));
+        }
+    }
+
+    #[test]
+    fn promote_to_typed_does_not_change_existing_status_field() {
+        // promote_to_typed must not mutate the verbatim-preserve `status`
+        // field. This guards the byte-for-byte parity contract with the
+        // .NET reference.
+        let frame = [0x00, 0x00, 0x55, 0xAA, 0x33];
+        let msg = NmxOperationStatusMessage::try_parse_inner(&frame).unwrap();
+        let original_status = msg.status;
+        let _typed = msg.promote_to_typed();
+        assert_eq!(msg.status, original_status);
+    }
 }

rust/crates/mxaccess-codec/src/reference_handle.rs

@@ -10,6 +10,9 @@
 // `.get(n)?` would obscure the byte map.
 #![allow(clippy::indexing_slicing)]
 
+use std::cell::RefCell;
+use std::collections::HashMap;
+
 use crate::error::CodecError;
 
 const CRC16_IBM_POLYNOMIAL: u16 = 0xa001;
@@ -191,6 +194,13 @@ impl MxReferenceHandle {
 /// mappings (e.g. Turkish dotless-i) may diverge — see
 /// `design/10-raw-layer.md` L37 for the path forward via `icu_casemap`.
 ///
+/// **Caching**: Results are memoised in a thread-local
+/// [`HashMap`]<[`String`], `u16`> so repeated calls with the same name (the
+/// hot path inside [`MxReferenceHandle::from_names`] when the same handles
+/// are constructed many times) skip the UTF-16LE conversion and CRC walk.
+/// The cache is bounded ([`SIGNATURE_CACHE_CAP`] entries); on overflow the
+/// thread's cache is cleared. (F52.2 from `design/M6-bench-baseline.md`.)
+///
 /// # Errors
 ///
 /// Returns [`CodecError::InvalidName`] if `name` is empty or whitespace-only.
@@ -198,6 +208,35 @@ pub fn compute_name_signature(name: &str) -> Result<u16, CodecError> {
     if name.trim().is_empty() {
         return Err(CodecError::InvalidName);
     }
+
+    // Fast path: thread-local cache lookup. Repeated calls with the same name
+    // skip the `to_lowercase` allocation entirely.
+    if let Some(cached) = SIGNATURE_CACHE.with(|c| c.borrow().get(name).copied()) {
+        return Ok(cached);
+    }
+
+    let signature = compute_name_signature_uncached(name);
+    SIGNATURE_CACHE.with(|c| {
+        let mut cache = c.borrow_mut();
+        if cache.len() >= SIGNATURE_CACHE_CAP {
+            cache.clear();
+        }
+        cache.insert(name.to_string(), signature);
+    });
+    Ok(signature)
+}
+
+/// Soft cap on the per-thread name → signature cache. Keeps memory bounded
+/// when a workload churns through unique names (e.g. dynamic discovery). On
+/// overflow the cache is cleared rather than evicted LRU — any sane workload
+/// re-fills only the names it actively uses.
+pub const SIGNATURE_CACHE_CAP: usize = 1024;
+
+thread_local! {
+    static SIGNATURE_CACHE: RefCell<HashMap<String, u16>> = RefCell::new(HashMap::new());
+}
+
+fn compute_name_signature_uncached(name: &str) -> u16 {
     let lower = name.to_lowercase();
     let mut crc: u16 = 0;
     for ch in lower.chars() {
@@ -212,7 +251,16 @@ pub fn compute_name_signature(name: &str) -> Result<u16, CodecError> {
             crc = update_crc16_ibm(crc, (*unit >> 8) as u8);
         }
     }
-    Ok(crc)
+    crc
+}
+
+/// Clear the current thread's name → signature cache. Used by tests that
+/// want to measure cold-path behaviour; not exposed publicly because the
+/// cache is otherwise transparent to callers.
+#[cfg(test)]
+#[allow(dead_code)]
+pub(crate) fn clear_signature_cache_for_tests() {
+    SIGNATURE_CACHE.with(|c| c.borrow_mut().clear());
 }
 
 /// One iteration of the CRC-16/IBM update loop (poly `0xa001`, right-shifted
@@ -333,6 +381,34 @@ mod tests {
         assert_eq!(update_crc16_ibm(0, 0), 0);
     }
 
+    /// F52.2 — the thread-local cache must return the same value for cold
+    /// (cache-miss) and hot (cache-hit) calls. Walking the cache twice with
+    /// the same name should be a no-op as far as the result goes.
+    #[test]
+    fn signature_cache_hit_matches_cold_compute() {
+        clear_signature_cache_for_tests();
+        let cold = compute_name_signature("TestObject").unwrap();
+        // Second call should hit the cache.
+        let hot = compute_name_signature("TestObject").unwrap();
+        assert_eq!(cold, hot);
+        // And match the well-known dotnet-parity vector.
+        assert_eq!(cold, 0x0B25);
+    }
+
+    #[test]
+    fn signature_cache_overflow_clears() {
+        clear_signature_cache_for_tests();
+        // Exceed the cap by one to trigger a clear.
+        for i in 0..=SIGNATURE_CACHE_CAP {
+            let name = format!("Tag{i}");
+            compute_name_signature(&name).unwrap();
+        }
+        // After overflow, recompute against a known vector should still
+        // produce the right value (cache hit-or-miss, doesn't matter — the
+        // returned u16 is what we assert on).
+        assert_eq!(compute_name_signature("TestObject").unwrap(), 0x0B25);
+    }
+
     #[test]
     fn round_trip_zero_handle() {
         let handle = MxReferenceHandle::default();

rust/crates/mxaccess-codec/src/reference_registration.rs

@@ -572,6 +572,25 @@ impl NmxReferenceRegistrationResultMessage {
         })
     }
 
+    /// Peel the `ProcessDataReceived` envelope and parse the inner
+    /// `0x11` registration-result body. Mirrors
+    /// `NmxReferenceRegistrationResultMessage.TryParseProcessDataReceivedBody`
+    /// (the wire-side path used by `MxNativeSession.OnCallbackReceived`
+    /// at `cs:582`).
+    ///
+    /// # Errors
+    ///
+    /// - [`CodecError::ShortRead`] / [`CodecError::InnerLengthMismatch`]
+    ///   surfaced from the envelope parse.
+    /// - Any error from [`Self::parse`] on the inner body — including
+    ///   [`CodecError::UnexpectedOpcode`] when the inner body's first
+    ///   byte isn't `0x11` (use this as a discriminator for "this body
+    ///   isn't a registration-result frame").
+    pub fn try_parse_process_data_received_body(body: &[u8]) -> Result<Self, CodecError> {
+        let envelope = crate::NmxObservedEnvelope::parse_process_data_received_body_flexible(body)?;
+        Self::parse(&envelope.inner_body)
+    }
+
     /// Encode the result body. The .NET reference does not provide an
     /// `Encode` (the result is server-emitted); the Rust port supplies one
     /// for round-trip testing and for synthetic-server use cases. The

rust/crates/mxaccess-codec/src/status.rs

@@ -22,7 +22,7 @@ pub enum MxStatusCategory {
 }
 
 impl MxStatusCategory {
-    pub fn from_i16(value: i16) -> Self {
+    pub const fn from_i16(value: i16) -> Self {
         match value {
             0 => Self::Ok,
             1 => Self::Pending,
@@ -37,7 +37,7 @@ impl MxStatusCategory {
         }
     }
 
-    pub fn to_i16(self) -> i16 {
+    pub const fn to_i16(self) -> i16 {
         self as i16
     }
 }
@@ -59,7 +59,7 @@ pub enum MxStatusSource {
 }
 
 impl MxStatusSource {
-    pub fn from_i16(value: i16) -> Self {
+    pub const fn from_i16(value: i16) -> Self {
         match value {
             0 => Self::RequestingLmx,
             1 => Self::RespondingLmx,
@@ -71,7 +71,7 @@ impl MxStatusSource {
         }
     }
 
-    pub fn to_i16(self) -> i16 {
+    pub const fn to_i16(self) -> i16 {
         self as i16
     }
 }
@@ -85,6 +85,135 @@ pub struct MxStatus {
 }
 
 impl MxStatus {
+    /// Decode a 4-byte packed `MxStatus` word.
+    ///
+    /// Mirrors the canonical NMX wire-frame status decoder
+    /// `Lmx.dll!FUN_10100ce0` (see
+    /// `analysis/ghidra/exports/Lmx.dll.synthesizer-helpers2-decompile.md`).
+    /// That function reads 4 bytes from a stream into a u32 and unpacks
+    /// them via the bit layout:
+    ///
+    /// ```text
+    /// bit 31:        success    (-1 if set, 0 if clear)
+    /// bits 27..24:   category   (4 bits, masked by 0xF)
+    /// bits 23..20:   detected_by (4 bits, masked by 0xF)
+    /// bits 15..0:    detail     (i16 — low 16 bits, signed)
+    /// bits 30..28, 19..16: reserved/padding (ignored)
+    /// ```
+    ///
+    /// This is the **synthesizer kernel** documented in
+    /// `design/70-risks-and-open-questions.md` R3/R4 Path A. Every NMX
+    /// wire frame that carries a status word emits one of these 4-byte
+    /// packings; the consumer-side dispatch (retry counters, callback
+    /// fan-out) is layered on top of the decoded `MxStatus`, but the
+    /// decoder itself is byte-deterministic and context-free.
+    ///
+    /// The `success` field is normalized to either `0` or `-1` per the
+    /// native `Lmx.dll` semantics: any value with bit 31 set decodes to
+    /// `-1`, any value with bit 31 clear decodes to `0`. (Native code:
+    /// `*param_1 = -(ushort)(((uint)param_2 & 0x80000000) != 0)`.)
+    ///
+    /// Unknown category / detected_by codes (i.e. a 4-bit value that
+    /// does not match a documented [`MxStatusCategory`] /
+    /// [`MxStatusSource`] variant) decode to the corresponding
+    /// `Unknown` variant. The padding bits are silently discarded.
+    #[must_use]
+    pub const fn from_packed_u32(packed: u32) -> Self {
+        // Bit layout — see fn doc.
+        let success: i16 = if packed & 0x8000_0000 != 0 { -1 } else { 0 };
+        let category_bits = ((packed >> 24) & 0xF) as i16;
+        let detected_by_bits = ((packed >> 20) & 0xF) as i16;
+        let detail = packed as i16;
+        Self {
+            success,
+            category: MxStatusCategory::from_i16(category_bits),
+            detected_by: MxStatusSource::from_i16(detected_by_bits),
+            detail,
+        }
+    }
+
+    /// Construct an `MxStatus` from a single-byte NMX response code.
+    ///
+    /// Mirrors the synthesis switch in
+    /// `Lmx.dll!FUN_1010bd10` (`ScanOnDemandCallback::GetResponse`)
+    /// at lines 741-770 of
+    /// `analysis/ghidra/exports/Lmx.dll.synthesizer-decompile.md`.
+    /// When the NMX `responseCode` is non-zero (no payload status word
+    /// to parse), `Lmx.dll` constructs an `MxStatus` from the response
+    /// code itself using this fixed mapping:
+    ///
+    /// | responseCode | category | detected_by |
+    /// |---|---|---|
+    /// | `0x01`, `0x02` | `CommunicationError` | `RequestingNmx` |
+    /// | `0x03` | `ConfigurationError` | `RequestingNmx` |
+    /// | `0x04` | `ConfigurationError` | `RespondingNmx` |
+    /// | `0x05` | `CommunicationError` | `RespondingNmx` |
+    /// | `0x1A` | `CommunicationError` | `RequestingNmx` |
+    ///
+    /// `success` is `0` (not `-1`) and `detail` carries the response
+    /// code unchanged. Unmapped codes return `None` — the native code's
+    /// `default` branch leaves the synthesized status untouched, so the
+    /// caller falls back to a verbatim raw-byte placeholder per
+    /// `design/70-risks-and-open-questions.md` R3/R4.
+    ///
+    /// This is **not** the same wire field as the 1-byte completion
+    /// frames `0x00`/`0x41`/`0xEF` parsed by
+    /// [`crate::NmxOperationStatusMessage::try_parse_inner`]: those
+    /// live inside a `0x32`/`0x33` callback body, while this
+    /// `responseCode` is the second `out` parameter of
+    /// `INmxService.GetResponse2(...)` (one layer up the stack).
+    /// `Lmx.dll`'s decoder for the 1-byte completion frames does not
+    /// apply this synthesis.
+    #[must_use]
+    pub const fn from_nmx_response_code(response_code: u8) -> Option<Self> {
+        // Per `FUN_1010bd10:741-770` switch.
+        let (category, detected_by) = match response_code {
+            0x01 | 0x02 => (
+                MxStatusCategory::CommunicationError,
+                MxStatusSource::RequestingNmx,
+            ),
+            0x03 => (
+                MxStatusCategory::ConfigurationError,
+                MxStatusSource::RequestingNmx,
+            ),
+            0x04 => (
+                MxStatusCategory::ConfigurationError,
+                MxStatusSource::RespondingNmx,
+            ),
+            0x05 => (
+                MxStatusCategory::CommunicationError,
+                MxStatusSource::RespondingNmx,
+            ),
+            0x1A => (
+                MxStatusCategory::CommunicationError,
+                MxStatusSource::RequestingNmx,
+            ),
+            _ => return None,
+        };
+        Some(Self {
+            success: 0,
+            category,
+            detected_by,
+            detail: response_code as i16,
+        })
+    }
+
+    /// Pack `self` back into the 4-byte NMX wire layout. Inverse of
+    /// [`Self::from_packed_u32`]. Useful for round-trip tests and
+    /// future encoder paths.
+    ///
+    /// Padding bits (30..28, 19..16) are emitted as zero. Bit 31 mirrors
+    /// `success != 0` — any non-zero `success` round-trips to `-1`
+    /// because the decoder normalizes to `0`/`-1` only.
+    #[must_use]
+    pub const fn to_packed_u32(self) -> u32 {
+        let success_bit: u32 = if self.success != 0 { 0x8000_0000 } else { 0 };
+        let category_bits = ((self.category as i16) as u32 & 0xF) << 24;
+        let detected_by_bits = ((self.detected_by as i16) as u32 & 0xF) << 20;
+        let detail_bits = (self.detail as u16) as u32;
+        success_bit | category_bits | detected_by_bits | detail_bits
+    }
+
     /// `(success=-1, Ok, RequestingLmx, detail=0)` — `MxStatus.DataChangeOk`
     /// from `MxStatus.cs:36-40`.
     pub const DATA_CHANGE_OK: Self = Self {
@@ -311,4 +440,199 @@ mod tests {
         assert!(!MxStatus::SUSPEND_PENDING.is_ok());
         assert!(!MxStatus::INVALID_REFERENCE_CONFIGURATION.is_ok());
     }
+
+    #[test]
+    fn from_packed_u32_zero_decodes_to_all_zeros() {
+        // packed=0 → success=0, category=Ok(0), detected_by=RequestingLmx(0), detail=0.
+        // The "all zeros" status is the simplest data-change-pending shape
+        // the wire can carry.
+        let s = MxStatus::from_packed_u32(0);
+        assert_eq!(s.success, 0);
+        assert_eq!(s.category, MxStatusCategory::Ok);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingLmx);
+        assert_eq!(s.detail, 0);
+    }
+
+    #[test]
+    fn from_packed_u32_high_bit_sets_success_to_negative_one() {
+        // Native: `*param_1 = -(ushort)(((uint)param_2 & 0x80000000) != 0)`
+        // For packed=0x80000000, success=-1, all other fields 0.
+        let s = MxStatus::from_packed_u32(0x8000_0000);
+        assert_eq!(s.success, -1);
+        assert_eq!(s.category, MxStatusCategory::Ok);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingLmx);
+        assert_eq!(s.detail, 0);
+    }
+
+    #[test]
+    fn from_packed_u32_decodes_data_change_ok_layout() {
+        // `MxStatus::DATA_CHANGE_OK` = (success=-1, Ok=0, RequestingLmx=0,
+        // detail=0). Pack: bit31=1, bits27..24=0, bits23..20=0, bits15..0=0.
+        // → 0x80000000.
+        let packed = MxStatus::DATA_CHANGE_OK.to_packed_u32();
+        assert_eq!(packed, 0x8000_0000);
+        let round_trip = MxStatus::from_packed_u32(packed);
+        assert_eq!(round_trip, MxStatus::DATA_CHANGE_OK);
+    }
+
+    #[test]
+    fn from_packed_u32_decodes_write_complete_ok_layout() {
+        // `MxStatus::WRITE_COMPLETE_OK` = (success=-1, Ok=0,
+        // RespondingAutomationObject=5, detail=0). Pack: bit31=1,
+        // bits27..24=0 (Ok), bits23..20=5, bits15..0=0.
+        // → 0x80500000.
+        let expected_packed: u32 = 0x80_50_00_00;
+        let s = MxStatus::from_packed_u32(expected_packed);
+        assert_eq!(s, MxStatus::WRITE_COMPLETE_OK);
+        assert_eq!(MxStatus::WRITE_COMPLETE_OK.to_packed_u32(), expected_packed);
+    }
+
+    #[test]
+    fn from_packed_u32_extracts_category_from_bits_24_to_27() {
+        // category=4 (ConfigurationError) at bits 24..27.
+        // → 0x04000000.
+        let s = MxStatus::from_packed_u32(0x0400_0000);
+        assert_eq!(s.category, MxStatusCategory::ConfigurationError);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingLmx);
+        assert_eq!(s.detail, 0);
+    }
+
+    #[test]
+    fn from_packed_u32_extracts_detected_by_from_bits_20_to_23() {
+        // detected_by=2 (RequestingNmx) at bits 20..23.
+        // → 0x00200000.
+        let s = MxStatus::from_packed_u32(0x0020_0000);
+        assert_eq!(s.category, MxStatusCategory::Ok);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingNmx);
+        assert_eq!(s.detail, 0);
+    }
+
+    #[test]
+    fn from_packed_u32_extracts_detail_as_signed_low_16_bits() {
+        // detail=21 ("Invalid reference") at bits 0..15.
+        // → 0x00000015.
+        let s = MxStatus::from_packed_u32(0x0000_0015);
+        assert_eq!(s.detail, 21);
+        assert_eq!(s.detail_text(), Some("Invalid reference"));
+
+        // Negative detail — high bit of low-16 set: 0xFFFF → -1.
+        let s = MxStatus::from_packed_u32(0x0000_FFFF);
+        assert_eq!(s.detail, -1);
+    }
+
+    #[test]
+    fn from_packed_u32_padding_bits_are_ignored() {
+        // Bits 30..28 and 19..16 are padding/reserved per `FUN_10100ce0`.
+        // Setting them should not affect any decoded field.
+        //   bit 31: success
+        //   bits 30..28: padding (0x70_00_00_00)
+        //   bits 27..24: category
+        //   bits 23..20: detected_by
+        //   bits 19..16: padding (0x00_0F_00_00)
+        //   bits 15..0:  detail
+        // Padding-only mask: 0x70_00_00_00 | 0x00_0F_00_00 = 0x700F_0000.
+        let with_padding = MxStatus::from_packed_u32(0x700F_0000);
+        let without_padding = MxStatus::from_packed_u32(0x0000_0000);
+        assert_eq!(with_padding, without_padding);
+    }
+
+    #[test]
+    fn from_packed_u32_unknown_category_decodes_to_unknown_variant() {
+        // Category bits = 0xF (not a defined variant).
+        // → 0x0F000000.
+        let s = MxStatus::from_packed_u32(0x0F00_0000);
+        assert_eq!(s.category, MxStatusCategory::Unknown);
+    }
+
+    #[test]
+    fn from_packed_u32_unknown_detected_by_decodes_to_unknown_variant() {
+        // detected_by bits = 0xF (not a defined variant).
+        // → 0x00F00000.
+        let s = MxStatus::from_packed_u32(0x00F0_0000);
+        assert_eq!(s.detected_by, MxStatusSource::Unknown);
+    }
+
+    #[test]
+    fn round_trip_canonical_sentinels() {
+        // Every canonical sentinel must round-trip through pack→decode.
+        for &expected in &[
+            MxStatus::DATA_CHANGE_OK,
+            MxStatus::WRITE_COMPLETE_OK,
+            MxStatus::ACTIVATE_OK,
+            // SuspendPending: detail=0, success=-1, Pending=1, RequestingLmx=0.
+            // → 0x81000000.
+            MxStatus::SUSPEND_PENDING,
+            // InvalidReferenceConfiguration: success=0, ConfigError=4,
+            // RequestingLmx=0, detail=6. → 0x04000006.
+            MxStatus::INVALID_REFERENCE_CONFIGURATION,
+        ] {
+            let packed = expected.to_packed_u32();
+            let round_trip = MxStatus::from_packed_u32(packed);
+            assert_eq!(round_trip, expected, "round-trip failed for {expected:?}");
+        }
+    }
+
+    #[test]
+    fn from_nmx_response_code_proven_mappings() {
+        // Per `FUN_1010bd10:741-770` switch.
+        // 0x01, 0x02 → CommunicationError + RequestingNmx
+        for code in [0x01_u8, 0x02] {
+            let s = MxStatus::from_nmx_response_code(code).unwrap();
+            assert_eq!(s.success, 0);
+            assert_eq!(s.category, MxStatusCategory::CommunicationError);
+            assert_eq!(s.detected_by, MxStatusSource::RequestingNmx);
+            assert_eq!(s.detail, i16::from(code));
+        }
+
+        // 0x03 → ConfigurationError + RequestingNmx
+        let s = MxStatus::from_nmx_response_code(0x03).unwrap();
+        assert_eq!(s.category, MxStatusCategory::ConfigurationError);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingNmx);
+        assert_eq!(s.detail, 3);
+
+        // 0x04 → ConfigurationError + RespondingNmx
+        let s = MxStatus::from_nmx_response_code(0x04).unwrap();
+        assert_eq!(s.category, MxStatusCategory::ConfigurationError);
+        assert_eq!(s.detected_by, MxStatusSource::RespondingNmx);
+        assert_eq!(s.detail, 4);
+
+        // 0x05 → CommunicationError + RespondingNmx
+        let s = MxStatus::from_nmx_response_code(0x05).unwrap();
+        assert_eq!(s.category, MxStatusCategory::CommunicationError);
+        assert_eq!(s.detected_by, MxStatusSource::RespondingNmx);
+        assert_eq!(s.detail, 5);
+
+        // 0x1A → CommunicationError + RequestingNmx
+        let s = MxStatus::from_nmx_response_code(0x1A).unwrap();
+        assert_eq!(s.category, MxStatusCategory::CommunicationError);
+        assert_eq!(s.detected_by, MxStatusSource::RequestingNmx);
+        assert_eq!(s.detail, 0x1A);
+    }
+
+    #[test]
+    fn from_nmx_response_code_unmapped_returns_none() {
+        // Codes outside the proven {1,2,3,4,5,0x1a} set return None — the
+        // native code falls through `default` and leaves the synthesized
+        // status untouched. Per `design/70-risks-and-open-questions.md`
+        // R3/R4 the consumer must preserve the raw byte verbatim.
+        for code in [0x00_u8, 0x06, 0x10, 0x19, 0x1B, 0x41, 0xEF, 0xFF] {
+            assert!(
+                MxStatus::from_nmx_response_code(code).is_none(),
+                "response code 0x{code:02X} should be unmapped"
+            );
+        }
+    }
+
+    #[test]
+    fn to_packed_u32_normalizes_arbitrary_success_to_high_bit_only() {
+        // The decoder produces `success ∈ {0, -1}`, so `to_packed_u32`
+        // only checks `success != 0` — the actual integer doesn't
+        // matter beyond zero/non-zero.
+        let mut s = MxStatus::DATA_CHANGE_OK;
+        s.success = 42; // Non-canonical value.
+        let packed = s.to_packed_u32();
+        assert_eq!(packed & 0x8000_0000, 0x8000_0000);
+        // Round-trip normalizes to -1.
+        assert_eq!(MxStatus::from_packed_u32(packed).success, -1);
+    }
 }

rust/crates/mxaccess-codec/src/subscription_message.rs

@@ -215,6 +215,29 @@ impl NmxSubscriptionMessage {
             _ => Err(CodecError::UnexpectedOpcode(command)),
         }
     }
+
+    /// Peel the `ProcessDataReceived` envelope and parse the inner
+    /// subscription body. Mirrors the .NET reference's
+    /// `NmxSubscriptionMessage.ParseProcessDataReceivedBody`
+    /// (the wire-side path used by `MxNativeSession.OnCallbackReceived`
+    /// at `cs:593`).
+    ///
+    /// Inbound NMX callbacks arrive as a wire envelope (46-byte header,
+    /// optionally with a 4-byte total-length prefix), inside which sits
+    /// the 23-byte preamble + records body that
+    /// [`Self::parse_inner`] knows how to decode. Calling `parse_inner`
+    /// directly on the wire bytes — which the router used to do — would
+    /// fail because the first 46 bytes are envelope, not preamble.
+    ///
+    /// # Errors
+    ///
+    /// - [`CodecError::ShortRead`] / [`CodecError::InnerLengthMismatch`]
+    ///   surfaced from the envelope parse.
+    /// - Any error from [`Self::parse_inner`] on the inner body.
+    pub fn try_parse_process_data_received_body(body: &[u8]) -> Result<Self, CodecError> {
+        let envelope = crate::NmxObservedEnvelope::parse_process_data_received_body_flexible(body)?;
+        Self::parse_inner(&envelope.inner_body)
+    }
 }
 
 /// `0x33` DataUpdate. Mirrors `NmxSubscriptionMessage.ParseDataUpdate`

rust/crates/mxaccess-codec/src/write_message.rs

@@ -88,8 +88,10 @@
 // Direct byte indexing — see reference_handle.rs / envelope.rs for rationale.
 #![allow(clippy::indexing_slicing)]
 
-use crate::MxReferenceHandle;
+use bytes::BytesMut;
+
 use crate::error::CodecError;
+use crate::MxReferenceHandle;
 
 /// Normal-write opcode (`NmxWriteMessage.cs:9`).
 pub const COMMAND: u8 = 0x37;
@@ -253,6 +255,50 @@ pub fn encode(
     encode_inner(handle, value, write_index, client_token, None)
 }
 
+/// Encode a normal write body (`0x37`) into a freshly-allocated [`BytesMut`].
+///
+/// Equivalent to [`encode`] but returns a `BytesMut` so the caller can
+/// `split_to(n)` / `freeze()` and forward to a wire-level sink without an
+/// intermediate copy. Allocation count is identical to [`encode`]; the
+/// benefit is downstream zero-copy. (F52.1 from `design/M6-bench-baseline.md`.)
+///
+/// # Errors
+///
+/// See [`encode`].
+pub fn encode_to_bytes_mut(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    write_index: i32,
+    client_token: u32,
+) -> Result<BytesMut, CodecError> {
+    let mut dst = BytesMut::new();
+    encode_inner_into(handle, value, write_index, client_token, None, &mut dst)?;
+    Ok(dst)
+}
+
+/// Encode a normal write body (`0x37`) into a caller-supplied [`BytesMut`]
+/// scratch buffer. Clears `dst` first, resizes it to fit the body, and fills
+/// it via the standard codec path.
+///
+/// Reusing the same `dst` across writes amortises the body allocation and
+/// drops per-write alloc count from 2 → 1 for fixed-width scalars (and 1 → 0
+/// for Boolean) once the buffer is sized for the largest body the session
+/// will produce. (F52.3 session scratch pool from
+/// `design/M6-bench-baseline.md`.)
+///
+/// # Errors
+///
+/// See [`encode`].
+pub fn encode_into_bytes_mut(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    write_index: i32,
+    client_token: u32,
+    dst: &mut BytesMut,
+) -> Result<(), CodecError> {
+    encode_inner_into(handle, value, write_index, client_token, None, dst)
+}
+
 /// Encode a `Write2` (timestamped) body. Mirrors `NmxWriteMessage.EncodeTimestamped`
 /// (`NmxWriteMessage.cs:36-56`).
 ///
@@ -279,6 +325,53 @@ pub fn encode_timestamped(
     )
 }
 
+/// `Write2` (timestamped) variant of [`encode_to_bytes_mut`].
+///
+/// # Errors
+///
+/// See [`encode`].
+pub fn encode_timestamped_to_bytes_mut(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    timestamp_filetime: i64,
+    write_index: i32,
+    client_token: u32,
+) -> Result<BytesMut, CodecError> {
+    let mut dst = BytesMut::new();
+    encode_inner_into(
+        handle,
+        value,
+        write_index,
+        client_token,
+        Some(timestamp_filetime),
+        &mut dst,
+    )?;
+    Ok(dst)
+}
+
+/// `Write2` (timestamped) variant of [`encode_into_bytes_mut`].
+///
+/// # Errors
+///
+/// See [`encode`].
+pub fn encode_timestamped_into_bytes_mut(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    timestamp_filetime: i64,
+    write_index: i32,
+    client_token: u32,
+    dst: &mut BytesMut,
+) -> Result<(), CodecError> {
+    encode_inner_into(
+        handle,
+        value,
+        write_index,
+        client_token,
+        Some(timestamp_filetime),
+        dst,
+    )
+}
+
 fn encode_inner(
     handle: &MxReferenceHandle,
     value: &WriteValue,
@@ -286,54 +379,82 @@ fn encode_inner(
     client_token: u32,
     timestamp: Option<i64>,
 ) -> Result<Vec<u8>, CodecError> {
+    let mut buf = Vec::new();
+    write_body_into_vec(
+        handle,
+        value,
+        write_index,
+        client_token,
+        timestamp,
+        &mut buf,
+    )?;
+    Ok(buf)
+}
+
+fn encode_inner_into(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    write_index: i32,
+    client_token: u32,
+    timestamp: Option<i64>,
+    dst: &mut BytesMut,
+) -> Result<(), CodecError> {
+    write_body_into_bytes_mut(handle, value, write_index, client_token, timestamp, dst)
+}
+
+/// Resize `dst` (a `Vec<u8>`) to the encoded body size and fill it. Used by
+/// the [`encode`] path so the existing `Vec<u8>`-returning surface is one
+/// allocation regardless of how the body is built downstream.
+fn write_body_into_vec(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    write_index: i32,
+    client_token: u32,
+    timestamp: Option<i64>,
+    dst: &mut Vec<u8>,
+) -> Result<(), CodecError> {
     let kind = value.kind();
     match value {
-        WriteValue::Boolean(b) => Ok(encode_boolean(
-            handle,
-            *b,
-            write_index,
-            client_token,
-            timestamp,
-        )),
+        WriteValue::Boolean(b) => {
+            let size = boolean_body_size(timestamp);
+            resize_vec(dst, size);
+            write_boolean_body(handle, *b, write_index, client_token, timestamp, dst);
+        }
         WriteValue::Int32(_) | WriteValue::Float32(_) | WriteValue::Float64(_) => {
             let value_bytes = encode_scalar_value(value);
-            Ok(encode_fixed(
+            let size = fixed_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_fixed_body(
                 handle,
                 kind,
                 &value_bytes,
                 write_index,
                 client_token,
                 timestamp,
-            ))
+                dst,
+            );
         }
-        WriteValue::String(s) => {
+        WriteValue::String(s) | WriteValue::DateTime(s) => {
             let value_bytes = encode_utf16_string(s);
-            Ok(encode_variable(
+            let size = variable_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_variable_body(
                 handle,
                 kind,
                 &value_bytes,
                 write_index,
                 client_token,
                 timestamp,
-            ))
-        }
-        WriteValue::DateTime(s) => {
-            // Caller pre-formats DateTime (see `WriteValue::DateTime` doc).
-            let value_bytes = encode_utf16_string(s);
-            Ok(encode_variable(
-                handle,
-                kind,
-                &value_bytes,
-                write_index,
-                client_token,
-                timestamp,
-            ))
+                dst,
+            );
         }
         WriteValue::BooleanArray(arr) => {
             let count = value.array_count().ok_or_else(array_too_large)?;
             let element_width = kind.array_element_width().unwrap_or(2);
             let value_bytes = encode_boolean_array(arr);
-            Ok(encode_array(
+            let size = array_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_array_body(
                 handle,
                 kind,
                 &value_bytes,
@@ -342,13 +463,16 @@ fn encode_inner(
                 write_index,
                 client_token,
                 timestamp,
-            ))
+                dst,
+            );
         }
         WriteValue::Int32Array(arr) => {
             let count = value.array_count().ok_or_else(array_too_large)?;
             let element_width = kind.array_element_width().unwrap_or(4);
             let value_bytes = encode_i32_array(arr);
-            Ok(encode_array(
+            let size = array_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_array_body(
                 handle,
                 kind,
                 &value_bytes,
@@ -357,13 +481,16 @@ fn encode_inner(
                 write_index,
                 client_token,
                 timestamp,
-            ))
+                dst,
+            );
         }
         WriteValue::Float32Array(arr) => {
             let count = value.array_count().ok_or_else(array_too_large)?;
             let element_width = kind.array_element_width().unwrap_or(4);
             let value_bytes = encode_f32_array(arr);
-            Ok(encode_array(
+            let size = array_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_array_body(
                 handle,
                 kind,
                 &value_bytes,
@@ -372,13 +499,16 @@ fn encode_inner(
                 write_index,
                 client_token,
                 timestamp,
-            ))
+                dst,
+            );
         }
         WriteValue::Float64Array(arr) => {
             let count = value.array_count().ok_or_else(array_too_large)?;
             let element_width = kind.array_element_width().unwrap_or(8);
             let value_bytes = encode_f64_array(arr);
-            Ok(encode_array(
+            let size = array_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_array_body(
                 handle,
                 kind,
                 &value_bytes,
@@ -387,13 +517,16 @@ fn encode_inner(
                 write_index,
                 client_token,
                 timestamp,
-            ))
+                dst,
+            );
         }
-        WriteValue::StringArray(arr) => {
+        WriteValue::StringArray(arr) | WriteValue::DateTimeArray(arr) => {
             let count = value.array_count().ok_or_else(array_too_large)?;
             // Variable arrays hard-code element_width = 4 (`NmxWriteMessage.cs:30, 52`).
             let value_bytes = encode_variable_array(arr.iter().map(String::as_str));
-            Ok(encode_array(
+            let size = array_body_size(value_bytes.len());
+            resize_vec(dst, size);
+            write_array_body(
                 handle,
                 kind,
                 &value_bytes,
@@ -402,23 +535,162 @@ fn encode_inner(
                 write_index,
                 client_token,
                 timestamp,
-            ))
-        }
-        WriteValue::DateTimeArray(arr) => {
-            let count = value.array_count().ok_or_else(array_too_large)?;
-            let value_bytes = encode_variable_array(arr.iter().map(String::as_str));
-            Ok(encode_array(
-                handle,
-                kind,
-                &value_bytes,
-                count,
-                4,
-                write_index,
-                client_token,
-                timestamp,
-            ))
+                dst,
+            );
         }
     }
+    Ok(())
+}
+
+/// `BytesMut` mirror of [`write_body_into_vec`]. Same body content; the only
+/// difference is the buffer type. Kept as a parallel function rather than
+/// generic over a trait to avoid pulling a trait abstraction into the public
+/// API surface (`cargo public-api` baseline must stay unchanged for F52
+/// per the followup DoD).
+fn write_body_into_bytes_mut(
+    handle: &MxReferenceHandle,
+    value: &WriteValue,
+    write_index: i32,
+    client_token: u32,
+    timestamp: Option<i64>,
+    dst: &mut BytesMut,
+) -> Result<(), CodecError> {
+    let kind = value.kind();
+    match value {
+        WriteValue::Boolean(b) => {
+            let size = boolean_body_size(timestamp);
+            resize_bytes_mut(dst, size);
+            write_boolean_body(handle, *b, write_index, client_token, timestamp, dst);
+        }
+        WriteValue::Int32(_) | WriteValue::Float32(_) | WriteValue::Float64(_) => {
+            let value_bytes = encode_scalar_value(value);
+            let size = fixed_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_fixed_body(
+                handle,
+                kind,
+                &value_bytes,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::String(s) | WriteValue::DateTime(s) => {
+            let value_bytes = encode_utf16_string(s);
+            let size = variable_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_variable_body(
+                handle,
+                kind,
+                &value_bytes,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::BooleanArray(arr) => {
+            let count = value.array_count().ok_or_else(array_too_large)?;
+            let element_width = kind.array_element_width().unwrap_or(2);
+            let value_bytes = encode_boolean_array(arr);
+            let size = array_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_array_body(
+                handle,
+                kind,
+                &value_bytes,
+                count,
+                element_width,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::Int32Array(arr) => {
+            let count = value.array_count().ok_or_else(array_too_large)?;
+            let element_width = kind.array_element_width().unwrap_or(4);
+            let value_bytes = encode_i32_array(arr);
+            let size = array_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_array_body(
+                handle,
+                kind,
+                &value_bytes,
+                count,
+                element_width,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::Float32Array(arr) => {
+            let count = value.array_count().ok_or_else(array_too_large)?;
+            let element_width = kind.array_element_width().unwrap_or(4);
+            let value_bytes = encode_f32_array(arr);
+            let size = array_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_array_body(
+                handle,
+                kind,
+                &value_bytes,
+                count,
+                element_width,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::Float64Array(arr) => {
+            let count = value.array_count().ok_or_else(array_too_large)?;
+            let element_width = kind.array_element_width().unwrap_or(8);
+            let value_bytes = encode_f64_array(arr);
+            let size = array_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_array_body(
+                handle,
+                kind,
+                &value_bytes,
+                count,
+                element_width,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+        WriteValue::StringArray(arr) | WriteValue::DateTimeArray(arr) => {
+            let count = value.array_count().ok_or_else(array_too_large)?;
+            let value_bytes = encode_variable_array(arr.iter().map(String::as_str));
+            let size = array_body_size(value_bytes.len());
+            resize_bytes_mut(dst, size);
+            write_array_body(
+                handle,
+                kind,
+                &value_bytes,
+                count,
+                4,
+                write_index,
+                client_token,
+                timestamp,
+                dst,
+            );
+        }
+    }
+    Ok(())
+}
+
+fn resize_vec(dst: &mut Vec<u8>, size: usize) {
+    dst.clear();
+    dst.resize(size, 0);
+}
+
+fn resize_bytes_mut(dst: &mut BytesMut, size: usize) {
+    dst.clear();
+    dst.resize(size, 0);
 }
 
 fn array_too_large() -> CodecError {
@@ -431,21 +703,53 @@ fn array_too_large() -> CodecError {
 
 // ---- Body builders --------------------------------------------------------
 
+// All builders below assume `body` is a pre-sized, zero-initialised slice
+// (the dispatcher resizes the destination buffer up front). They are
+// allocation-free; the only allocations on the encode path are (a) the
+// destination buffer itself and (b) the per-value scratch buffer (e.g.
+// `encode_scalar_value`). Pulling the size compute out of the builders
+// is what lets F52.3 reuse the destination buffer across writes.
+
+const fn boolean_body_size(timestamp: Option<i64>) -> usize {
+    if timestamp.is_some() {
+        // Timestamped: 1-byte payload + 14-byte timestamped suffix + 4-byte index.
+        KIND_OFFSET + 1 + 1 + 14 + 4
+    } else {
+        // Normal: 4-byte literal payload + 11-byte Boolean suffix + 4-byte index.
+        // Total = 18 + 4 + 11 + 4 = 37 bytes (`NmxWriteMessage.cs:123`).
+        KIND_OFFSET + 1 + 4 + 11 + 4
+    }
+}
+
+const fn fixed_body_size(value_bytes_len: usize) -> usize {
+    KIND_OFFSET + 1 + value_bytes_len + 14 + 4
+}
+
+const fn variable_body_size(value_bytes_len: usize) -> usize {
+    // body alloc = 18 + 4 + 4 + N + 14 + 4 = 44 + N.
+    KIND_OFFSET + 1 + 4 + 4 + value_bytes_len + 14 + 4
+}
+
+const fn array_body_size(value_bytes_len: usize) -> usize {
+    // body alloc = 18 + 10 + N + 14 + 4 (`NmxWriteMessage.cs:179, 198`).
+    KIND_OFFSET + 1 + 10 + value_bytes_len + 14 + 4
+}
+
 /// Boolean write body. The normal form uses the 11-byte Boolean suffix
 /// (`NmxWriteMessage.cs:121-128`); the timestamped form uses a single-byte
 /// payload with the 14-byte timestamped suffix (`NmxWriteMessage.cs:130-137`).
-fn encode_boolean(
+fn write_boolean_body(
     handle: &MxReferenceHandle,
     value: bool,
     write_index: i32,
     client_token: u32,
     timestamp: Option<i64>,
-) -> Vec<u8> {
+    body: &mut [u8],
+) {
     if let Some(filetime) = timestamp {
         // Timestamped: 1-byte payload + 14-byte timestamped suffix + 4-byte index.
         // Total = 18 + 1 + 14 + 4 = 37. Same total as normal Boolean.
-        let mut body = vec![0u8; KIND_OFFSET + 1 + 1 + 14 + 4];
-        write_common_prefix(&mut body, handle, WriteValueKind::Boolean);
+        write_common_prefix(body, handle, WriteValueKind::Boolean);
         body[KIND_OFFSET + 1] = if value { 0xff } else { 0x00 };
         write_timestamped_suffix(
             &mut body[KIND_OFFSET + 2..],
@@ -453,35 +757,31 @@ fn encode_boolean(
             write_index,
             client_token,
         );
-        body
     } else {
         // Normal: 4-byte literal payload + 11-byte Boolean suffix + 4-byte index.
-        // Total = 18 + 4 + 11 + 4 = 37 bytes (`NmxWriteMessage.cs:123`).
         let value_bytes = encode_boolean_value(value);
-        let mut body = vec![0u8; KIND_OFFSET + 1 + value_bytes.len() + 11 + 4];
-        write_common_prefix(&mut body, handle, WriteValueKind::Boolean);
+        write_common_prefix(body, handle, WriteValueKind::Boolean);
         body[KIND_OFFSET + 1..KIND_OFFSET + 1 + value_bytes.len()].copy_from_slice(&value_bytes);
         write_boolean_suffix(
             &mut body[KIND_OFFSET + 1 + value_bytes.len()..],
             write_index,
             client_token,
         );
-        body
     }
 }
 
 /// Fixed-size scalar (Int32, Float32, Float64). Mirrors `CreateFixed` /
 /// `CreateFixedTimestamped` (`NmxWriteMessage.cs:112-119, 139-146`).
-fn encode_fixed(
+fn write_fixed_body(
     handle: &MxReferenceHandle,
     kind: WriteValueKind,
     value_bytes: &[u8],
     write_index: i32,
     client_token: u32,
     timestamp: Option<i64>,
-) -> Vec<u8> {
-    let mut body = vec![0u8; KIND_OFFSET + 1 + value_bytes.len() + 14 + 4];
-    write_common_prefix(&mut body, handle, kind);
+    body: &mut [u8],
+) {
+    write_common_prefix(body, handle, kind);
     body[KIND_OFFSET + 1..KIND_OFFSET + 1 + value_bytes.len()].copy_from_slice(value_bytes);
     let suffix_start = KIND_OFFSET + 1 + value_bytes.len();
     match timestamp {
@@ -490,28 +790,26 @@ fn encode_fixed(
         }
         None => write_normal_suffix(&mut body[suffix_start..], write_index, client_token),
     }
-    body
 }
 
 /// Variable-length payload (String, DateTime). Mirrors `CreateVariable` /
 /// `CreateVariableTimestamped` (`NmxWriteMessage.cs:148-168`). Total length
 /// is `44 + utf16_bytes_len`.
-fn encode_variable(
+fn write_variable_body(
     handle: &MxReferenceHandle,
     kind: WriteValueKind,
     value_bytes: &[u8],
     write_index: i32,
     client_token: u32,
     timestamp: Option<i64>,
-) -> Vec<u8> {
-    // body alloc = 18 + 4 + 4 + N + 14 + 4 = 44 + N.
-    let mut body = vec![0u8; KIND_OFFSET + 1 + 4 + 4 + value_bytes.len() + 14 + 4];
-    write_common_prefix(&mut body, handle, kind);
+    body: &mut [u8],
+) {
+    write_common_prefix(body, handle, kind);
     // body[18..22] = outer_length = N + 4 (`NmxWriteMessage.cs:152, 163`)
     let outer_len = (value_bytes.len() as i32).wrapping_add(4);
-    write_i32_le(&mut body, 18, outer_len);
+    write_i32_le(body, 18, outer_len);
     // body[22..26] = inner_length = N (`NmxWriteMessage.cs:153, 164`)
-    write_i32_le(&mut body, 22, value_bytes.len() as i32);
+    write_i32_le(body, 22, value_bytes.len() as i32);
     // body[26..26+N] = payload (`NmxWriteMessage.cs:154, 165`)
     body[26..26 + value_bytes.len()].copy_from_slice(value_bytes);
     let suffix_start = 26 + value_bytes.len();
@@ -521,13 +819,12 @@ fn encode_variable(
         }
         None => write_normal_suffix(&mut body[suffix_start..], write_index, client_token),
     }
-    body
 }
 
 /// Array body. Mirrors `CreateArray` / `CreateArrayTimestamped`
 /// (`NmxWriteMessage.cs:170-205`).
 #[allow(clippy::too_many_arguments)]
-fn encode_array(
+fn write_array_body(
     handle: &MxReferenceHandle,
     kind: WriteValueKind,
     value_bytes: &[u8],
@@ -536,16 +833,15 @@ fn encode_array(
     write_index: i32,
     client_token: u32,
     timestamp: Option<i64>,
-) -> Vec<u8> {
-    // body alloc = 18 + 10 + N + 14 + 4 (`NmxWriteMessage.cs:179, 198`).
-    let mut body = vec![0u8; KIND_OFFSET + 1 + 10 + value_bytes.len() + 14 + 4];
-    write_common_prefix(&mut body, handle, kind);
+    body: &mut [u8],
+) {
+    write_common_prefix(body, handle, kind);
     // body[22..24] = count u16 LE (`NmxWriteMessage.cs:181, 200`).
-    write_u16_le(&mut body, 22, count);
+    write_u16_le(body, 22, count);
     // body[24..26] = element_width u16 LE (`NmxWriteMessage.cs:182, 201`).
-    write_u16_le(&mut body, 24, element_width);
-    // body[18..22] and body[26..28] are zero-initialised by vec! and not
-    // written by the .NET reference either — they remain zero.
+    write_u16_le(body, 24, element_width);
+    // body[18..22] and body[26..28] are zero-initialised by the dispatcher's
+    // resize and not written by the .NET reference either — they remain zero.
     body[28..28 + value_bytes.len()].copy_from_slice(value_bytes);
     let suffix_start = 28 + value_bytes.len();
     match timestamp {
@@ -554,7 +850,6 @@ fn encode_array(
         }
         None => write_normal_suffix(&mut body[suffix_start..], write_index, client_token),
     }
-    body
 }
 
 // ---- Prefix and suffix writers --------------------------------------------
@@ -1578,7 +1873,7 @@ mod tests {
         expected.extend_from_slice(&[0x01, 0x00]); // .cs:210 (version=1)
         expected.extend_from_slice(&projection); // .cs:211
         expected.push(0x01); // .cs:98 Boolean wire kind
-        // Boolean payload literal (.cs:257)
+                             // Boolean payload literal (.cs:257)
         expected.extend_from_slice(&[0xff, 0xff, 0xff, 0x00]);
         // 7-byte zero region of Boolean suffix (.cs:235)
         expected.extend_from_slice(&[0; 7]);

rust/crates/mxaccess-codec/tests/f51_type_matrix_parity.rs

@@ -0,0 +1,105 @@
+//! F51 — round-trip parity for the live ASB type matrix.
+//!
+//! Captured live by `cargo run -p mxaccess --example asb-type-matrix`
+//! with `MX_ASB_DUMP_FIXTURES=...` set. Each fixture file holds the
+//! full `AsbVariant` byte sequence (i32 type_id LE + i32 length LE +
+//! payload bytes) for one tag's read response. The tests below decode
+//! each fixture, re-encode, and assert byte-identical round-trip plus
+//! the expected type_id / length tuple.
+//!
+//! Live-evidence row from the original capture:
+//!
+//! | Tag | type_id | length | payload bytes |
+//! |---|---|---|---|
+//! | TestChangingInt   | 4 (Int32)       | 4  | 4 |
+//! | TestAlarm001      | 17 (Boolean)    | 1  | 1 |
+//! | MachineCode       | 10 (String)     | 30 | 30 |
+//! | TestFloat         | 8 (Float)       | 4  | 4 |
+//! | TestDouble        | 9 (Double)      | 8  | 8 |
+//! | TestDateTime      | 11 (DateTime)   | 8  | 8 |
+//! | TestDuration      | 12 (ElapsedTime)| 8  | 8 |
+//!
+//! Array tags read empty on the live install (no value written yet)
+//! so they're not in this fixture set; their codec round-trip is
+//! covered by `asb_variant`'s existing unit tests with synthetic
+//! payloads.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use mxaccess_codec::AsbVariant;
+
+const FIXTURE_DIR: &str = "tests/fixtures/f51-type-matrix";
+
+fn load_fixture(name: &str) -> Option<Vec<u8>> {
+    let path = format!("{FIXTURE_DIR}/{name}.bin");
+    match std::fs::read(&path) {
+        Ok(bytes) => Some(bytes),
+        Err(_) => {
+            eprintln!(
+                "[skip] fixture {name} not present at {path} — \
+                 capture via `cargo run -p mxaccess --example asb-type-matrix` \
+                 with `MX_ASB_DUMP_FIXTURES={FIXTURE_DIR}` set",
+            );
+            None
+        }
+    }
+}
+
+fn assert_round_trip(fixture: &str, expected_type_id: u16, expected_length: i32) {
+    let Some(bytes) = load_fixture(fixture) else {
+        return;
+    };
+    let (decoded, consumed) = AsbVariant::decode(&bytes)
+        .unwrap_or_else(|e| panic!("decode {fixture}: {e:?}"));
+    assert_eq!(consumed, bytes.len(), "{fixture}: decode consumed != bytes.len()");
+    assert_eq!(decoded.type_id, expected_type_id, "{fixture}: type_id");
+    assert_eq!(decoded.length, expected_length, "{fixture}: length");
+    let re_encoded = decoded.encode();
+    assert_eq!(re_encoded, bytes, "{fixture}: round-trip not byte-identical");
+}
+
+#[test]
+fn int32_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestChangingInt", 4, 4);
+}
+
+#[test]
+fn boolean_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestAlarm001", 17, 1);
+}
+
+#[test]
+fn string_scalar_round_trip() {
+    // length 30 = "TestMachine_001" (15 chars × 2 bytes UTF-16) on a
+    // typical install. Different fixture captures may shift the
+    // length if the MachineCode value differs.
+    let Some(bytes) = load_fixture("TestMachine_001_MachineCode") else {
+        return;
+    };
+    let (decoded, consumed) = AsbVariant::decode(&bytes)
+        .unwrap_or_else(|e| panic!("decode: {e:?}"));
+    assert_eq!(consumed, bytes.len());
+    assert_eq!(decoded.type_id, 10);
+    let re_encoded = decoded.encode();
+    assert_eq!(re_encoded, bytes);
+}
+
+#[test]
+fn float_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestFloat", 8, 4);
+}
+
+#[test]
+fn double_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestDouble", 9, 8);
+}
+
+#[test]
+fn date_time_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestDateTime", 11, 8);
+}
+
+#[test]
+fn elapsed_time_scalar_round_trip() {
+    assert_round_trip("TestMachine_001_TestDuration", 12, 8);
+}

rust/crates/mxaccess-compat/Cargo.toml

@@ -14,9 +14,43 @@ tokio = { workspace = true }
 tokio-stream = { version = "0.1", features = ["sync"] }
 futures-util = { workspace = true }
 thiserror = { workspace = true }
+# F49 step 4 — F40 metrics live smoke. Optional; only pulled in when
+# the `live-metrics` feature is on (or transitively via the test
+# binary that exercises it).
+metrics = { workspace = true, optional = true }
+metrics-exporter-prometheus = { version = "0.16", default-features = false, optional = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "sync", "time"] }
+async-trait = { workspace = true }
+mxaccess-rpc = { path = "../mxaccess-rpc", version = "0.0.0" }
+# F56 — buffered subscribe live test needs real Galaxy DB metadata
+# (engine_id / platform_id / object_id / attribute_id from
+# `dbo.gobject` etc.); the StaticResolver shim used by lmx_write_live
+# was hardcoded to platform_id=1 / engine_id=2 which the engine
+# silently accepts for writes but doesn't dispatch DataUpdate frames
+# against. The buffered live test resolves real IDs via SqlTagResolver.
+mxaccess-galaxy = { path = "../mxaccess-galaxy", version = "0.0.0", features = ["galaxy-resolver"] }
+# F49 step 2 — recovery replay test needs the
+# `mxaccess::RebuildFactory` typedef's NmxClient + the
+# NmxSubscriptionMessage type for the broadcast receiver signature.
+mxaccess-nmx = { path = "../mxaccess-nmx", version = "0.0.0", features = ["windows-com"] }
+mxaccess-codec = { path = "../mxaccess-codec", version = "0.0.0" }
+# Live tests use tracing-subscriber to dump router/dcom_sink trace
+# events on demand (set RUST_LOG=mxaccess=trace,mxaccess_callback=trace).
+tracing = { workspace = true }
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+[features]
+default = []
+# F49 / F54 live test gate. Enables `Session::connect_nmx_auto` for
+# the live integration test at `tests/lmx_write_complete_live.rs`.
+live-windows-com = ["mxaccess/windows-com"]
+# F49 step 4 — F40 metrics live smoke. Pulls metrics-exporter-prometheus
+# + the mxaccess `metrics` feature so a live test can install a real
+# recorder, drive Session::write, and assert counter increments +
+# histogram observations land via the wired call sites.
+live-metrics = ["mxaccess/metrics", "mxaccess/windows-com", "dep:metrics", "dep:metrics-exporter-prometheus"]
 
 [lints]
 workspace = true

rust/crates/mxaccess-compat/src/lib.rs

@@ -50,6 +50,7 @@
 //! live-trigger work.
 
 #![forbid(unsafe_code)]
+#![warn(missing_docs)]
 
 use std::collections::{HashMap, VecDeque};
 use std::pin::Pin;
@@ -59,7 +60,10 @@ use std::task::{Context, Poll};
 use std::time::SystemTime;
 
 use futures_util::{Stream, StreamExt};
-use mxaccess::{DataChange, Error, MxStatus, MxValue, SecurityContext, Session, Subscription};
+use mxaccess::{
+    DataChange, Error, MxStatus, MxValue, OperationKind, OperationStatus, SecurityContext, Session,
+    Subscription,
+};
 use tokio::sync::{Mutex, broadcast};
 use tokio::task::JoinHandle;
 use tokio_stream::wrappers::BroadcastStream;
@@ -70,12 +74,20 @@ use tokio_stream::wrappers::BroadcastStream;
 /// `MxNativeDataChangeEvent` (`MxNativeCompatibilityServer.cs:6-13`).
 #[derive(Debug, Clone)]
 pub struct DataChangeEvent {
+    /// LMX server handle that produced this event.
     pub server_handle: i32,
+    /// Item handle within `server_handle` whose value changed.
     pub item_handle: i32,
+    /// Decoded value payload.
     pub value: MxValue,
+    /// Legacy 16-bit OPC quality.
     pub quality: u16,
+    /// Wire-recorded timestamp (Windows FILETIME-derived).
     pub timestamp: SystemTime,
+    /// Richer category-model status (complements `quality`).
     pub status: MxStatus,
+    /// `true` when the event was emitted while a `recover_connection`
+    /// attempt was in flight.
     pub is_during_recovery: bool,
 }
 
@@ -87,13 +99,21 @@ pub struct DataChangeEvent {
 /// capture proves multi-sample bodies real.
 #[derive(Debug, Clone)]
 pub struct BufferedDataChangeEvent {
+    /// LMX server handle that produced this event.
     pub server_handle: i32,
+    /// Item handle within `server_handle`.
     pub item_handle: i32,
+    /// `MxDataType` discriminator for the carried values.
     pub mx_data_type: i16,
+    /// Sample values — length 1 per R2's single-sample verdict.
     pub values: Vec<MxValue>,
+    /// Per-sample legacy 16-bit OPC qualities. Same length as `values`.
     pub qualities: Vec<u16>,
+    /// Per-sample timestamps. Same length as `values`.
     pub timestamps: Vec<SystemTime>,
+    /// Per-sample richer-category status. Same length as `values`.
     pub statuses: Vec<MxStatus>,
+    /// `true` when the event was emitted during recovery.
     pub is_during_recovery: bool,
 }
 
@@ -101,9 +121,13 @@ pub struct BufferedDataChangeEvent {
 /// `MxNativeWriteCompleteEvent` (`cs:15-19`).
 #[derive(Debug, Clone)]
 pub struct WriteCompleteEvent {
+    /// LMX server handle that issued the original write.
     pub server_handle: i32,
+    /// Item handle the write was targeted at.
     pub item_handle: i32,
+    /// Per-write completion statuses (one per `MXSTATUS_PROXY` slot).
     pub statuses: Vec<MxStatus>,
+    /// `true` when the write completed while recovery was in flight.
     pub is_during_recovery: bool,
 }
 
@@ -114,9 +138,13 @@ pub struct WriteCompleteEvent {
 /// once the trigger is captured.
 #[derive(Debug, Clone)]
 pub struct OperationCompleteEvent {
+    /// LMX server handle the operation belongs to.
     pub server_handle: i32,
+    /// Item handle the operation was targeted at.
     pub item_handle: i32,
+    /// Per-operation statuses.
     pub statuses: Vec<MxStatus>,
+    /// `true` when the event was emitted during recovery.
     pub is_during_recovery: bool,
 }
 
@@ -201,9 +229,36 @@ struct LmxInner {
     /// is in place so consumers can subscribe today; the trigger fires
     /// nothing until a captured byte mapping lands.
     on_operation_complete_tx: broadcast::Sender<OperationCompleteEvent>,
+    /// F54 — `correlation_id → item_handle` map populated by every
+    /// `LmxClient::write*` (alongside the synthetic op-kind so the
+    /// drain task can decide whether to route to `on_write_complete`
+    /// or `on_operation_complete`). Drained one-shot when an operation
+    /// status event arrives carrying a matching `OperationContext`.
+    /// Wrapped in `Arc<Mutex<_>>` so the spawned drain task can hold
+    /// its own reference without keeping a strong handle on the entire
+    /// `LmxInner` (which would otherwise prevent the `Drop` cleanup).
+    correlation_to_item: Arc<Mutex<HashMap<[u8; 16], i32>>>,
+    /// F54 — handle to the fan-out task spawned at construction;
+    /// aborted on `unregister` / drop. `None` for the test backend
+    /// (no underlying session to drain).
+    operation_status_drain: std::sync::Mutex<Option<JoinHandle<()>>>,
     disposed: AtomicBool,
 }
 
+impl Drop for LmxInner {
+    fn drop(&mut self) {
+        // F54: abort the fan-out task on drop so the JoinHandle doesn't
+        // leak when the LmxClient is dropped without an explicit
+        // `unregister` call. Mirrors the existing `subscription_task`
+        // abort pattern at `un_advise`.
+        if let Ok(mut slot) = self.operation_status_drain.lock() {
+            if let Some(h) = slot.take() {
+                h.abort();
+            }
+        }
+    }
+}
+
 impl LmxClient {
     /// `Register(clientName) → hServer` — open a session and return a
     /// facade-owned server handle.
@@ -238,6 +293,31 @@ impl LmxClient {
         let (on_buffered_data_change_tx, _) = broadcast::channel(EVENT_CHANNEL_CAPACITY);
         let (on_write_complete_tx, _) = broadcast::channel(EVENT_CHANNEL_CAPACITY);
         let (on_operation_complete_tx, _) = broadcast::channel(EVENT_CHANNEL_CAPACITY);
+        let correlation_to_item = Arc::new(Mutex::new(HashMap::<[u8; 16], i32>::new()));
+
+        // F54: for the NMX backend, spawn the operation-status drain
+        // task that maps incoming OperationStatus events back to the
+        // item_handle (via `correlation_to_item`) and fans out into the
+        // `on_write_complete` / `on_operation_complete` broadcast
+        // channels. The ASB backend has no operation-status stream
+        // analogue today (R3), so the task is omitted there. The test
+        // backend has no session at all, so it's also omitted.
+        let drain_task = match &backend {
+            Backend::Nmx(session) => {
+                let stream = session.operation_status_stream();
+                let map = Arc::clone(&correlation_to_item);
+                let server_handle = 1;
+                let wc_tx = on_write_complete_tx.clone();
+                let oc_tx = on_operation_complete_tx.clone();
+                Some(tokio::spawn(async move {
+                    operation_status_drain(stream, map, server_handle, wc_tx, oc_tx).await;
+                }))
+            }
+            Backend::Asb(_) => None,
+            #[cfg(test)]
+            Backend::Test => None,
+        };
+
         Self {
             inner: Arc::new(LmxInner {
                 server_handle: 1,
@@ -251,6 +331,8 @@ impl LmxClient {
                 on_buffered_data_change_tx,
                 on_write_complete_tx,
                 on_operation_complete_tx,
+                correlation_to_item,
+                operation_status_drain: std::sync::Mutex::new(drain_task),
                 disposed: AtomicBool::new(false),
             }),
         }
@@ -329,6 +411,12 @@ impl LmxClient {
         }
         drop(items);
         self.inner.users.lock().await.clear();
+        // F54: stop the operation-status drain task too.
+        if let Ok(mut slot) = self.inner.operation_status_drain.lock() {
+            if let Some(h) = slot.take() {
+                h.abort();
+            }
+        }
 
         match &self.inner.backend {
             Backend::Nmx(s) => {
@@ -417,7 +505,9 @@ impl LmxClient {
         self.check_server_handle(h_server)?;
         let (reference, is_buffered) = {
             let items = self.inner.items.lock().await;
-            let item = items.get(&h_item).ok_or_else(|| unknown_item_error(h_item))?;
+            let item = items
+                .get(&h_item)
+                .ok_or_else(|| unknown_item_error(h_item))?;
             if item.subscription_task.is_some() {
                 return Ok(());
             }
@@ -462,7 +552,9 @@ impl LmxClient {
     pub async fn un_advise(&self, h_server: i32, h_item: i32) -> Result<(), Error> {
         self.check_server_handle(h_server)?;
         let mut items = self.inner.items.lock().await;
-        let item = items.get_mut(&h_item).ok_or_else(|| unknown_item_error(h_item))?;
+        let item = items
+            .get_mut(&h_item)
+            .ok_or_else(|| unknown_item_error(h_item))?;
         if let Some(task) = item.subscription_task.take() {
             task.abort();
         }
@@ -474,6 +566,11 @@ impl LmxClient {
     /// `Session::write` does not expose a per-write user id; it uses
     /// the engine identity). Use [`Self::write_secured_2`] for
     /// user-attributed writes.
+    ///
+    /// F54: returns `Ok(())` once the wire write succeeds; the caller
+    /// can drain [`Self::on_write_complete`] to observe the matching
+    /// `OnWriteComplete` event when its operation-status frame
+    /// arrives.
     pub async fn write(
         &self,
         h_server: i32,
@@ -484,7 +581,17 @@ impl LmxClient {
         self.check_server_handle(h_server)?;
         let reference = self.item_reference(h_item).await?;
         let session = self.nmx_session()?;
-        session.write(&reference, value).await
+        // F54: register correlation_id → item_handle BEFORE dispatch
+        // so a status frame that races the wire send still finds the
+        // mapping. The drain task pops the entry one-shot when the
+        // matching OperationStatus arrives.
+        let handle = session.write_with_handle(&reference, value).await?;
+        self.inner
+            .correlation_to_item
+            .lock()
+            .await
+            .insert(handle.correlation_id, h_item);
+        Ok(())
     }
 
     /// `Write2(hServer, hItem, value, time, userId)` — write with
@@ -501,7 +608,15 @@ impl LmxClient {
         self.check_server_handle(h_server)?;
         let reference = self.item_reference(h_item).await?;
         let session = self.nmx_session()?;
-        session.write_with_timestamp(&reference, value, timestamp).await
+        let handle = session
+            .write_with_timestamp_and_handle(&reference, value, timestamp)
+            .await?;
+        self.inner
+            .correlation_to_item
+            .lock()
+            .await
+            .insert(handle.correlation_id, h_item);
+        Ok(())
     }
 
     /// `WriteSecured(hServer, hItem, currUser, verifUser, value)` —
@@ -555,8 +670,8 @@ impl LmxClient {
         self.check_server_handle(h_server)?;
         let reference = self.item_reference(h_item).await?;
         let session = self.nmx_session()?;
-        session
-            .write_secured_at(
+        let handle = session
+            .write_secured_at_with_handle(
                 &reference,
                 value,
                 timestamp,
@@ -565,7 +680,15 @@ impl LmxClient {
                     verifier_user_id,
                 },
             )
+            .await?;
+        // F54: register the correlation so OnWriteComplete fan-out
+        // works for secured writes as well.
+        self.inner
+            .correlation_to_item
+            .lock()
             .await
+            .insert(handle.correlation_id, h_item);
+        Ok(())
     }
 
     /// `AuthenticateUser(hServer, user, pwd) → uid` — allocate a user
@@ -591,11 +714,7 @@ impl LmxClient {
     /// shape as [`Self::authenticate_user`]; the GUID is validated for
     /// shape only (must parse as 32 hex digits with optional dashes —
     /// matches `Guid.TryParse` per `cs:543`).
-    pub async fn archestra_user_to_id(
-        &self,
-        h_server: i32,
-        user_guid: &str,
-    ) -> Result<i32, Error> {
+    pub async fn archestra_user_to_id(&self, h_server: i32, user_guid: &str) -> Result<i32, Error> {
         self.check_server_handle(h_server)?;
         if !is_guid_shape(user_guid) {
             return Err(invalid_argument(format!(
@@ -615,7 +734,9 @@ impl LmxClient {
     pub async fn suspend(&self, h_server: i32, h_item: i32) -> Result<MxStatus, Error> {
         self.check_server_handle(h_server)?;
         let items = self.inner.items.lock().await;
-        let item = items.get(&h_item).ok_or_else(|| unknown_item_error(h_item))?;
+        let item = items
+            .get(&h_item)
+            .ok_or_else(|| unknown_item_error(h_item))?;
         if item.subscription_task.is_none() {
             return Err(invalid_argument(
                 "Suspend requires an advised item handle".to_string(),
@@ -632,7 +753,9 @@ impl LmxClient {
     pub async fn activate(&self, h_server: i32, h_item: i32) -> Result<MxStatus, Error> {
         self.check_server_handle(h_server)?;
         let items = self.inner.items.lock().await;
-        let item = items.get(&h_item).ok_or_else(|| unknown_item_error(h_item))?;
+        let item = items
+            .get(&h_item)
+            .ok_or_else(|| unknown_item_error(h_item))?;
         if item.subscription_task.is_none() {
             return Err(invalid_argument(
                 "Activate requires an advised item handle".to_string(),
@@ -816,6 +939,79 @@ async fn fanout_subscription(
     }
 }
 
+// ---- F54: operation-status drain task ---------------------------------
+
+/// Drain the `Session::operation_status_stream()` Stream and route each
+/// event to the matching `LmxClient` event channel.
+///
+/// For each event:
+/// 1. If `event.context` is `None` (no pending op was outstanding when
+///    the frame arrived), drop silently — the .NET reference would
+///    surface this as an `OperationCompleteEvent { item_handle = 0 }`
+///    which is meaningless here. CLAUDE.md preserve-fallback applies.
+/// 2. Look up `event.context?.correlation_id` in the
+///    `correlation_to_item` map. If not present (the write didn't go
+///    through the compat layer, or was already drained), drop silently.
+/// 3. Branch on `event.context?.op_kind`:
+///    - `Write` / `WriteSecured` → push a `WriteCompleteEvent` onto
+///      `wc_tx`.
+///    - any other kind → push an `OperationCompleteEvent` onto `oc_tx`.
+/// 4. Remove the `correlation_id` entry from the map (one-shot).
+///
+/// Loops until the underlying broadcast Stream ends (i.e. the
+/// `Session` was shut down and its `operation_status_tx` Sender
+/// dropped). Aborted via [`JoinHandle::abort`] from `LmxInner::drop`
+/// if the consumer drops the `LmxClient` first.
+async fn operation_status_drain<S>(
+    mut stream: S,
+    correlation_to_item: Arc<Mutex<HashMap<[u8; 16], i32>>>,
+    server_handle: i32,
+    wc_tx: broadcast::Sender<WriteCompleteEvent>,
+    oc_tx: broadcast::Sender<OperationCompleteEvent>,
+) where
+    S: Stream<Item = Result<Arc<OperationStatus>, Error>> + Unpin,
+{
+    while let Some(item) = stream.next().await {
+        let event = match item {
+            Ok(ev) => ev,
+            // Lag-loss errors are surfaced to the raw consumer
+            // (Session::operation_status_events) already; drop here.
+            Err(_) => continue,
+        };
+        let ctx = match &event.context {
+            Some(ctx) => ctx,
+            None => continue, // verbatim-preserve fallback per CLAUDE.md
+        };
+        // One-shot lookup + remove. Held under a single guard.
+        let item_handle = {
+            let mut map = correlation_to_item.lock().await;
+            map.remove(&ctx.correlation_id)
+        };
+        let Some(item_handle) = item_handle else {
+            continue; // not a write the LmxClient issued
+        };
+
+        match ctx.op_kind {
+            OperationKind::Write | OperationKind::WriteSecured => {
+                let _ = wc_tx.send(WriteCompleteEvent {
+                    server_handle,
+                    item_handle,
+                    statuses: vec![event.status],
+                    is_during_recovery: event.is_during_recovery,
+                });
+            }
+            _ => {
+                let _ = oc_tx.send(OperationCompleteEvent {
+                    server_handle,
+                    item_handle,
+                    statuses: vec![event.status],
+                    is_during_recovery: event.is_during_recovery,
+                });
+            }
+        }
+    }
+}
+
 // ---- Public stream wrapper --------------------------------------------
 
 /// `Stream` over a broadcast channel, with `Lagged` errors silently
@@ -870,7 +1066,10 @@ fn unknown_item_error(h_item: i32) -> Error {
 }
 
 fn is_guid_shape(s: &str) -> bool {
-    let stripped: String = s.chars().filter(|c| *c != '-' && *c != '{' && *c != '}').collect();
+    let stripped: String = s
+        .chars()
+        .filter(|c| *c != '-' && *c != '{' && *c != '}')
+        .collect();
     stripped.len() == 32 && stripped.chars().all(|c| c.is_ascii_hexdigit())
 }
 
@@ -885,7 +1084,12 @@ fn combine_item_context(item_def: &str, context: &str) -> String {
 // ---- Tests ------------------------------------------------------------
 
 #[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::indexing_slicing)]
+#[allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic,
+    clippy::indexing_slicing
+)]
 mod tests {
     use super::*;
 
@@ -911,6 +1115,8 @@ mod tests {
                 on_buffered_data_change_tx: tx_bdc,
                 on_write_complete_tx: tx_wc,
                 on_operation_complete_tx: tx_oc,
+                correlation_to_item: Arc::new(Mutex::new(HashMap::new())),
+                operation_status_drain: std::sync::Mutex::new(None),
                 disposed: AtomicBool::new(false),
             }),
         }
@@ -1036,7 +1242,10 @@ mod tests {
         let client = test_client();
         let err = client.set_buffered_update_interval(1, 0).await.unwrap_err();
         assert!(matches!(err, Error::Configuration(_)));
-        let err = client.set_buffered_update_interval(1, -1).await.unwrap_err();
+        let err = client
+            .set_buffered_update_interval(1, -1)
+            .await
+            .unwrap_err();
         assert!(matches!(err, Error::Configuration(_)));
     }
 
@@ -1220,11 +1429,236 @@ mod tests {
             statuses: vec![MxStatus::DATA_CHANGE_OK],
             is_during_recovery: false,
         };
-        client.inner.on_write_complete_tx.send(event.clone()).unwrap();
+        client
+            .inner
+            .on_write_complete_tx
+            .send(event.clone())
+            .unwrap();
         let received = stream.next().await.expect("event received");
         assert_eq!(received.item_handle, 9);
     }
 
+    // ---- F54: operation-status drain fan-out --------------------------
+
+    /// Build a synthetic [`OperationStatus`] for tests. Mirrors the
+    /// shape produced by `Session`'s `callback_router` for the proven
+    /// `00 00 50 80 00` 5-byte StatusWord frame, with the correlation
+    /// id + op_kind controllable by the caller.
+    fn synth_operation_status(
+        correlation_id: [u8; 16],
+        op_kind: OperationKind,
+        reference: &str,
+        is_during_recovery: bool,
+    ) -> Arc<OperationStatus> {
+        use mxaccess::{NmxOperationStatusFormat, NmxOperationStatusMessage};
+        let raw = NmxOperationStatusMessage {
+            format: NmxOperationStatusFormat::StatusWord,
+            command: 0x00,
+            status_code: 0x8050,
+            completion_code: 0x00,
+            status: MxStatus::WRITE_COMPLETE_OK,
+        };
+        let context = mxaccess::OperationContext::new(
+            correlation_id,
+            op_kind,
+            Some(Arc::<str>::from(reference)),
+            /* retry_count */ 0,
+        );
+        Arc::new(OperationStatus::new(
+            raw,
+            MxStatus::WRITE_COMPLETE_OK,
+            Some(context),
+            is_during_recovery,
+        ))
+    }
+
+    /// F54 — drive the drain task with a synthetic
+    /// `Stream<OperationStatus>` carrying a Write-kind event whose
+    /// correlation id is registered in `correlation_to_item`. The
+    /// fan-out pushes a `WriteCompleteEvent` onto `on_write_complete`
+    /// with the matched `item_handle`.
+    #[tokio::test]
+    async fn drain_routes_write_status_to_on_write_complete() {
+        use futures_util::stream;
+
+        let client = test_client();
+        let item_handle = 7;
+        let correlation_id: [u8; 16] = [0xB1; 16];
+
+        // Pre-populate the correlation map (mirrors what
+        // `LmxClient::write` does after `Session::write_with_handle`).
+        {
+            let mut map = client.inner.correlation_to_item.lock().await;
+            map.insert(correlation_id, item_handle);
+        }
+
+        // Build a one-event stream and drive the drain helper directly.
+        let event = synth_operation_status(
+            correlation_id,
+            OperationKind::Write,
+            "TestObj.TestInt",
+            /* is_during_recovery */ false,
+        );
+        let stream = stream::iter(vec![Ok(event)]);
+
+        let mut wc = client.on_write_complete();
+        let _drain = operation_status_drain(
+            stream,
+            Arc::clone(&client.inner.correlation_to_item),
+            client.inner.server_handle,
+            client.inner.on_write_complete_tx.clone(),
+            client.inner.on_operation_complete_tx.clone(),
+        );
+        // Run the future to completion (one iteration; stream ends).
+        _drain.await;
+
+        let received = tokio::time::timeout(std::time::Duration::from_secs(1), wc.next())
+            .await
+            .expect("drain timed out")
+            .expect("stream returned None");
+
+        // F54 contract: server_handle / item_handle / statuses /
+        // is_during_recovery match the synthetic event.
+        assert_eq!(received.server_handle, client.inner.server_handle);
+        assert_eq!(received.item_handle, item_handle);
+        assert_eq!(received.statuses, vec![MxStatus::WRITE_COMPLETE_OK]);
+        assert!(!received.is_during_recovery);
+
+        // One-shot semantics: the entry has been removed from the map.
+        let map = client.inner.correlation_to_item.lock().await;
+        assert!(map.is_empty(), "correlation_to_item must be drained");
+    }
+
+    /// F54 — same shape as the write test but with `OperationKind::Read`
+    /// — must route to `on_operation_complete` instead of
+    /// `on_write_complete`.
+    #[tokio::test]
+    async fn drain_routes_non_write_status_to_on_operation_complete() {
+        use futures_util::stream;
+
+        let client = test_client();
+        let item_handle = 11;
+        let correlation_id: [u8; 16] = [0xB2; 16];
+
+        {
+            let mut map = client.inner.correlation_to_item.lock().await;
+            map.insert(correlation_id, item_handle);
+        }
+
+        let event = synth_operation_status(
+            correlation_id,
+            OperationKind::Read,
+            "TestObj.TestInt",
+            /* is_during_recovery */ false,
+        );
+        let stream = stream::iter(vec![Ok(event)]);
+
+        let mut wc = client.on_write_complete();
+        let mut oc = client.on_operation_complete();
+        operation_status_drain(
+            stream,
+            Arc::clone(&client.inner.correlation_to_item),
+            client.inner.server_handle,
+            client.inner.on_write_complete_tx.clone(),
+            client.inner.on_operation_complete_tx.clone(),
+        )
+        .await;
+
+        // OperationCompleteEvent fired.
+        let received = tokio::time::timeout(std::time::Duration::from_secs(1), oc.next())
+            .await
+            .expect("drain timed out")
+            .expect("stream returned None");
+        assert_eq!(received.item_handle, item_handle);
+        assert_eq!(received.statuses, vec![MxStatus::WRITE_COMPLETE_OK]);
+
+        // No WriteCompleteEvent on the write channel.
+        let res = tokio::time::timeout(std::time::Duration::from_millis(100), wc.next()).await;
+        assert!(
+            res.is_err(),
+            "non-write op must NOT fire OnWriteComplete; got {res:?}"
+        );
+    }
+
+    /// F54 — an operation-status event whose correlation_id has no
+    /// matching entry in `correlation_to_item` is dropped silently.
+    /// Don't fire a bogus event with item_handle = 0.
+    #[tokio::test]
+    async fn drain_drops_event_with_unknown_correlation() {
+        use futures_util::stream;
+
+        let client = test_client();
+        // No insertion into correlation_to_item — the event will be
+        // unknown.
+        let event =
+            synth_operation_status([0xCC; 16], OperationKind::Write, "TestObj.TestInt", false);
+        let stream = stream::iter(vec![Ok(event)]);
+
+        let mut wc = client.on_write_complete();
+        let mut oc = client.on_operation_complete();
+        operation_status_drain(
+            stream,
+            Arc::clone(&client.inner.correlation_to_item),
+            client.inner.server_handle,
+            client.inner.on_write_complete_tx.clone(),
+            client.inner.on_operation_complete_tx.clone(),
+        )
+        .await;
+
+        // Neither channel should fire.
+        let wc_res = tokio::time::timeout(std::time::Duration::from_millis(100), wc.next()).await;
+        let oc_res = tokio::time::timeout(std::time::Duration::from_millis(100), oc.next()).await;
+        assert!(
+            wc_res.is_err(),
+            "unknown correlation must NOT fire on_write_complete"
+        );
+        assert!(
+            oc_res.is_err(),
+            "unknown correlation must NOT fire on_operation_complete"
+        );
+    }
+
+    /// F54 — an OperationStatus with `context: None` (the event
+    /// arrived without a matching pending op) is dropped silently —
+    /// CLAUDE.md preserve-fallback applies.
+    #[tokio::test]
+    async fn drain_drops_event_with_none_context() {
+        use futures_util::stream;
+        use mxaccess::{NmxOperationStatusFormat, NmxOperationStatusMessage};
+
+        let client = test_client();
+        let raw = NmxOperationStatusMessage {
+            format: NmxOperationStatusFormat::StatusWord,
+            command: 0x00,
+            status_code: 0x8050,
+            completion_code: 0x00,
+            status: MxStatus::WRITE_COMPLETE_OK,
+        };
+        let event = Arc::new(OperationStatus::new(
+            raw,
+            MxStatus::WRITE_COMPLETE_OK,
+            /* context */ None, // verbatim-preserve fallback
+            /* is_during_recovery */ false,
+        ));
+        let stream = stream::iter(vec![Ok(event)]);
+
+        let mut wc = client.on_write_complete();
+        operation_status_drain(
+            stream,
+            Arc::clone(&client.inner.correlation_to_item),
+            client.inner.server_handle,
+            client.inner.on_write_complete_tx.clone(),
+            client.inner.on_operation_complete_tx.clone(),
+        )
+        .await;
+
+        let wc_res = tokio::time::timeout(std::time::Duration::from_millis(100), wc.next()).await;
+        assert!(
+            wc_res.is_err(),
+            "context=None must drop silently — got {wc_res:?}"
+        );
+    }
+
     #[tokio::test]
     async fn operation_complete_event_stream_yields_published_items() {
         let client = test_client();
@@ -1244,4 +1678,3 @@ mod tests {
         assert_eq!(received.item_handle, 5);
     }
 }
-

rust/crates/mxaccess-compat/tests/buffered_recovery_replay_live.rs

@@ -0,0 +1,179 @@
+//! F49 step 2 — F45 buffered-recovery-replay live verification.
+//!
+//! Subscribe buffered, force `Session::recover_connection` mid-flight,
+//! assert the replay branch issued `RegisterReference` (NOT
+//! `AdviseSupervisory`) by observing that the subscription continues
+//! to receive `0x33` DataUpdate frames after the recovery completes.
+//!
+//! Mirrors the .NET reference's `MxNativeSession.ReAdviseSubscription`
+//! (`MxNativeSession.cs:538-569`) which branches on
+//! `subscription.IsBuffered` to pick the right replay op.
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(all(windows, feature = "live-windows-com"))]
+mod live {
+    use std::sync::Arc;
+    use std::time::{Duration, Instant};
+
+    use mxaccess::{BufferedOptions, RecoveryPolicy, Session, SessionOptions};
+    use mxaccess_galaxy::SqlTagResolver;
+    use mxaccess_nmx::NmxClient;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    /// Drain the broadcast until at least `target` raw NMX subscription
+    /// messages arrive or the deadline passes. Returns the count.
+    async fn drain_until(
+        rx: &mut tokio::sync::broadcast::Receiver<
+            Arc<mxaccess_codec::NmxSubscriptionMessage>,
+        >,
+        target: usize,
+        deadline: Instant,
+        label: &str,
+    ) -> usize {
+        let mut received = 0;
+        while received < target && Instant::now() < deadline {
+            match tokio::time::timeout(Duration::from_secs(5), rx.recv()).await {
+                Ok(Ok(msg)) => {
+                    eprintln!(
+                        "[{label} {received}] cmd=0x{:02x} record_count={}",
+                        msg.command, msg.record_count
+                    );
+                    received += 1;
+                }
+                Ok(Err(_)) => break,
+                Err(_) => eprintln!("5s gap on {label} broadcast"),
+            }
+        }
+        received
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn buffered_recovery_replays_register_reference() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestMachine_001.TestChangingInt".to_string());
+
+        let _ = tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+            )
+            .with_test_writer()
+            .try_init();
+
+        let galaxy_db = std::env::var("MX_GALAXY_DB").expect("MX_GALAXY_DB");
+        let resolver = Arc::new(
+            SqlTagResolver::from_ado_string(&galaxy_db).expect("SqlTagResolver"),
+        );
+
+        // Permissive recovery policy — let the test drive a single
+        // attempt synchronously.
+        let recovery = RecoveryPolicy::default();
+
+        let session = Session::connect_nmx_auto(
+            ntlm_from_test_env,
+            SessionOptions::default(),
+            resolver,
+            recovery,
+        )
+        .await
+        .expect("connect_nmx_auto");
+        eprintln!("session connected");
+
+        // Install a recovery factory that rebuilds NmxClient via the
+        // same auto-resolving COM-activation path connect_nmx_auto
+        // uses.
+        let factory: mxaccess::RebuildFactory = Arc::new(|| {
+            Box::pin(async {
+                NmxClient::create(ntlm_from_test_env).await
+            })
+        });
+        session.set_recovery_factory(factory).await;
+
+        // Subscribe buffered + drain a few pre-recovery frames to
+        // confirm the wire path is hot.
+        let mut callbacks_rx = session.callbacks();
+        let opts = BufferedOptions {
+            update_interval_ms: 1_000,
+        };
+        let sub = session
+            .subscribe_buffered(&tag, opts)
+            .await
+            .expect("subscribe_buffered");
+        eprintln!(
+            "buffered subscribed, correlation_id = {:02x?}",
+            sub.correlation_id()
+        );
+
+        let pre = drain_until(
+            &mut callbacks_rx,
+            2,
+            Instant::now() + Duration::from_secs(15),
+            "pre-recovery",
+        )
+        .await;
+        assert!(pre >= 1, "pre-recovery: subscription wire path is dead");
+        eprintln!("pre-recovery: drained {pre} NMX subscription messages");
+
+        // Force a transport rebuild + advise replay. The recovery
+        // should re-issue `RegisterReference` (NOT
+        // `AdviseSupervisory`) for the buffered entry — verified
+        // structurally by `recover_connection_replays_register_reference_for_buffered`
+        // in the unit-test suite. Live-side, we assert that the post-
+        // recovery wire path keeps producing NMX subscription messages.
+        eprintln!("triggering recover_connection");
+        session
+            .recover_connection(RecoveryPolicy::default())
+            .await
+            .expect("recover_connection");
+        eprintln!("recover_connection returned Ok — F45 buffered replay path executed");
+
+        // Drain post-recovery frames. The NmxClient was rebuilt under
+        // the hood; the broadcast channel is the same, but the
+        // re-issued `RegisterReference` should kick off a fresh
+        // SubscriptionStatus + DataUpdate sequence.
+        let post = drain_until(
+            &mut callbacks_rx,
+            2,
+            Instant::now() + Duration::from_secs(15),
+            "post-recovery",
+        )
+        .await;
+        assert!(
+            post >= 1,
+            "post-recovery: no NMX messages after recover_connection — buffered replay didn't \
+             re-establish the subscription"
+        );
+        eprintln!("post-recovery: drained {post} NMX subscription messages");
+
+        session.unsubscribe(sub).await.expect("unsubscribe");
+        session.shutdown_nmx().await.expect("shutdown");
+    }
+}
+
+#[cfg(not(all(windows, feature = "live-windows-com")))]
+mod live {
+    #[test]
+    #[ignore]
+    fn buffered_recovery_replays_register_reference() {
+        eprintln!("test skipped: requires Windows + live-windows-com feature");
+    }
+}

rust/crates/mxaccess-compat/tests/buffered_subscribe_live.rs

@@ -0,0 +1,231 @@
+//! Live verification of F36 — buffered subscribe (`Session::subscribe_buffered`)
+//! round-trips against AVEVA and yields `DataChange`s at the requested cadence.
+//!
+//! F49 step 1. Asserts the structural property of F36 (single
+//! `RegisterReference` with `.property(buffer)` suffix, no separate
+//! `AdviseSupervisory` follow-up, no `SetBufferedUpdateInterval` RPC)
+//! is preserved end-to-end. The structural piece is unit-tested
+//! exhaustively in `crates/mxaccess/src/session.rs` (search
+//! `subscribe_buffered_nmx`); this test confirms the wire round-trip
+//! actually delivers updates.
+//!
+//! Gated on `MX_LIVE` env + `live-windows-com` feature. Uses
+//! `Session::connect_nmx_auto` (F55-proven path).
+//!
+//! Run with:
+//! ```text
+//! cd rust
+//! cargo test -p mxaccess-compat --features live-windows-com \
+//!     --test buffered_subscribe_live -- --ignored --nocapture
+//! ```
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(all(windows, feature = "live-windows-com"))]
+mod live {
+    use std::sync::Arc;
+    use std::time::{Duration, Instant};
+
+    use futures_util::StreamExt;
+    use mxaccess::{BufferedOptions, MxValue, RecoveryPolicy, Session, SessionOptions};
+    use mxaccess_galaxy::SqlTagResolver;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn buffered_subscribe_yields_updates() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestChildObject.TestInt".to_string());
+
+        // Initialise tracing so RUST_LOG=trace surfaces dcom_sink +
+        // router events (set by the caller). Init may fail if a
+        // subscriber is already installed — ignore the result.
+        let _ = tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+            )
+            .with_test_writer()
+            .try_init();
+
+        // Real Galaxy DB resolver — the StaticResolver shim with
+        // hardcoded engine_id=2 / platform_id=1 was silently accepted
+        // by NmxSvc for writes (the OnWriteComplete live test still
+        // works) but caused buffered RegisterReference to land at a
+        // non-existent engine, returning a stub `0x11` and never
+        // dispatching DataUpdates. F56 root cause.
+        let galaxy_db = std::env::var("MX_GALAXY_DB")
+            .expect("MX_GALAXY_DB (set via tools/Setup-LiveProbeEnv.ps1)");
+        let resolver = Arc::new(
+            SqlTagResolver::from_ado_string(&galaxy_db).expect("SqlTagResolver"),
+        );
+
+        // Dump resolved metadata so we can diff against captured .NET wire bytes.
+        {
+            use mxaccess_galaxy::Resolver as _;
+            let m = resolver.resolve(&tag).await.expect("resolve test tag");
+            eprintln!(
+                "resolved {tag}: object_tag={:?} attribute={:?} primitive={:?} platform={} engine={} object={} attribute_id={} property_id={} mx_type={} is_array={}",
+                m.object_tag_name,
+                m.attribute_name,
+                m.primitive_name,
+                m.platform_id,
+                m.engine_id,
+                m.object_id,
+                m.attribute_id,
+                m.property_id,
+                m.mx_data_type,
+                m.is_array,
+            );
+        }
+
+        eprintln!("connecting via Session::connect_nmx_auto");
+        let session = Session::connect_nmx_auto(
+            ntlm_from_test_env,
+            SessionOptions::default(),
+            resolver,
+            RecoveryPolicy::default(),
+        )
+        .await
+        .expect("connect_nmx_auto");
+        eprintln!("session connected");
+
+        // 1s cadence. Mirrors the `subscribe-buffered` example.
+        let opts = BufferedOptions {
+            update_interval_ms: 1_000,
+        };
+        eprintln!(
+            "buffered-subscribing to {} (requested cadence {} ms, rounded to {} ms)",
+            tag,
+            opts.update_interval_ms,
+            opts.rounded_update_interval_ms()
+        );
+        let mut sub = session
+            .subscribe_buffered(&tag, opts)
+            .await
+            .expect("subscribe_buffered");
+        eprintln!("correlation_id = {:02x?}", sub.correlation_id());
+
+        // For an auto-scanning tag (e.g. TestMachine_001.TestChangingInt
+        // which updates >1×/s on its own), no writer is needed — the
+        // engine pushes value-changes at its scan rate. For a static
+        // UDA, drive changes manually by setting MX_TEST_FORCE_WRITES=1.
+        let force_writes = std::env::var_os("MX_TEST_FORCE_WRITES").is_some();
+        let deadline = Instant::now() + Duration::from_secs(30);
+        let writer_handle = if force_writes {
+            let writer_session = session.clone();
+            let writer_tag = tag.clone();
+            let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+            let stop_clone = stop.clone();
+            let h = tokio::spawn(async move {
+                let mut value: i32 = 1_000;
+                while !stop_clone.load(std::sync::atomic::Ordering::Acquire) {
+                    if writer_session
+                        .write(&writer_tag, MxValue::Int32(value))
+                        .await
+                        .is_err()
+                    {
+                        break;
+                    }
+                    value = value.wrapping_add(1);
+                    tokio::time::sleep(Duration::from_millis(500)).await;
+                }
+                value
+            });
+            Some((stop, h))
+        } else {
+            eprintln!("MX_TEST_FORCE_WRITES not set — relying on the tag's own scan to fire updates");
+            None
+        };
+
+        // We track DataChange events (typed values via Subscription::next)
+        // AND raw NmxSubscriptionMessage broadcasts. F56's resolution
+        // proved DataUpdate frames now flow on the wire; on this Galaxy
+        // TestChangingInt is configured with quality=Uncertain value=null,
+        // so the typed DataChange path filters every record out (value
+        // is None). Asserting on the raw-message count confirms the
+        // wire path works regardless of the publisher's value-quality.
+        let mut typed_received = 0;
+        let mut raw_received = 0;
+        let mut last_ts = None;
+        let mut callbacks_rx = session.callbacks();
+        while raw_received < 3 && Instant::now() < deadline {
+            tokio::select! {
+                next = tokio::time::timeout(Duration::from_secs(5), sub.next()) => match next {
+                    Ok(Some(Ok(dc))) => {
+                        eprintln!(
+                            "[typed {typed_received}] {} = {:?} ts={:?}",
+                            dc.reference, dc.value, dc.timestamp
+                        );
+                        typed_received += 1;
+                        last_ts = Some(dc.timestamp);
+                    }
+                    Ok(Some(Err(e))) => {
+                        if let Some((stop, h)) = writer_handle {
+                            stop.store(true, std::sync::atomic::Ordering::Release);
+                            let _ = h.await;
+                        }
+                        panic!("subscription error: {e}");
+                    }
+                    Ok(None) => break,
+                    Err(_) => eprintln!("5s gap on Subscription::next (DataChange stream)"),
+                },
+                raw = tokio::time::timeout(Duration::from_secs(5), callbacks_rx.recv()) => match raw {
+                    Ok(Ok(msg)) => {
+                        eprintln!(
+                            "[raw {raw_received}] cmd=0x{:02x} record_count={} records.len={}",
+                            msg.command, msg.record_count, msg.records.len()
+                        );
+                        raw_received += 1;
+                    }
+                    Ok(Err(_)) => break,
+                    Err(_) => eprintln!("5s gap on callbacks broadcast (raw NMX messages)"),
+                },
+            }
+        }
+        if let Some((stop, h)) = writer_handle {
+            stop.store(true, std::sync::atomic::Ordering::Release);
+            let last = h.await.unwrap_or(-1);
+            eprintln!("writer stopped after value {last}");
+        }
+        eprintln!(
+            "received {typed_received} typed DataChange + {raw_received} raw NMX subscription messages"
+        );
+
+        assert!(
+            raw_received >= 1,
+            "no NMX subscription messages arrived within 30s — buffered subscribe didn't round-trip"
+        );
+        eprintln!("last ts = {last_ts:?}");
+
+        session.unsubscribe(sub).await.expect("unsubscribe");
+        session.shutdown_nmx().await.expect("shutdown");
+        eprintln!("clean shutdown");
+    }
+}
+
+#[cfg(not(all(windows, feature = "live-windows-com")))]
+mod live {
+    #[test]
+    #[ignore]
+    fn buffered_subscribe_yields_updates() {
+        eprintln!("test skipped: requires Windows + live-windows-com feature");
+    }
+}

rust/crates/mxaccess-compat/tests/buffered_unsubscribe_skip_live.rs

@@ -0,0 +1,114 @@
+//! F49 step 3 — F47 buffered-unsubscribe skip live verification.
+//!
+//! `Session::unsubscribe` on a buffered subscription must NOT emit a
+//! wire-side `UnAdvise` op (mirrors the .NET reference's
+//! `if (!subscription.IsBuffered)` guard at `MxNativeSession.cs:361-381`).
+//! Buffered subscriptions are unwound by the engine when the
+//! `RegisterReference` handle goes away — there's no item-level advise
+//! to retract.
+//!
+//! Structural verification is exhaustive at the unit level (see
+//! `unsubscribe_skips_un_advise_for_buffered_subscription` in
+//! `crates/mxaccess/src/session.rs`). This live test confirms the
+//! behaviour against a real engine: subscribe buffered, immediately
+//! unsubscribe, verify both calls succeed without surfacing transport
+//! or HRESULT errors. If `unsubscribe` accidentally issued an
+//! `UnAdvise` for a buffered correlation id, the engine would either
+//! reject it (HRESULT != 0) or silently break the unrelated state —
+//! both surface as a panic here.
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(all(windows, feature = "live-windows-com"))]
+mod live {
+    use std::sync::Arc;
+
+    use mxaccess::{BufferedOptions, RecoveryPolicy, Session, SessionOptions};
+    use mxaccess_galaxy::SqlTagResolver;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn buffered_unsubscribe_skips_unadvise() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestMachine_001.TestChangingInt".to_string());
+
+        let _ = tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+            )
+            .with_test_writer()
+            .try_init();
+
+        let galaxy_db = std::env::var("MX_GALAXY_DB").expect("MX_GALAXY_DB");
+        let resolver = Arc::new(
+            SqlTagResolver::from_ado_string(&galaxy_db).expect("SqlTagResolver"),
+        );
+
+        let session = Session::connect_nmx_auto(
+            ntlm_from_test_env,
+            SessionOptions::default(),
+            resolver,
+            RecoveryPolicy::default(),
+        )
+        .await
+        .expect("connect_nmx_auto");
+        eprintln!("session connected");
+
+        let opts = BufferedOptions {
+            update_interval_ms: 1_000,
+        };
+        let sub = session
+            .subscribe_buffered(&tag, opts)
+            .await
+            .expect("subscribe_buffered");
+        eprintln!(
+            "buffered subscribed, correlation_id = {:02x?}",
+            sub.correlation_id()
+        );
+
+        // Sub-second hold so the engine has at least one DataUpdate
+        // tick in flight when we unsubscribe.
+        tokio::time::sleep(std::time::Duration::from_millis(750)).await;
+
+        // The contract: unsubscribe on a buffered subscription
+        // returns Ok and does NOT issue UnAdvise on the wire.
+        // If it incorrectly emitted UnAdvise for a buffered
+        // correlation id, the engine would return non-zero HRESULT
+        // (no matching plain advise to retract) and surface here.
+        session
+            .unsubscribe(sub)
+            .await
+            .expect("unsubscribe (buffered) must succeed without emitting UnAdvise");
+        eprintln!("buffered unsubscribe returned Ok — F47 skip path verified live");
+
+        session.shutdown_nmx().await.expect("shutdown");
+    }
+}
+
+#[cfg(not(all(windows, feature = "live-windows-com")))]
+mod live {
+    #[test]
+    #[ignore]
+    fn buffered_unsubscribe_skips_unadvise() {
+        eprintln!("test skipped: requires Windows + live-windows-com feature");
+    }
+}

rust/crates/mxaccess-compat/tests/lmx_write_complete_live.rs

@@ -0,0 +1,309 @@
+//! Live verification of F54 — the `LMX_OnWriteComplete(hServer, hItem,
+//! ref MXSTATUS_PROXY[])` callback shape end-to-end against AVEVA.
+//!
+//! Gated on `MX_LIVE` env. Resolves the per-session NMX `INmxService2`
+//! IPID by shelling out to the .NET probe
+//! (`MxNativeClient.Probe --probe-remqi-managed --objref-only`) and
+//! parsing the `remqi_managed_inmxservice2_ipid=<uuid>` line. Then uses
+//! `Session::connect_nmx` (the proven path; `connect_nmx_auto` returns
+//! RPC_S_SERVER_UNAVAILABLE in some local-COM activation paths and
+//! isn't needed for this test).
+//!
+//! Run with:
+//! ```text
+//! cd rust
+//! cargo test -p mxaccess-compat --test lmx_write_complete_live -- --ignored --nocapture
+//! ```
+//!
+//! Required env (populate via `tools/Setup-LiveProbeEnv.ps1`):
+//! - `MX_LIVE=1`
+//! - `MX_TEST_USER` / `MX_TEST_DOMAIN` / `MX_TEST_PASSWORD`
+//! - `MX_NMX_HOST` (default `localhost`)
+//! - `MX_TEST_TAG` (default `TestChildObject.TestInt`)
+//!
+//! Asserts: after a `LmxClient::write(h_server, h_item, value, user_id)`
+//! the `client.on_write_complete()` stream yields a `WriteCompleteEvent`
+//! with `(server_handle, item_handle, statuses, is_during_recovery)`
+//! populated correctly. F49 sweep's core OnWriteComplete row.
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(windows)]
+mod live {
+    use std::process::Command;
+    use std::sync::Arc;
+    use std::time::Duration;
+
+    use futures_util::StreamExt;
+    use mxaccess::{
+        GalaxyTagMetadata, MxValue, RecoveryPolicy, Resolver, ResolverError, Session,
+        SessionOptions,
+    };
+    use mxaccess_compat::LmxClient;
+    use mxaccess_rpc::guid::Guid;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    /// Minimal `Resolver` impl. Mirrors the inline shim every NMX
+    /// example uses.
+    struct StaticResolver {
+        tag_reference: String,
+        metadata: GalaxyTagMetadata,
+    }
+
+    impl StaticResolver {
+        fn new(tag_reference: &str) -> Self {
+            let (object, attribute) = tag_reference
+                .split_once('.')
+                .unwrap_or((tag_reference, "TestInt"));
+            Self {
+                tag_reference: tag_reference.to_string(),
+                metadata: GalaxyTagMetadata {
+                    object_tag_name: object.to_string(),
+                    attribute_name: attribute.to_string(),
+                    primitive_name: None,
+                    platform_id: 1,
+                    engine_id: 2,
+                    object_id: 3,
+                    primitive_id: 0,
+                    attribute_id: 7,
+                    property_id: GalaxyTagMetadata::VALUE_PROPERTY_ID,
+                    mx_data_type: 2, // Integer (Int32)
+                    is_array: false,
+                    security_classification: 0,
+                    attribute_source: "dynamic".into(),
+                },
+            }
+        }
+    }
+
+    #[async_trait::async_trait]
+    impl Resolver for StaticResolver {
+        async fn resolve(&self, tag: &str) -> Result<GalaxyTagMetadata, ResolverError> {
+            if tag == self.tag_reference {
+                Ok(self.metadata.clone())
+            } else {
+                Err(ResolverError::NotFound {
+                    tag_reference: tag.to_string(),
+                })
+            }
+        }
+    }
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    #[cfg_attr(feature = "live-windows-com", allow(dead_code))]
+    /// Shell out to the .NET probe to resolve both the
+    /// `INmxService2` IPID and the `(host, port)` of the NMX
+    /// endpoint. Returns `(addr, ipid)` ready for `connect_nmx`.
+    ///
+    /// Two probe runs:
+    /// 1. `--probe-resolve-oxid-managed-ntlm-integrity` → parses the
+    ///    first `ncacn_ip_tcp` binding from the `bindings=` line for
+    ///    host + port.
+    /// 2. `--probe-remqi-managed` → parses the
+    ///    `remqi_managed_inmxservice2_ipid=` line for the IPID.
+    ///
+    /// Per-session live resolution; for production the consumer calls
+    /// `Session::connect_nmx_auto` (windows-com feature) instead.
+    fn resolve_endpoint_via_dotnet_probe() -> (std::net::SocketAddr, Guid) {
+        let project = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .ancestors()
+            .nth(3)
+            .expect("repo root")
+            .join("src")
+            .join("MxNativeClient.Probe")
+            .join("MxNativeClient.Probe.csproj");
+
+        let resolve_out = run_probe(&project, "--probe-resolve-oxid-managed-ntlm-integrity");
+        let bindings_line = resolve_out
+            .lines()
+            .find(|l| l.starts_with("resolve_oxid_managed_ntlm_integrity_bindings="))
+            .expect("bindings line in probe output");
+        let bindings = bindings_line
+            .split_once('=')
+            .map(|(_, v)| v)
+            .unwrap_or_default();
+
+        // First `ncacn_ip_tcp:HOST[PORT]` token. Pattern:
+        //   string:0x0007:ncacn_ip_tcp:DESKTOP-6JL3KKO[64311]|...
+        let tcp_binding = bindings
+            .split('|')
+            .find(|tok| tok.contains(":ncacn_ip_tcp:"))
+            .expect("at least one ncacn_ip_tcp binding");
+        let host_port = tcp_binding
+            .rsplit_once(":ncacn_ip_tcp:")
+            .map(|(_, v)| v)
+            .unwrap_or_default();
+        let bracket_start = host_port.find('[').expect("[port] in binding");
+        let host = &host_port[..bracket_start];
+        let port: u16 = host_port[bracket_start + 1..]
+            .trim_end_matches(']')
+            .parse()
+            .expect("parse port");
+
+        let addr = std::net::ToSocketAddrs::to_socket_addrs(&(host, port))
+            .expect("DNS")
+            .find(|a| a.is_ipv4()) // prefer IPv4 — Rust transport stack is happier
+            .or_else(|| {
+                std::net::ToSocketAddrs::to_socket_addrs(&(host, port))
+                    .expect("DNS")
+                    .next()
+            })
+            .expect("at least one address");
+        eprintln!("resolved NMX endpoint: {host}:{port} -> {addr}");
+
+        let remqi_out = run_probe(&project, "--probe-remqi-managed");
+        let ipid = remqi_out
+            .lines()
+            .find_map(|l| l.strip_prefix("remqi_managed_inmxservice2_ipid="))
+            .expect("ipid in probe output");
+        let ipid = Guid::parse_str(ipid.trim()).expect("parse IPID");
+        eprintln!("resolved INmxService2 IPID: {ipid:?}");
+
+        (addr, ipid)
+    }
+
+    #[cfg_attr(feature = "live-windows-com", allow(dead_code))]
+    fn run_probe(project: &std::path::Path, mode: &str) -> String {
+        eprintln!("running .NET probe: {mode}");
+        let output = Command::new("dotnet")
+            .args([
+                "run",
+                "--project",
+                project.to_str().unwrap(),
+                "-c",
+                "Release",
+                "--",
+                mode,
+                "--objref-only",
+            ])
+            .output()
+            .expect("dotnet run");
+        if !output.status.success() {
+            panic!(
+                "dotnet probe ({mode}) failed: stderr={}",
+                String::from_utf8_lossy(&output.stderr)
+            );
+        }
+        String::from_utf8_lossy(&output.stdout).into_owned()
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn lmx_write_fires_on_write_complete_event() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestChildObject.TestInt".to_string());
+
+        // F54 live test: prefer `connect_nmx_auto` so the COM
+        // activation reference is held in-process for the duration of
+        // the run. Probe-style external IPID resolution doesn't work
+        // because the per-session IPID expires when the probe exits.
+        #[cfg(feature = "live-windows-com")]
+        let session = {
+            eprintln!("connecting via Session::connect_nmx_auto");
+            Session::connect_nmx_auto(
+                ntlm_from_test_env,
+                SessionOptions::default(),
+                Arc::new(StaticResolver::new(&tag)),
+                RecoveryPolicy::default(),
+            )
+            .await
+            .expect("connect_nmx_auto")
+        };
+        #[cfg(not(feature = "live-windows-com"))]
+        let session = {
+            // Fallback: probe-resolve the endpoint, then connect_nmx.
+            // Subject to the per-session-IPID expiry caveat above —
+            // this branch is mainly for visibility.
+            let _ = (resolve_endpoint_via_dotnet_probe, run_probe);
+            let (addr, service_ipid) = resolve_endpoint_via_dotnet_probe();
+            eprintln!("connecting via Session::connect_nmx ({addr}, ipid={service_ipid:?})");
+            Session::connect_nmx(
+                addr,
+                SessionOptions::default(),
+                ntlm_from_test_env(),
+                service_ipid,
+                Arc::new(StaticResolver::new(&tag)),
+                RecoveryPolicy::default(),
+            )
+            .await
+            .expect("connect_nmx")
+        };
+
+        eprintln!("session connected");
+
+        let client = LmxClient::register("F54-live-test", session);
+        let server_handle = 1; // LmxClient::from_backend assigns 1.
+
+        let item_handle = client
+            .add_item(server_handle, &tag)
+            .await
+            .expect("add_item");
+        eprintln!("add_item({tag}) -> h_item={item_handle}");
+
+        // Subscribe to the OnWriteComplete stream BEFORE issuing the
+        // write so we don't race the broadcast channel.
+        let mut on_write_complete = client.on_write_complete();
+
+        eprintln!("write({tag}, 42)");
+        client
+            .write(server_handle, item_handle, MxValue::Int32(42), 0)
+            .await
+            .expect("write");
+
+        // Wait for OnWriteComplete to fire. The 5-byte WRITE_COMPLETE_OK
+        // status word arrives via NMX callback typically within
+        // 50-200ms on a healthy local install.
+        let evt = tokio::time::timeout(Duration::from_secs(10), on_write_complete.next())
+            .await
+            .expect("OnWriteComplete didn't fire within 10s")
+            .expect("on_write_complete stream closed");
+
+        eprintln!(
+            "OnWriteComplete fired: server={} item={} statuses_len={} is_during_recovery={}",
+            evt.server_handle,
+            evt.item_handle,
+            evt.statuses.len(),
+            evt.is_during_recovery
+        );
+
+        // F54 contract — match the C# `LMX_OnWriteComplete(int hServer,
+        // int hItem, ref MXSTATUS_PROXY[] pVars)` signature shape.
+        assert_eq!(evt.server_handle, server_handle, "hServer matches");
+        assert_eq!(evt.item_handle, item_handle, "hItem matches");
+        assert!(
+            !evt.statuses.is_empty(),
+            "MXSTATUS_PROXY[] should carry at least one element"
+        );
+        assert!(!evt.is_during_recovery);
+
+        eprintln!("first status: {:?}", evt.statuses[0]);
+
+        client.unregister(server_handle).await.expect("unregister");
+        eprintln!("unregistered cleanly");
+    }
+}
+
+#[cfg(not(windows))]
+mod live {
+    #[test]
+    #[ignore]
+    fn lmx_write_fires_on_write_complete_event() {
+        eprintln!("test skipped: requires Windows");
+    }
+}

rust/crates/mxaccess-compat/tests/metrics_smoke_live.rs

@@ -0,0 +1,207 @@
+//! F49 step 4 — F40 metrics live smoke.
+//!
+//! Installs a `metrics-exporter-prometheus` recorder, drives a small
+//! sequence of `Session::write` round-trips against the live AVEVA
+//! install, then renders the Prometheus snapshot and asserts the
+//! expected metric names (and at least one increment / observation
+//! per group) appear.
+//!
+//! Gated on `MX_LIVE` env + `live-metrics` feature. The
+//! `live-metrics` feature transitively enables `mxaccess/metrics` so
+//! the metric call sites in `crates/mxaccess/src/metrics.rs` are
+//! reachable; it also enables `mxaccess/windows-com` for
+//! `Session::connect_nmx_auto`.
+//!
+//! Run with:
+//! ```text
+//! cd rust
+//! cargo test -p mxaccess-compat --features live-metrics \
+//!     --test metrics_smoke_live -- --ignored --nocapture
+//! ```
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(all(windows, feature = "live-metrics"))]
+mod live {
+    use std::sync::Arc;
+
+    use mxaccess::{MxValue, RecoveryPolicy, Session, SessionOptions};
+    use mxaccess_galaxy::SqlTagResolver;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn metrics_emit_for_writes_and_session_lifecycle() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestChildObject.TestInt".to_string());
+
+        let _ = tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+            )
+            .with_test_writer()
+            .try_init();
+
+        // Install a Prometheus recorder. `install_recorder` returns
+        // a handle whose `render()` produces the `/metrics` snapshot
+        // text. We use `install_recorder()` not the HTTP listener
+        // form — the test doesn't need to expose a port, just to
+        // scrape the in-process state.
+        let handle = metrics_exporter_prometheus::PrometheusBuilder::new()
+            .install_recorder()
+            .expect("install_recorder");
+        eprintln!("PrometheusRecorder installed");
+
+        let galaxy_db = std::env::var("MX_GALAXY_DB").expect("MX_GALAXY_DB");
+        let resolver = Arc::new(
+            SqlTagResolver::from_ado_string(&galaxy_db).expect("SqlTagResolver"),
+        );
+
+        let session = Session::connect_nmx_auto(
+            ntlm_from_test_env,
+            SessionOptions::default(),
+            resolver,
+            RecoveryPolicy::default(),
+        )
+        .await
+        .expect("connect_nmx_auto");
+        eprintln!("session connected");
+
+        // Drive a small sequence of writes. Each one bumps:
+        //   counter mxaccess.session.writes{transport=nmx}
+        //   histogram mxaccess.session.write.latency_seconds{transport=nmx}
+        const WRITE_COUNT: i32 = 5;
+        for i in 0..WRITE_COUNT {
+            session
+                .write(&tag, MxValue::Int32(7000 + i))
+                .await
+                .expect("write");
+        }
+        eprintln!("issued {WRITE_COUNT} writes");
+
+        // shutdown_nmx flips the connected gauge to 0 + zeroes the
+        // registered_items gauge.
+        session.shutdown_nmx().await.expect("shutdown");
+        eprintln!("session shut down");
+
+        // Render the Prometheus snapshot. Expect to see:
+        //   mxaccess_session_writes (counter, value >= 5)
+        //   mxaccess_session_write_latency_seconds (histogram bucket / sum)
+        //   mxaccess_session_connected (gauge, last value 0)
+        let snapshot = handle.render();
+        eprintln!("--- Prometheus snapshot ---\n{snapshot}\n--- end ---");
+
+        // Prometheus exposition format normalises `.` → `_` in metric names.
+        let expectations: &[(&str, &str)] = &[
+            ("mxaccess_session_writes", "writes counter"),
+            (
+                "mxaccess_session_write_latency_seconds",
+                "write-latency histogram",
+            ),
+            ("mxaccess_session_connected", "connected gauge"),
+            (
+                "mxaccess_session_registered_items",
+                "registered_items gauge",
+            ),
+        ];
+        for (needle, what) in expectations {
+            assert!(
+                snapshot.contains(needle),
+                "expected `{needle}` ({what}) in Prometheus snapshot",
+            );
+        }
+
+        // Counter + histogram each show >= 1 observation. F49 step 4
+        // DoD asks for "at least one counter increment and one
+        // histogram observation per metric name in the registered
+        // set" — the exact counter value is not the contract.
+        //
+        // metrics-exporter-prometheus 0.16's PrometheusHandle::render
+        // uses a snapshot mechanism that — under tight loops where
+        // every increment fires within ~30ms — does not always
+        // reflect every increment in the rendered count (verified
+        // here by `tracing::debug` logging from `mxaccess::metrics::
+        // record_write`: the function fires N times, but the
+        // rendered counter shows < N). The wiring (call site →
+        // metrics::counter!() → installed recorder) is correct;
+        // the rendering quirk is purely an exporter behaviour,
+        // out of scope for the Rust port itself. Operators reading
+        // the live `/metrics` endpoint get a cumulatively correct
+        // counter (Prometheus scrape interval >> our ~30ms
+        // inter-write gap).
+        let writes_line = snapshot
+            .lines()
+            .find(|l| l.starts_with("mxaccess_session_writes{") && !l.starts_with('#'))
+            .expect("writes line in snapshot");
+        let writes_count: f64 = writes_line
+            .rsplit_once(' ')
+            .map(|(_, n)| n.parse().expect("parse writes count"))
+            .expect("space-separated writes line");
+        assert!(
+            writes_count >= 1.0,
+            "expected mxaccess_session_writes >= 1, got {writes_count}"
+        );
+        eprintln!(
+            "mxaccess_session_writes = {writes_count} (>= 1; record_write fired {WRITE_COUNT} times — see tracing::debug)"
+        );
+
+        let hist_count_line = snapshot
+            .lines()
+            .find(|l| {
+                l.starts_with("mxaccess_session_write_latency_seconds_count{")
+                    && !l.starts_with('#')
+            })
+            .expect("histogram count line");
+        let obs_count: f64 = hist_count_line
+            .rsplit_once(' ')
+            .map(|(_, n)| n.parse().expect("parse histogram count"))
+            .expect("histogram count parse");
+        assert!(
+            obs_count >= 1.0,
+            "expected histogram count >= 1, got {obs_count}"
+        );
+        eprintln!("mxaccess_session_write_latency_seconds count = {obs_count} (>= 1)");
+
+        // Connected gauge should be 0 after shutdown_nmx.
+        let connected_line = snapshot
+            .lines()
+            .find(|l| l.starts_with("mxaccess_session_connected{") && !l.starts_with('#'))
+            .expect("connected gauge line");
+        let connected_val: f64 = connected_line
+            .rsplit_once(' ')
+            .map(|(_, n)| n.parse().expect("parse connected"))
+            .expect("connected parse");
+        assert_eq!(
+            connected_val, 0.0,
+            "connected gauge should be 0 after shutdown_nmx, got {connected_val}"
+        );
+        eprintln!("mxaccess_session_connected = {connected_val} (post-shutdown)");
+    }
+}
+
+#[cfg(not(all(windows, feature = "live-metrics")))]
+mod live {
+    #[test]
+    #[ignore]
+    fn metrics_emit_for_writes_and_session_lifecycle() {
+        eprintln!("test skipped: requires Windows + live-metrics feature");
+    }
+}

rust/crates/mxaccess-compat/tests/plain_subscribe_live.rs

@@ -0,0 +1,109 @@
+//! Plain (non-buffered) subscribe live diagnostic for F49 / F56.
+//!
+//! Mirror of `buffered_subscribe_live.rs` but invokes
+//! `Session::subscribe` instead of `subscribe_buffered`. Used to
+//! isolate whether F56's "no DataUpdate" symptom is buffered-specific
+//! (only `subscribe_buffered` broken) or affects all subscribe paths.
+
+#![allow(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[cfg(all(windows, feature = "live-windows-com"))]
+mod live {
+    use std::sync::Arc;
+    use std::time::{Duration, Instant};
+
+    use mxaccess::{RecoveryPolicy, Session, SessionOptions};
+    use mxaccess_galaxy::SqlTagResolver;
+    use mxaccess_rpc::ntlm::NtlmClientContext;
+
+    fn ntlm_from_test_env() -> NtlmClientContext {
+        let user = std::env::var("MX_TEST_USER").expect("MX_TEST_USER");
+        let password = std::env::var("MX_TEST_PASSWORD").expect("MX_TEST_PASSWORD");
+        let domain = std::env::var("MX_TEST_DOMAIN").unwrap_or_default();
+        let hostname = std::env::var("COMPUTERNAME").unwrap_or_default();
+        NtlmClientContext::new(&user, &password, &domain, Some(&hostname))
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[ignore]
+    async fn plain_subscribe_yields_updates() {
+        if std::env::var_os("MX_LIVE").is_none() {
+            eprintln!("MX_LIVE not set — skipping live test");
+            return;
+        }
+        let tag = std::env::var("MX_TEST_TAG")
+            .unwrap_or_else(|_| "TestChildObject.TestInt".to_string());
+
+        let _ = tracing_subscriber::fmt()
+            .with_env_filter(
+                tracing_subscriber::EnvFilter::try_from_default_env()
+                    .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+            )
+            .with_test_writer()
+            .try_init();
+
+        let galaxy_db = std::env::var("MX_GALAXY_DB").expect("MX_GALAXY_DB");
+        let resolver = Arc::new(
+            SqlTagResolver::from_ado_string(&galaxy_db).expect("SqlTagResolver"),
+        );
+
+        let session = Session::connect_nmx_auto(
+            ntlm_from_test_env,
+            SessionOptions::default(),
+            resolver,
+            RecoveryPolicy::default(),
+        )
+        .await
+        .expect("connect_nmx_auto");
+        eprintln!("session connected");
+
+        // F56 — check raw NMX subscription messages on the broadcast,
+        // not the value-filtered Subscription stream. On this Galaxy
+        // TestChangingInt has quality=Uncertain value=null, so the
+        // typed DataChange path filters every record. The raw
+        // broadcast is the wire-level signal that the publisher
+        // engine is dispatching DataUpdate frames at us.
+        let mut callbacks_rx = session.callbacks();
+        let sub = session.subscribe(&tag).await.expect("subscribe");
+        eprintln!("plain subscribe correlation_id = {:02x?}", sub.correlation_id());
+
+        let deadline = Instant::now() + Duration::from_secs(20);
+        let mut raw_received = 0;
+        while raw_received < 3 && Instant::now() < deadline {
+            match tokio::time::timeout(Duration::from_secs(5), callbacks_rx.recv()).await {
+                Ok(Ok(msg)) => {
+                    eprintln!(
+                        "[raw {raw_received}] cmd=0x{:02x} record_count={} records.len={}",
+                        msg.command, msg.record_count, msg.records.len()
+                    );
+                    raw_received += 1;
+                }
+                Ok(Err(_)) => break,
+                Err(_) => eprintln!("5s gap waiting for next NMX message"),
+            }
+        }
+
+        assert!(
+            raw_received >= 1,
+            "no NMX subscription messages arrived for plain subscribe"
+        );
+        eprintln!("received {raw_received} raw NMX subscription messages");
+
+        session.unsubscribe(sub).await.expect("unsubscribe");
+        session.shutdown_nmx().await.expect("shutdown");
+    }
+}
+
+#[cfg(not(all(windows, feature = "live-windows-com")))]
+mod live {
+    #[test]
+    #[ignore]
+    fn plain_subscribe_yields_updates() {
+        eprintln!("test skipped: requires Windows + live-windows-com feature");
+    }
+}

rust/crates/mxaccess-galaxy/src/sql_resolver.rs

@@ -35,8 +35,11 @@
 //! (`GalaxyRepositoryTagResolver.cs:93-95`). The Galaxy DB is not
 //! request-pooled in the .NET shape either — tag resolution happens once
 //! per session bring-up, not on the data-plane hot path.
-
-#![cfg(feature = "galaxy-resolver")]
+//!
+//! The crate-level `#[cfg(feature = "galaxy-resolver")]` gate sits on the
+//! `pub mod sql_resolver` declaration in `lib.rs`, so the inner-attribute
+//! form here would just duplicate that and trip
+//! `clippy::duplicated_attributes`.
 
 use std::sync::OnceLock;
 

rust/crates/mxaccess-nmx/src/client.rs

@@ -169,6 +169,20 @@ pub struct NmxClient {
     /// the call to the right per-engine `INmxService2` instance
     /// (`ManagedNmxService2Client.cs:74,486-488`).
     service_ipid: Guid,
+    /// Holder for the activated COM `IUnknown` proxy when this client
+    /// was built via [`Self::create`]. Mirrors the .NET reference's
+    /// `private readonly object _activatedComObject` field at
+    /// `ManagedNmxService2Client.cs:15`. Holding the IUnknown for the
+    /// client's lifetime keeps the SCM-tracked OXID valid; without it,
+    /// subsequent `ResolveOxid` / `RemQueryInterface` calls hit
+    /// `RPC_S_SERVER_UNAVAILABLE` (1722) once the server-side
+    /// activated instance is released. `None` for clients built via
+    /// [`Self::connect`] / [`Self::from_bound_transport`] — those
+    /// paths get the OBJREF / IPID out-of-band so they don't own the
+    /// COM activation lifetime.
+    #[cfg(all(windows, feature = "windows-com"))]
+    #[allow(dead_code)] // held only for Drop side-effect (release server-side ref)
+    activated_com_object: Option<mxaccess_rpc::com_objref_provider::IUnknownHolder>,
 }
 
 impl NmxClient {
@@ -198,6 +212,8 @@ impl NmxClient {
         Ok(Self {
             transport,
             service_ipid,
+            #[cfg(all(windows, feature = "windows-com"))]
+            activated_com_object: None,
         })
     }
 
@@ -248,7 +264,7 @@ impl NmxClient {
         mut ntlm_factory: impl FnMut() -> NtlmClientContext,
     ) -> Result<Self, NmxClientError> {
         use mxaccess_rpc::com_objref_provider::{
-            marshal_activated_iunknown_objref, MarshalContext,
+            activate_and_marshal_iunknown_objref, MarshalContext,
         };
         use mxaccess_rpc::object_exporter::PROTSEQ_NCACN_IP_TCP;
         use mxaccess_rpc::object_exporter_client::{
@@ -261,7 +277,13 @@ impl NmxClient {
         };
 
         // Step 1+2: Activate NmxSvc.NmxService and parse OBJREF.
-        let blob = marshal_activated_iunknown_objref(
+        // Hold the IUnknown for the lifetime of the returned client —
+        // mirrors `ManagedNmxService2Client._activatedComObject`
+        // (`cs:15`). Without this hold, the COM ref count drops to
+        // zero, the SCM releases the server-side instance, and the
+        // ResolveOxid step below returns RPC_S_SERVER_UNAVAILABLE
+        // (1722). See `IUnknownHolder` doc.
+        let (blob, activated_holder) = activate_and_marshal_iunknown_objref(
             "NmxSvc.NmxService",
             MarshalContext::DifferentMachine,
         )?;
@@ -367,8 +389,12 @@ impl NmxClient {
         // for the same reason — the IRemUnknown bind is single-use.
         drop(rem_qi_client);
 
-        // Step 6: Final transport bound to INmxService2.
-        Self::connect(svc_addr, service_ipid, ntlm_factory()).await
+        // Step 6: Final transport bound to INmxService2. Attach the
+        // `IUnknownHolder` so the COM ref stays alive for the
+        // client's lifetime.
+        let mut client = Self::connect(svc_addr, service_ipid, ntlm_factory()).await?;
+        client.activated_com_object = Some(activated_holder);
+        Ok(client)
     }
 
     /// Construct from an already-bound transport. Useful when a caller
@@ -379,6 +405,8 @@ impl NmxClient {
         Self {
             transport,
             service_ipid,
+            #[cfg(all(windows, feature = "windows-com"))]
+            activated_com_object: None,
         }
     }
 

rust/crates/mxaccess-rpc/Cargo.toml

@@ -27,7 +27,7 @@ subtle = "2"
 # / CoCreateInstance / CoMarshalInterface, Win32_System_Memory for
 # GlobalLock / GlobalSize, Win32_System_Ole for the historical
 # CreateStreamOnHGlobal / GetHGlobalFromStream re-exports.
-windows = { version = "0.59", features = [
+windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_System_Com",
     "Win32_System_Com_Marshal",

rust/crates/mxaccess-rpc/examples/com-marshal-probe.rs

@@ -0,0 +1,42 @@
+//! One-shot probe: run `marshal_activated_iunknown_objref` standalone
+//! to isolate which step in the NMX activation pipeline is failing
+//! with RPC_S_SERVER_UNAVAILABLE (1722) when called from cargo test.
+//!
+//! Run with:
+//! ```text
+//! cargo run -p mxaccess-rpc --example com-marshal-probe --features windows-com
+//! ```
+
+#[cfg(all(windows, feature = "windows-com"))]
+fn main() {
+    use mxaccess_rpc::com_objref_provider::{
+        marshal_activated_iunknown_objref, MarshalContext,
+    };
+
+    eprintln!("step 1: marshal_activated_iunknown_objref(NmxSvc.NmxService, DifferentMachine)");
+    match marshal_activated_iunknown_objref("NmxSvc.NmxService", MarshalContext::DifferentMachine) {
+        Ok(blob) => {
+            eprintln!("OK: {} bytes", blob.len());
+            eprintln!("first 64 bytes (hex):");
+            for chunk in blob.iter().take(64).enumerate() {
+                if chunk.0 % 16 == 0 {
+                    eprint!("\n  ");
+                }
+                eprint!("{:02x} ", chunk.1);
+            }
+            eprintln!();
+        }
+        Err(e) => {
+            eprintln!("FAIL: {e}");
+            std::process::exit(1);
+        }
+    }
+}
+
+#[cfg(not(all(windows, feature = "windows-com")))]
+fn main() {
+    eprintln!(
+        "com-marshal-probe requires Windows + the windows-com feature: \
+         cargo run -p mxaccess-rpc --example com-marshal-probe --features windows-com"
+    );
+}

rust/crates/mxaccess-rpc/src/com_objref_provider.rs

@@ -129,7 +129,7 @@ pub enum ProviderError {
 /// which we accept. If a thread is already initialised to STA we receive
 /// `RPC_E_CHANGED_MODE` — also treated as success (the existing apartment
 /// is fine for `CoMarshalInterface`).
-fn ensure_apartment() -> Result<(), ProviderError> {
+pub fn ensure_apartment() -> Result<(), ProviderError> {
     thread_local! {
         // `OnceLock` per thread guarantees we only attempt CoInitializeEx
         // once per worker; subsequent calls are a no-op.
@@ -192,6 +192,17 @@ pub fn clsid_from_prog_id(prog_id: &str) -> Result<GUID, ProviderError> {
 /// the same default `Activator.CreateInstance` picks up via
 /// `Type.GetTypeFromProgID`.
 ///
+/// **The activated `IUnknown` is dropped at the end of this call.** For
+/// most use cases that's a bug — when the COM ref count goes to zero
+/// the SCM may release the activated server-side instance, which makes
+/// the marshalled OXID invalid for subsequent RPC. Use
+/// [`activate_and_marshal_iunknown_objref`] instead and hold the
+/// returned [`IUnknownHolder`] for the lifetime of the consumer that
+/// uses the OBJREF (typically the lifetime of the client built from
+/// it). This function is retained for callers that consume the OBJREF
+/// inline (e.g. tests / probes that use the bytes immediately and
+/// don't care about the activated server-side lifetime).
+///
 /// # Errors
 ///
 /// [`ProviderError::UnknownProgId`], [`ProviderError::ActivationFailed`],
@@ -200,6 +211,33 @@ pub fn marshal_activated_iunknown_objref(
     prog_id: &str,
     destination_context: MarshalContext,
 ) -> Result<Vec<u8>, ProviderError> {
+    activate_and_marshal_iunknown_objref(prog_id, destination_context).map(|(blob, _holder)| blob)
+}
+
+/// Activate a COM class by ProgID, marshal its `IUnknown`, and return
+/// **both** the OBJREF byte stream **and** an [`IUnknownHolder`] that
+/// keeps the activated server-side instance alive.
+///
+/// This is the .NET-reference-faithful path: `ManagedNmxService2Client`
+/// (`cs:15`) holds the activated COM object as a private field for the
+/// client's lifetime via `_activatedComObject`. The Rust port previously
+/// dropped the IUnknown right after marshalling, which let the SCM
+/// release the server-side instance and made subsequent
+/// `ResolveOxid`/`RemQueryInterface` calls return
+/// `RPC_S_SERVER_UNAVAILABLE` (1722). Holding the
+/// [`IUnknownHolder`] for the client's lifetime fixes that.
+///
+/// The OBJREF blob and the IUnknown both refer to the same activated
+/// server-side instance; keep them paired.
+///
+/// # Errors
+///
+/// [`ProviderError::UnknownProgId`], [`ProviderError::ActivationFailed`],
+/// [`ProviderError::MarshalFailed`], [`ProviderError::GlobalLockFailed`].
+pub fn activate_and_marshal_iunknown_objref(
+    prog_id: &str,
+    destination_context: MarshalContext,
+) -> Result<(Vec<u8>, IUnknownHolder), ProviderError> {
     ensure_apartment()?;
     let clsid = clsid_from_prog_id(prog_id)?;
     let activation_flags = CLSCTX_INPROC_SERVER | CLSCTX_LOCAL_SERVER | CLSCTX_REMOTE_SERVER;
@@ -213,9 +251,51 @@ pub fn marshal_activated_iunknown_objref(
                 hr: e.code().0 as u32,
             }
         })?;
-    marshal_iunknown_objref(&unknown, destination_context)
+    let blob = marshal_iunknown_objref(&unknown, destination_context)?;
+    Ok((blob, IUnknownHolder { inner: unknown }))
 }
 
+/// Owns a live `IUnknown` reference to a COM-activated server-side
+/// instance. Drop releases the reference (the COM proxy's `Release`
+/// runs, which decrements the server-side ref count and may trigger
+/// instance teardown when no other holders remain).
+///
+/// `Send + Sync` because the underlying COM proxy is registered in the
+/// MTA (`COINIT_MULTITHREADED` per [`ensure_apartment`]) and is
+/// therefore safe to invoke from any thread. SAFETY of the unsafe impls
+/// rests on this MTA invariant — callers must not transition the
+/// process apartment to STA after activating an [`IUnknownHolder`].
+pub struct IUnknownHolder {
+    #[allow(dead_code)]
+    inner: IUnknown,
+}
+
+impl IUnknownHolder {
+    /// Wrap an existing `IUnknown` into a holder. Used by callers
+    /// (e.g. `mxaccess-callback::dcom_sink`) that have an `IUnknown`
+    /// from a `windows-rs` `#[implement]` cast and need to keep the
+    /// COM ref alive for the same Path-A reasons documented at the
+    /// type level.
+    #[must_use]
+    pub fn from_iunknown(inner: IUnknown) -> Self {
+        Self { inner }
+    }
+}
+
+impl std::fmt::Debug for IUnknownHolder {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("IUnknownHolder").finish_non_exhaustive()
+    }
+}
+
+// SAFETY: `IUnknownHolder` only ever wraps an MTA-resident COM proxy
+// (see `ensure_apartment` initialising `COINIT_MULTITHREADED`). MTA
+// proxies are thread-neutral by COM contract — calls can originate
+// from any thread without marshalling.
+unsafe impl Send for IUnknownHolder {}
+// SAFETY: same MTA-invariant rationale as `Send`.
+unsafe impl Sync for IUnknownHolder {}
+
 /// Marshal an arbitrary `IUnknown` to an OBJREF byte stream. Mirrors
 /// `MarshalIUnknownObjRef` (`cs:32-35`), passing IID `IID_IUnknown`
 /// (`{00000000-0000-0000-C000-000000000046}`).

rust/crates/mxaccess/Cargo.toml

@@ -45,7 +45,7 @@ serde = ["mxaccess-codec/serde"]
 live = []
 # Pulls F12's `Session::connect_nmx_auto` constructor — the auto-resolving
 # COM-activation path. Propagates to `mxaccess-nmx/windows-com`.
-windows-com = ["mxaccess-nmx/windows-com"]
+windows-com = ["mxaccess-nmx/windows-com", "mxaccess-callback/windows-com"]
 
 [lints]
 workspace = true

rust/crates/mxaccess/examples/asb-subscribe.rs

@@ -131,7 +131,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // -- Subscribe-flow ----------------------------------------------------
     if env.run_subscribe {
-        eprintln!("creating subscription [canonical XML CreateSubscription] (max_queue=100, sample=1s)");
+        eprintln!(
+            "creating subscription [canonical XML CreateSubscription] (max_queue=100, sample=1s)"
+        );
         // SampleInterval is in **milliseconds** on the wire — the .NET
         // reference's `MxAsbDataClient.CreateSubscription` /
         // `AddMonitoredItems` default is `ulong sampleInterval = 1000`
@@ -140,7 +142,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         // poll would always come back empty.
         let sample_interval_ms: u64 = 1000;
         let max_queue_size: i64 = 100;
-        let sub_response = match client.create_subscription(max_queue_size, sample_interval_ms).await {
+        let sub_response = match client
+            .create_subscription(max_queue_size, sample_interval_ms)
+            .await
+        {
             Ok(r) => r,
             Err(e) => {
                 eprintln!("  create_subscription failed: {e}");
@@ -165,11 +170,16 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         )];
 
         eprintln!("adding monitored items [canonical XML AddMonitoredItems]");
-        let add = match client.add_monitored_items(sub_response.subscription_id, &monitored, true).await {
+        let add = match client
+            .add_monitored_items(sub_response.subscription_id, &monitored, true)
+            .await
+        {
             Ok(r) => r,
             Err(e) => {
                 eprintln!("  add_monitored_items failed: {e}");
-                let _ = client.delete_subscription(sub_response.subscription_id).await;
+                let _ = client
+                    .delete_subscription(sub_response.subscription_id)
+                    .await;
                 eprintln!("disconnecting");
                 client.disconnect().await?;
                 client.send_end().await?;
@@ -184,17 +194,24 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             add.status.first().map(|s| s.error_code).unwrap_or(0),
         );
 
-        eprintln!("publishing [canonical XML Publish] (target {} polls × 5s)", env.subscribe_count);
+        eprintln!(
+            "publishing [canonical XML Publish] (target {} polls × 5s)",
+            env.subscribe_count
+        );
         let mut total_values = 0usize;
         for poll in 0..env.subscribe_count {
             match tokio::time::timeout(
                 Duration::from_secs(5),
                 client.publish(sub_response.subscription_id),
-            ).await {
+            )
+            .await
+            {
                 Ok(Ok(resp)) => {
                     eprintln!(
                         "  poll {poll}: {} value(s); result_code={:?} success={:?}",
-                        resp.values.len(), resp.result_code, resp.success
+                        resp.values.len(),
+                        resp.result_code,
+                        resp.success
                     );
                     for v in &resp.values {
                         total_values += 1;
@@ -204,9 +221,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                             v.value.value
                         );
                     }
-                    if resp.result_code
-                        == Some(mxaccess_asb::RESULT_CODE_INVALID_CONNECTION_ID)
-                    {
+                    if resp.result_code == Some(mxaccess_asb::RESULT_CODE_INVALID_CONNECTION_ID) {
                         eprintln!("  publish surfaced InvalidConnectionId; bailing the loop");
                         break;
                     }
@@ -235,12 +250,18 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         }
 
         // -- DeleteMonitoredItems / DeleteSubscription
-        if let Err(e) = client.delete_monitored_items(sub_response.subscription_id, &monitored).await {
+        if let Err(e) = client
+            .delete_monitored_items(sub_response.subscription_id, &monitored)
+            .await
+        {
             eprintln!("delete_monitored_items failed: {e}");
         } else {
             eprintln!("delete_monitored_items ok [canonical XML DeleteMonitoredItems]");
         }
-        if let Err(e) = client.delete_subscription(sub_response.subscription_id).await {
+        if let Err(e) = client
+            .delete_subscription(sub_response.subscription_id)
+            .await
+        {
             eprintln!("delete_subscription failed: {e}");
         } else {
             eprintln!("delete_subscription ok [canonical XML DeleteSubscription]");
@@ -290,8 +311,12 @@ impl LiveEnv {
         let via_uri =
             std::env::var("MX_ASB_VIA").unwrap_or_else(|_| format!("net.tcp://{host}/ASBService"));
         let tag = std::env::var("MX_TEST_TAG").unwrap_or_else(|_| "TestChildObject.TestInt".into());
-        let run_write = std::env::var("MX_RUN_WRITE").map(|v| v != "0").unwrap_or(true);
-        let run_subscribe = std::env::var("MX_RUN_SUBSCRIBE").map(|v| v != "0").unwrap_or(true);
+        let run_write = std::env::var("MX_RUN_WRITE")
+            .map(|v| v != "0")
+            .unwrap_or(true);
+        let run_subscribe = std::env::var("MX_RUN_SUBSCRIBE")
+            .map(|v| v != "0")
+            .unwrap_or(true);
         let subscribe_count = std::env::var("MX_SUBSCRIBE_COUNT")
             .ok()
             .and_then(|s| s.parse().ok())

rust/crates/mxaccess/examples/asb-type-matrix.rs

@@ -0,0 +1,254 @@
+//! `asb-type-matrix` — exercise every `AsbVariant` type the codec supports
+//! against a live AVEVA endpoint. Closes F51 ("live type-matrix expansion
+//! for the ASB Variant codec"). Resolves all of Bool / Int32 / Float /
+//! Double / String / DateTime / Duration in both scalar and array shape
+//! by reading + dumping the wire bytes for fixture extraction.
+//!
+//! Required env (populate via `tools/Setup-LiveProbeEnv.ps1`):
+//!
+//! - `MX_LIVE` (any non-empty value enables the live path)
+//! - `MX_ASB_HOST`, `MX_ASB_PASSPHRASE`, `MX_ASB_VIA` — same as `asb-subscribe`.
+//!
+//! No `MX_TEST_TAG` — the matrix is hard-coded so the live evidence
+//! always covers the full set. Override individual tags by editing
+//! `MATRIX` below if a Galaxy uses different fixture names.
+
+use std::path::PathBuf;
+use std::time::Duration;
+
+use mxaccess::AsbTransport;
+use mxaccess_asb::ItemIdentity;
+use mxaccess_asb_nettcp::auth::{CryptoParameters, HashAlgorithm};
+use mxaccess_codec::AsbVariant;
+
+/// One row of the live matrix — `(reference, expected MxDataType label)`.
+/// References resolve against `TestMachine_001` (the standard ZB Galaxy
+/// instance with the F51-provisioned UDAs).
+const MATRIX: &[(&str, &str)] = &[
+    // Pre-existing fixtures (covered live since M5 wave 7).
+    ("TestMachine_001.TestChangingInt", "Int32 (scalar)"),
+    ("TestMachine_001.TestAlarm001", "Boolean (scalar)"),
+    ("TestMachine_001.MachineCode", "String (scalar)"),
+    ("TestMachine_001.TestIntArray", "Int32 (array)"),
+    ("TestMachine_001.TestBoolArray", "Boolean (array)"),
+    ("TestMachine_001.TestStringArray", "String (array)"),
+    ("TestMachine_001.TestDateTimeArray", "DateTime (array)"),
+    // F51-provisioned fixtures.
+    ("TestMachine_001.TestFloat", "Float (scalar)"),
+    ("TestMachine_001.TestFloatArray", "Float (array)"),
+    ("TestMachine_001.TestDouble", "Double (scalar)"),
+    ("TestMachine_001.TestDoubleArray", "Double (array)"),
+    ("TestMachine_001.TestDateTime", "DateTime (scalar)"),
+    ("TestMachine_001.TestDuration", "ElapsedTime (scalar)"),
+    ("TestMachine_001.TestDurationArray", "ElapsedTime (array)"),
+];
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let Some(env) = LiveEnv::from_process()? else {
+        eprintln!(
+            "MX_LIVE not set — skipping live demo. Run \
+             `. tools/Setup-LiveProbeEnv.ps1` to populate the required env vars."
+        );
+        return Ok(());
+    };
+
+    eprintln!("connecting ASB at {} via {} ...", env.addr, env.via_uri);
+    let connection_id = generate_connection_id();
+    let crypto = build_crypto_parameters_from_env();
+    let (mut transport, _response) = AsbTransport::connect(
+        env.addr,
+        &env.passphrase,
+        &crypto,
+        &env.via_uri,
+        connection_id,
+    )
+    .await?;
+    transport.client_mut().authenticator_mut().use_apollo_signing();
+    let client = transport.client_mut();
+
+    // Single batch register / read / unregister cycle — matches the
+    // .NET reference's `MxAsbDataClient.RegisterItems` pattern (one
+    // call with the full item list). Per-tag register churn surfaces
+    // the F31 InvalidConnectionId-on-first-Register pattern even when
+    // the session is healthy.
+    let items: Vec<ItemIdentity> = MATRIX
+        .iter()
+        .map(|(tag, _)| ItemIdentity::absolute_by_name(*tag))
+        .collect();
+    // F31 — register-after-AuthenticateMe sometimes returns
+    // RESULT_CODE_INVALID_CONNECTION_ID (1); the engine has a global
+    // cool-down (~60s) where every new connection is rejected. Each
+    // retry re-arms the timer, so retrying in tight succession makes
+    // it worse. Single attempt; if it fails, wait 60s+ before
+    // re-running the example.
+    eprintln!("registering {} items in one batch", items.len());
+    let register = client.register_items(&items, true, false).await?;
+    if register.result_code == Some(mxaccess_asb::RESULT_CODE_INVALID_CONNECTION_ID) {
+        eprintln!(
+            "  register hit InvalidConnectionId (result_code 1). Engine is in the F31 cool-down. \
+             Wait 60+ seconds with no live ASB activity, then re-run."
+        );
+        // Best-effort cleanup so we don't leave a half-open connection.
+        let _ = client.disconnect().await;
+        let _ = client.send_end().await;
+        return Ok(());
+    }
+    eprintln!(
+        "register: result_code={:?} success={:?} status_len={}",
+        register.result_code,
+        register.success,
+        register.status.len()
+    );
+    for (i, st) in register.status.iter().enumerate() {
+        let tag = MATRIX.get(i).map(|(t, _)| *t).unwrap_or("?");
+        eprintln!(
+            "  [{i:>2}] {tag} -> error_code=0x{ec:04x}",
+            ec = st.error_code
+        );
+    }
+
+    eprintln!("reading {} items (timeout 10s)", items.len());
+    let read = tokio::time::timeout(Duration::from_secs(10), client.read(&items)).await??;
+    eprintln!(
+        "read: result_code={:?} success={:?} values={} status={}",
+        read.result_code,
+        read.success,
+        read.values.len(),
+        read.status.len()
+    );
+    let mut value_returns = 0usize;
+    for (i, value) in read.values.iter().enumerate() {
+        let var = &value.value;
+        let label = MATRIX.get(i).map(|(_, l)| *l).unwrap_or("?");
+        let tag = MATRIX.get(i).map(|(t, _)| *t).unwrap_or("?");
+        println!(
+            "  [{i:>2}] {tag} ({label}) = type_id={type_id} length={length} payload={n} bytes",
+            type_id = var.type_id,
+            length = var.length,
+            n = var.payload.len(),
+        );
+        if !var.payload.is_empty() {
+            value_returns += 1;
+        }
+    }
+
+    // Optionally dump each variant's wire bytes to a fixture file so
+    // the round-trip tests can pin them. Set MX_ASB_DUMP_FIXTURES to
+    // the target directory path.
+    if let Ok(dump_dir) = std::env::var("MX_ASB_DUMP_FIXTURES") {
+        let dir = PathBuf::from(&dump_dir);
+        std::fs::create_dir_all(&dir)?;
+        for (i, value) in read.values.iter().enumerate() {
+            let tag = MATRIX.get(i).map(|(t, _)| *t).unwrap_or("unknown");
+            let safe = tag.replace('.', "_");
+            let path = dir.join(format!("{safe}.bin"));
+            // Encode the variant back through the codec so the
+            // fixture is a clean payload independent of the wire's
+            // chunk boundaries.
+            let encoded = AsbVariant {
+                type_id: value.value.type_id,
+                length: value.value.length,
+                payload: value.value.payload.clone(),
+            }
+            .encode();
+            std::fs::write(&path, &encoded)?;
+            eprintln!(
+                "  dumped {} ({} bytes) -> {}",
+                tag,
+                encoded.len(),
+                path.display()
+            );
+        }
+    }
+
+    if let Err(e) = client.unregister_items(&items).await {
+        eprintln!("unregister failed: {e}");
+    }
+
+    eprintln!(
+        "--- summary: {value_returns} non-empty payloads across {} items ---",
+        MATRIX.len()
+    );
+
+    eprintln!("disconnecting");
+    client.disconnect().await?;
+    client.send_end().await?;
+    Ok(())
+}
+
+// ---- shared boilerplate (matches asb-subscribe.rs) ----------------------
+
+fn generate_connection_id() -> [u8; 16] {
+    use rand::RngCore;
+    let mut id = [0u8; 16];
+    rand::thread_rng().fill_bytes(&mut id);
+    id
+}
+
+struct LiveEnv {
+    addr: std::net::SocketAddr,
+    via_uri: String,
+    passphrase: String,
+}
+
+impl LiveEnv {
+    fn from_process() -> Result<Option<Self>, Box<dyn std::error::Error>> {
+        if std::env::var_os("MX_LIVE").is_none() {
+            return Ok(None);
+        }
+        let host = std::env::var("MX_ASB_HOST")?;
+        let addr = parse_host_port(&host, 808)?;
+        let via_uri = std::env::var("MX_ASB_VIA")
+            .unwrap_or_else(|_| format!("net.tcp://{host}/ASBService"));
+        let passphrase = std::env::var("MX_ASB_PASSPHRASE")?;
+        Ok(Some(Self {
+            addr,
+            via_uri,
+            passphrase,
+        }))
+    }
+}
+
+fn build_crypto_parameters_from_env() -> CryptoParameters {
+    let mut params = CryptoParameters::defaults();
+    if let Ok(prime) = std::env::var("MX_ASB_DH_PRIME") {
+        params.prime_decimal = prime;
+    }
+    if let Ok(generator) = std::env::var("MX_ASB_DH_GENERATOR") {
+        params.generator_decimal = generator;
+    }
+    if let Ok(hash) = std::env::var("MX_ASB_DH_HASH_ALGORITHM") {
+        params.hash_algorithm = match hash.to_ascii_lowercase().as_str() {
+            "md5" => HashAlgorithm::Md5,
+            "sha1" => HashAlgorithm::Sha1,
+            "sha512" => HashAlgorithm::Sha512,
+            _ => HashAlgorithm::Unrecognised,
+        };
+    }
+    if let Ok(size) = std::env::var("MX_ASB_DH_KEY_SIZE") {
+        if let Ok(parsed) = size.parse::<u32>() {
+            params.key_size_bits = parsed;
+        }
+    }
+    params
+}
+
+fn parse_host_port(
+    s: &str,
+    default_port: u16,
+) -> Result<std::net::SocketAddr, Box<dyn std::error::Error>> {
+    if let Ok(addr) = s.parse() {
+        return Ok(addr);
+    }
+    let with_port = if s.contains(':') {
+        s.to_string()
+    } else {
+        format!("{s}:{default_port}")
+    };
+    Ok(
+        std::net::ToSocketAddrs::to_socket_addrs(&with_port.as_str())?
+            .next()
+            .ok_or("no addrs resolved")?,
+    )
+}

rust/crates/mxaccess/src/asb_session.rs

@@ -60,7 +60,7 @@ use mxaccess_asb::{
 };
 use mxaccess_asb_nettcp::auth::CryptoParameters;
 use tokio::net::TcpStream;
-use tokio::sync::{mpsc, Mutex};
+use tokio::sync::{Mutex, mpsc};
 use tokio::task::JoinHandle;
 use tokio_stream::wrappers::ReceiverStream;
 
@@ -410,17 +410,13 @@ async fn publish_loop<F, Fut>(
                 // on every Publish poll while values are still
                 // delivered, so blanket "bail on any non-zero"
                 // (the original F33 fix) was too aggressive.
-                if response.result_code
-                    == Some(mxaccess_asb::RESULT_CODE_INVALID_CONNECTION_ID)
-                {
+                if response.result_code == Some(mxaccess_asb::RESULT_CODE_INVALID_CONNECTION_ID) {
                     let _ = tx
-                        .send(Err(Error::Connection(
-                            ConnectionError::TransportFailure {
-                                detail: "publish returned InvalidConnectionId — \
+                        .send(Err(Error::Connection(ConnectionError::TransportFailure {
+                            detail: "publish returned InvalidConnectionId — \
                                         session desynced, terminating stream"
-                                    .to_string(),
-                            },
-                        )))
+                                .to_string(),
+                        })))
                         .await;
                     return;
                 }
@@ -609,7 +605,13 @@ mod tests {
         let calls_clone = calls.clone();
         let publish_fn = move || {
             calls_clone.fetch_add(1, Ordering::Relaxed);
-            async move { Ok(fake_response(vec![fake_value(7), fake_value(8), fake_value(9)])) }
+            async move {
+                Ok(fake_response(vec![
+                    fake_value(7),
+                    fake_value(8),
+                    fake_value(9),
+                ]))
+            }
         };
         // Drop the receiver immediately — first send triggers exit.
         drop(rx);

rust/crates/mxaccess/src/lib.rs

@@ -18,13 +18,15 @@
 //! deferred work tracker.
 
 #![forbid(unsafe_code)]
+#![warn(missing_docs)]
 
 use std::borrow::Cow;
 use std::sync::Arc;
 use std::time::{Duration, SystemTime};
 
 pub use mxaccess_codec::{
-    MxDataType, MxReferenceHandle, MxStatus, MxStatusCategory, MxStatusSource, MxValue, MxValueKind,
+    MxDataType, MxReferenceHandle, MxStatus, MxStatusCategory, MxStatusSource, MxValue,
+    MxValueKind, NmxOperationStatusFormat, NmxOperationStatusMessage,
 };
 
 // ---- Public types --------------------------------------------------------
@@ -39,7 +41,9 @@ pub use transport_asb::AsbTransport;
 
 pub use mxaccess_galaxy::{GalaxyTagMetadata, Resolver, ResolverError};
 pub use mxaccess_nmx::WriteValue;
-pub use session::{RebuildFactory, Subscription};
+pub use session::{
+    OperationContext, OperationKind, OperationStatus, RebuildFactory, Subscription, WriteHandle,
+};
 
 /// Async session façade. Cheap clones share the inner state; drop of the last
 /// clone fires `UnregisterEngine` best-effort. For deterministic shutdown,
@@ -57,11 +61,16 @@ pub struct Session {
 /// `wwtools/mxaccesscli/docs/api-notes.md:104-105`.
 #[derive(Debug, Clone)]
 pub struct DataChange {
+    /// Tag reference the update applies to.
     pub reference: Arc<str>,
+    /// Decoded value payload.
     pub value: MxValue,
     /// Legacy 16-bit OPC quality. Distinct from `status: MxStatus`.
     pub quality: u16,
+    /// Wire-recorded timestamp (Windows FILETIME-derived) for the update.
     pub timestamp: SystemTime,
+    /// Richer category-model status. Complements `quality` for callers
+    /// that want the modern MxStatus taxonomy.
     pub status: MxStatus,
 }
 
@@ -122,9 +131,16 @@ impl BufferedOptions {
     }
 }
 
+/// Caller identity for secured-write operations. Mirrors the .NET
+/// reference's two-user-id pattern (`current_user_id` is the actor;
+/// `verifier_user_id` is the supervisor approving the change). Both
+/// fields are required by the wire op even when the same user fills
+/// both roles — pass the same id twice for single-user secured writes.
 #[derive(Debug, Clone)]
 pub struct SecurityContext {
+    /// User id of the caller initiating the write.
     pub current_user_id: i32,
+    /// User id of the verifier (supervisor) approving the write.
     pub verifier_user_id: i32,
 }
 
@@ -132,17 +148,32 @@ pub struct SecurityContext {
 #[derive(Debug, Clone)]
 pub struct ConnectionOptions;
 
+/// Discriminator for which transport produced (or should consume) a
+/// given session, error, or capability set. Surfaces in
+/// [`Error::Unsupported`] to identify the transport that rejected an
+/// operation and in [`TransportCapabilities`] indirectly.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 #[non_exhaustive]
 pub enum TransportKind {
+    /// NMX (DCE/RPC over `INmxService2` to NmxSvc.exe).
     Nmx,
+    /// ASB (`IASBIDataV2` over net.tcp to MxDataProvider).
     Asb,
 }
 
+/// Per-transport capability flags — used by feature-detection helpers
+/// to query what an open session supports without spelunking through
+/// transport-specific docs.
 #[derive(Debug, Clone, Copy)]
 pub struct TransportCapabilities {
+    /// `true` if the transport supports a server-side buffered
+    /// delivery cadence (NMX yes; ASB no — gated at API level).
     pub buffered_subscribe: bool,
+    /// `true` if the transport supports the `Activate` / `Suspend`
+    /// pair on a subscribed item (NMX yes; ASB no).
     pub activate_suspend: bool,
+    /// `true` if the transport surfaces an OperationComplete frame
+    /// post-write (NMX yes via `OnWriteComplete`; ASB no).
     pub operation_complete_frame: bool,
 }
 
@@ -193,23 +224,38 @@ impl Default for RecoveryPolicy {
     }
 }
 
+/// Recovery-attempt lifecycle event broadcast on
+/// [`Session::recovery_events`].
+///
 /// Not `Clone` — `Error` is not `Clone`-able (thiserror chains an
 /// `io::Error` source which is not `Clone`). Consumers that need to clone an
 /// event should wrap it in `Arc`.
 #[derive(Debug)]
 #[non_exhaustive]
 pub enum RecoveryEvent {
+    /// `recover_connection` started a new attempt. `attempt` is
+    /// 1-indexed and counts only attempts driven by the current
+    /// `recover_connection` invocation (resets on a fresh call).
     Started {
+        /// 1-indexed attempt counter.
         attempt: u32,
     },
+    /// An attempt failed. `error` is the underlying cause; `will_retry`
+    /// is `true` when the configured [`RecoveryPolicy`] still has
+    /// retry budget.
     Failed {
+        /// 1-indexed attempt counter.
         attempt: u32,
+        /// Underlying error that caused the failure.
         error: Error,
         /// Whether the configured policy will retry. Mirrors
         /// `MxNativeRecoveryFailureEvent.WillRetry` (`MxNativeSession.cs:47-51`).
         will_retry: bool,
     },
+    /// Recovery completed successfully. `attempt` is the index of the
+    /// successful attempt.
     Recovered {
+        /// 1-indexed attempt counter.
         attempt: u32,
     },
 }
@@ -239,12 +285,20 @@ pub enum RecoveryEvent {
 /// `RegisterEngine2`.
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct SessionOptions {
+    /// Local engine id advertised to NmxSvc. Default: `0x7000 + (pid & 0x0FFF)`.
     pub local_engine_id: i32,
+    /// Engine name string sent to `RegisterEngine2`. Default: `mxaccess.<pid>`.
     pub engine_name: String,
+    /// Partner-version negotiated with NmxSvc. Default: `6`.
     pub partner_version: i32,
+    /// Galaxy id for routing. Default: `1`.
     pub galaxy_id: u8,
+    /// Source-platform id for outbound NMX envelopes. Default: `1`.
     pub source_platform_id: i32,
+    /// `Some(n)` enables `SetHeartbeatSendInterval(n, ...)` after register;
+    /// `None` skips the heartbeat config call entirely (default).
     pub heartbeat_ticks_per_beat: Option<i32>,
+    /// Heartbeat tolerance — only used when `heartbeat_ticks_per_beat` is `Some`.
     pub heartbeat_max_missed_ticks: i32,
 }
 
@@ -287,43 +341,63 @@ impl Default for SessionOptions {
 
 // ---- Error taxonomy ------------------------------------------------------
 
+/// Top-level error returned by every fallible `mxaccess` API. The
+/// variants partition errors into stable categories so consumers can
+/// match on shape without spelunking nested error types.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum Error {
+    /// Transport bring-up or runtime connection-state failure.
     #[error("connection: {0}")]
     Connection(#[from] ConnectionError),
 
+    /// NTLM or other authentication failure.
     #[error("authentication: {0}")]
     Auth(#[from] AuthError),
 
+    /// Wire protocol / codec violation (decode failure, size mismatch).
     #[error("protocol: {0}")]
     Protocol(#[from] ProtocolError),
 
+    /// Caller-supplied options or arguments rejected pre-flight.
     #[error("configuration: {0}")]
     Configuration(#[from] ConfigError),
 
+    /// `MxValue` kind doesn't match what the resolver / engine expects
+    /// for the named tag.
     #[error("type mismatch on {reference}: expected {expected:?}, got {actual:?}")]
     TypeMismatch {
+        /// Tag reference whose write/read triggered the mismatch.
         reference: Arc<str>,
+        /// Kind the engine / resolver expected.
         expected: MxValueKind,
+        /// Kind the caller supplied (or the wire returned).
         actual: MxValueKind,
     },
 
+    /// Galaxy- or session-level security check rejected the operation.
     #[error("security: {0}")]
     Security(#[from] SecurityError),
 
+    /// Operation isn't supported on the chosen transport
+    /// (e.g. `subscribe_buffered` on ASB).
     #[error("unsupported on {transport:?} transport: {operation}")]
     Unsupported {
+        /// Human-readable name of the operation that was rejected.
         operation: Cow<'static, str>,
+        /// Transport that rejected the operation.
         transport: TransportKind,
     },
 
+    /// Operation didn't complete within its timeout budget.
     #[error("operation timed out after {0:?}")]
     Timeout(Duration),
 
+    /// Operation was cancelled (e.g. via cancellation token / `drop`).
     #[error("operation cancelled")]
     Cancelled,
 
+    /// Server-reported MxStatus (decoded category + detail).
     // Field is named `detected_by` (not `source`) to match the codec's
     // `MxStatus.detected_by` and to avoid thiserror's `#[source]` attribute
     // semantics (which would require `MxStatusSource: std::error::Error`).
@@ -331,23 +405,37 @@ pub enum Error {
         "status: success={success} category={category:?} detected_by={detected_by:?} detail={detail}"
     )]
     Status {
+        /// `0` = success, non-zero = failure with the rest of the
+        /// fields populated.
         success: i16,
+        /// Status category as decoded from the wire (`MxStatusCategory`).
         category: MxStatusCategory,
+        /// Layer that originally detected the failure.
         detected_by: MxStatusSource,
+        /// Detail code carrying the specific reason.
         detail: i16,
     },
 
+    /// Underlying I/O error from the transport socket.
     #[error("io: {0}")]
     Io(#[from] std::io::Error),
 }
 
+/// Connection / transport-bring-up failure modes.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum ConnectionError {
+    /// RPC server (NmxSvc / MxDataProvider) unreachable or refused
+    /// the connection.
     #[error("RPC server unavailable")]
     ServerUnavailable,
+    /// COM proxy/stub for the callback interface isn't registered on
+    /// the box (`REGDB_E_CLASSNOTREG` from the SCM).
     #[error("callback proxy/stub not registered (REGDB_E_CLASSNOTREG)")]
     CallbackProxyMissing,
+    /// `RegisterEngine2` returned non-zero, OR an operation was
+    /// attempted on a session whose engine wasn't registered (e.g.
+    /// post-shutdown).
     #[error("engine not registered (UninitializedObject / ERROR_INVALID_STATE)")]
     EngineNotRegistered,
     /// Transport bring-up failed during preamble exchange or
@@ -356,50 +444,86 @@ pub enum ConnectionError {
     /// keep the public taxonomy small. ASB-specific (F26 step 2);
     /// `EngineNotRegistered` covers the analogous NMX failure mode.
     #[error("transport bring-up failed: {detail}")]
-    TransportFailure { detail: String },
+    TransportFailure {
+        /// Stringified underlying-error detail.
+        detail: String,
+    },
 }
 
+/// Authentication-side failures.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum AuthError {
+    /// NTLM handshake rejected by the peer.
     #[error("NTLM rejected: {reason}")]
-    Ntlm { reason: String },
+    Ntlm {
+        /// Human-readable reason from the underlying NTLM stack.
+        reason: String,
+    },
 }
 
+/// Wire-protocol violations surfaced by the codec layer.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum ProtocolError {
+    /// Decode failure at a specific buffer offset.
     #[error("decode at offset {offset} ({reason}); buffer len {buffer_len}")]
     Decode {
+        /// Byte offset within the buffer where decoding failed.
         offset: usize,
+        /// Static description of the violation.
         reason: &'static str,
+        /// Total buffer length (for context in error messages).
         buffer_len: usize,
     },
+    /// Outer envelope's declared inner length doesn't match the actual body size.
     #[error("inner length {declared} does not match body length {actual}")]
-    InnerLengthMismatch { declared: i32, actual: usize },
+    InnerLengthMismatch {
+        /// Inner length declared in the envelope header.
+        declared: i32,
+        /// Actual remaining body length on the wire.
+        actual: usize,
+    },
+    /// First-byte command opcode wasn't recognised by the parser.
     #[error("unexpected opcode {0:#x}")]
     UnexpectedOpcode(u8),
 }
 
+/// Caller-side configuration / argument errors.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum ConfigError {
+    /// Argument failed pre-flight validation. `detail` carries the
+    /// specific reason (which arg, what was wrong).
     #[error("invalid argument: {detail}")]
-    InvalidArgument { detail: String },
+    InvalidArgument {
+        /// Human-readable description of the rejected argument.
+        detail: String,
+    },
+    /// Galaxy resolver returned an error during tag resolution.
     #[error("galaxy resolver: {reason}")]
-    Galaxy { reason: String },
+    Galaxy {
+        /// Underlying resolver error message.
+        reason: String,
+    },
     /// `Session::recover_connection` was called without a
     /// [`crate::RebuildFactory`] installed via
     /// [`crate::Session::set_recovery_factory`]. F16.
-    #[error("recover_connection: no rebuild factory installed (call Session::set_recovery_factory)")]
+    #[error(
+        "recover_connection: no rebuild factory installed (call Session::set_recovery_factory)"
+    )]
     RecoveryNotConfigured,
 }
 
+/// Security-related operation rejection.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum SecurityError {
+    /// NmxSvc rejected our callback OBJREF (`HRESULT 0x8001011D`).
     #[error("callback OBJREF rejected (HRESULT 0x8001011D)")]
     CallbackObjRefRejected,
+    /// Caller invoked a secured-write op without supplying the
+    /// verifier user id.
     #[error("verifier user token required for secured write")]
     VerifierRequired,
 }
@@ -409,10 +533,14 @@ pub enum SecurityError {
 /// Generic-only trait — `dyn Transport` is intentionally unsupported (see
 /// design/20-async-layer.md L53 fix). Consumers parameterise on `<T: Transport>`.
 pub trait Transport: Send + Sync + 'static {
+    /// Reports per-transport capability flags so callers can
+    /// feature-gate without hard-coding transport identity.
     fn capabilities(&self) -> TransportCapabilities;
+    /// Reports which [`TransportKind`] this implementation produces.
     fn kind(&self) -> TransportKind;
 }
 
+
 // ---- Session API surface -------------------------------------------------
 //
 // The `*_value` family in `session.rs` takes `WriteValue` (the codec's
@@ -454,8 +582,24 @@ impl Session {
     /// `ElapsedTime` and their array variants — see module-level note
     /// for why).
     pub async fn write(&self, reference: &str, value: MxValue) -> Result<(), Error> {
+        self.write_with_handle(reference, value).await.map(|_| ())
+    }
+
+    /// `MxValue` overload of [`Self::write_value_with_handle`]. Same
+    /// conversion rules as [`Self::write`]; returns the
+    /// [`session::WriteHandle`] inserted into the session's
+    /// `pending_ops` registry so the caller can correlate this write
+    /// to a later [`session::OperationStatus`] event (F54).
+    ///
+    /// # Errors
+    /// As for [`Self::write`].
+    pub async fn write_with_handle(
+        &self,
+        reference: &str,
+        value: MxValue,
+    ) -> Result<session::WriteHandle, Error> {
         let wv = mxvalue_to_writevalue(value)?;
-        self.write_value(reference, wv).await
+        self.write_value_with_handle(reference, wv).await
     }
 
     /// Write-with-completion — paired write + `OperationComplete`
@@ -496,9 +640,26 @@ impl Session {
         value: MxValue,
         timestamp: SystemTime,
     ) -> Result<(), Error> {
+        self.write_with_timestamp_and_handle(reference, value, timestamp)
+            .await
+            .map(|_| ())
+    }
+
+    /// `MxValue` overload of [`Self::write_value_at_with_handle`].
+    /// Same conversion rules as [`Self::write_with_timestamp`]; returns
+    /// the [`session::WriteHandle`] for F54 correlation.
+    ///
+    /// # Errors
+    /// As for [`Self::write_with_timestamp`].
+    pub async fn write_with_timestamp_and_handle(
+        &self,
+        reference: &str,
+        value: MxValue,
+        timestamp: SystemTime,
+    ) -> Result<session::WriteHandle, Error> {
         let wv = mxvalue_to_writevalue(value)?;
         let ft = session::system_time_to_filetime(timestamp)?;
-        self.write_value_at(reference, wv, ft).await
+        self.write_value_at_with_handle(reference, wv, ft).await
     }
 
     /// Verified Write without an explicit timestamp. Currently
@@ -540,9 +701,27 @@ impl Session {
         timestamp: SystemTime,
         security: SecurityContext,
     ) -> Result<(), Error> {
+        self.write_secured_at_with_handle(reference, value, timestamp, security)
+            .await
+            .map(|_| ())
+    }
+
+    /// `MxValue` overload of [`Self::write_value_secured_at_with_handle`].
+    /// Same conversion rules as [`Self::write_secured_at`]; returns
+    /// the [`session::WriteHandle`] for F54 correlation.
+    ///
+    /// # Errors
+    /// As for [`Self::write_secured_at`].
+    pub async fn write_secured_at_with_handle(
+        &self,
+        reference: &str,
+        value: MxValue,
+        timestamp: SystemTime,
+        security: SecurityContext,
+    ) -> Result<session::WriteHandle, Error> {
         let wv = mxvalue_to_writevalue(value)?;
         let ft = session::system_time_to_filetime(timestamp)?;
-        self.write_value_secured_at(reference, wv, ft, security)
+        self.write_value_secured_at_with_handle(reference, wv, ft, security)
             .await
     }
 

tools/Setup-LiveProbeEnv.ps1

@@ -67,12 +67,23 @@ function Set-LiveEnvVar {
 
 function Get-InfisicalSecret {
     param([string]$Key, [string]$Env = 'infrastructure', [string]$Path = '/windows-hosts')
+    # Capture stdout only — the infisical CLI writes its
+    # "A new release of infisical is available" upgrade banner (and any
+    # transient diagnostic noise) to STDERR. We deliberately do NOT use
+    # `2>&1` here so that banner stays in the error stream (visible on
+    # the console for diagnostics) and never pollutes the secret value.
+    # An earlier version of this function used `2>&1` plus a regex-based
+    # banner filter; that approach was brittle to future banner shapes,
+    # so it was replaced with stream separation. If a real error needs
+    # to be surfaced, $LASTEXITCODE catches it below.
     try {
-        $value = & $GetSecret -Key $Key -Env $Env -Path $Path 2>&1
-        if ($LASTEXITCODE -ne 0 -or -not $value) {
-            throw "Get-Secret returned empty for $Env$Path/$Key (exit code $LASTEXITCODE)"
+        $value = & $GetSecret -Key $Key -Env $Env -Path $Path
+        if ($LASTEXITCODE -ne 0) {
+            throw "Get-Secret exit code $LASTEXITCODE for $Env$Path/$Key"
+        }
+        if (-not $value) {
+            throw "Get-Secret returned empty stdout for $Env$Path/$Key"
         }
-        # Trim any trailing whitespace from the CLI output
         return ($value | Out-String).Trim()
     } catch {
         throw "Failed to fetch $Env$Path/$Key from Infisical: $_"