getEventsList() {
@@ -69577,6 +69654,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
}
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public int getEventsCount() {
@@ -69587,6 +69671,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
}
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public mxaccess_gateway.v1.MxaccessGateway.MxEvent getEvents(int index) {
@@ -69597,6 +69688,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
}
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder setEvents(
@@ -69614,6 +69712,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder setEvents(
@@ -69628,6 +69733,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder addEvents(mxaccess_gateway.v1.MxaccessGateway.MxEvent value) {
@@ -69644,6 +69756,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder addEvents(
@@ -69661,6 +69780,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder addEvents(
@@ -69675,6 +69801,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder addEvents(
@@ -69689,6 +69822,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder addAllEvents(
@@ -69704,6 +69844,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder clearEvents() {
@@ -69717,6 +69864,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public Builder removeEvents(int index) {
@@ -69730,6 +69884,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return this;
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public mxaccess_gateway.v1.MxaccessGateway.MxEvent.Builder getEventsBuilder(
@@ -69737,6 +69898,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
return internalGetEventsFieldBuilder().getBuilder(index);
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public mxaccess_gateway.v1.MxaccessGateway.MxEventOrBuilder getEventsOrBuilder(
@@ -69747,6 +69915,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
}
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public java.util.List
@@ -69758,6 +69933,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
}
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public mxaccess_gateway.v1.MxaccessGateway.MxEvent.Builder addEventsBuilder() {
@@ -69765,6 +69947,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
mxaccess_gateway.v1.MxaccessGateway.MxEvent.getDefaultInstance());
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public mxaccess_gateway.v1.MxaccessGateway.MxEvent.Builder addEventsBuilder(
@@ -69773,6 +69962,13 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
index, mxaccess_gateway.v1.MxaccessGateway.MxEvent.getDefaultInstance());
}
/**
+ *
+ * The reply is bounded by both a server-side count cap and the negotiated
+ * worker-frame byte cap; a reply may therefore carry fewer events than
+ * `max_events` and fewer than are queued. Callers drain iteratively until an
+ * empty reply.
+ *
+ *
* repeated .mxaccess_gateway.v1.MxEvent events = 1;
*/
public java.util.List
@@ -75305,6 +75501,11 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
* after_worker_sequence = oldest_available_sequence - 1 in the next
* StreamEventsRequest, which will cause the server to replay starting at
* oldest_available_sequence (the first retained event).
+ * When nothing is retained (the replay ring is empty), this is the next sequence
+ * that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ * formula remains valid: it resolves to the highest sequence already seen, so the
+ * follow-up resume replays nothing, reports no gap, and every newer live event
+ * passes. The interval evicted is unchanged.
*
*
* uint64 oldest_available_sequence = 2;
@@ -75386,6 +75587,11 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
* after_worker_sequence = oldest_available_sequence - 1 in the next
* StreamEventsRequest, which will cause the server to replay starting at
* oldest_available_sequence (the first retained event).
+ * When nothing is retained (the replay ring is empty), this is the next sequence
+ * that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ * formula remains valid: it resolves to the highest sequence already seen, so the
+ * follow-up resume replays nothing, reports no gap, and every newer live event
+ * passes. The interval evicted is unchanged.
*
*
* uint64 oldest_available_sequence = 2;
@@ -75781,6 +75987,11 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
* after_worker_sequence = oldest_available_sequence - 1 in the next
* StreamEventsRequest, which will cause the server to replay starting at
* oldest_available_sequence (the first retained event).
+ * When nothing is retained (the replay ring is empty), this is the next sequence
+ * that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ * formula remains valid: it resolves to the highest sequence already seen, so the
+ * follow-up resume replays nothing, reports no gap, and every newer live event
+ * passes. The interval evicted is unchanged.
*
*
* uint64 oldest_available_sequence = 2;
@@ -75800,6 +76011,11 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
* after_worker_sequence = oldest_available_sequence - 1 in the next
* StreamEventsRequest, which will cause the server to replay starting at
* oldest_available_sequence (the first retained event).
+ * When nothing is retained (the replay ring is empty), this is the next sequence
+ * that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ * formula remains valid: it resolves to the highest sequence already seen, so the
+ * follow-up resume replays nothing, reports no gap, and every newer live event
+ * passes. The interval evicted is unchanged.
*
*
* uint64 oldest_available_sequence = 2;
@@ -75823,6 +76039,11 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
* after_worker_sequence = oldest_available_sequence - 1 in the next
* StreamEventsRequest, which will cause the server to replay starting at
* oldest_available_sequence (the first retained event).
+ * When nothing is retained (the replay ring is empty), this is the next sequence
+ * that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ * formula remains valid: it resolves to the highest sequence already seen, so the
+ * follow-up resume replays nothing, reports no gap, and every newer live event
+ * passes. The interval evicted is unchanged.
*
*
* uint64 oldest_available_sequence = 2;
diff --git a/clients/java/src/main/generated/main/java/mxaccess_worker/v1/MxaccessWorker.java b/clients/java/src/main/generated/main/java/mxaccess_worker/v1/MxaccessWorker.java
index 3303cfc..5b3819b 100644
--- a/clients/java/src/main/generated/main/java/mxaccess_worker/v1/MxaccessWorker.java
+++ b/clients/java/src/main/generated/main/java/mxaccess_worker/v1/MxaccessWorker.java
@@ -3797,6 +3797,9 @@ public final class MxaccessWorker extends com.google.protobuf.GeneratedFile {
* instead of a hard-coded default; 0 (an older gateway that never set the field) means
* "use the worker's built-in default". Sits above the public gRPC cap by an
* envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ * Every worker->gateway frame — events, heartbeats, faults, and control replies
+ * including DrainEvents — must serialize within this limit; reply builders truncate
+ * to fit rather than emit an oversized frame.
*
*
* uint32 max_frame_bytes = 4;
@@ -3941,6 +3944,9 @@ public final class MxaccessWorker extends com.google.protobuf.GeneratedFile {
* instead of a hard-coded default; 0 (an older gateway that never set the field) means
* "use the worker's built-in default". Sits above the public gRPC cap by an
* envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ * Every worker->gateway frame — events, heartbeats, faults, and control replies
+ * including DrainEvents — must serialize within this limit; reply builders truncate
+ * to fit rather than emit an oversized frame.
*
*
* uint32 max_frame_bytes = 4;
@@ -4499,6 +4505,9 @@ public final class MxaccessWorker extends com.google.protobuf.GeneratedFile {
* instead of a hard-coded default; 0 (an older gateway that never set the field) means
* "use the worker's built-in default". Sits above the public gRPC cap by an
* envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ * Every worker->gateway frame — events, heartbeats, faults, and control replies
+ * including DrainEvents — must serialize within this limit; reply builders truncate
+ * to fit rather than emit an oversized frame.
*
*
* uint32 max_frame_bytes = 4;
@@ -4515,6 +4524,9 @@ public final class MxaccessWorker extends com.google.protobuf.GeneratedFile {
* instead of a hard-coded default; 0 (an older gateway that never set the field) means
* "use the worker's built-in default". Sits above the public gRPC cap by an
* envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ * Every worker->gateway frame — events, heartbeats, faults, and control replies
+ * including DrainEvents — must serialize within this limit; reply builders truncate
+ * to fit rather than emit an oversized frame.
*
*
* uint32 max_frame_bytes = 4;
@@ -4535,6 +4547,9 @@ public final class MxaccessWorker extends com.google.protobuf.GeneratedFile {
* instead of a hard-coded default; 0 (an older gateway that never set the field) means
* "use the worker's built-in default". Sits above the public gRPC cap by an
* envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ * Every worker->gateway frame — events, heartbeats, faults, and control replies
+ * including DrainEvents — must serialize within this limit; reply builders truncate
+ * to fit rather than emit an oversized frame.
*
*
* uint32 max_frame_bytes = 4;
diff --git a/clients/java/zb-mom-ww-mxgateway-client/build.gradle b/clients/java/zb-mom-ww-mxgateway-client/build.gradle
index cdb2b4a..4fe4351 100644
--- a/clients/java/zb-mom-ww-mxgateway-client/build.gradle
+++ b/clients/java/zb-mom-ww-mxgateway-client/build.gradle
@@ -63,10 +63,11 @@ protobuf {
// or a plugin/protobuf version bump, silently drifts the committed output. checkGeneratedClean
// fails when the regenerated tree differs from what is committed.
//
-// Caveat (repo memory project_java_generated_churn): the protobuf gradle plugin also rewrites
-// MxaccessGateway.java with a spurious protobuf-runtime-version delta on every build even when no
-// .proto changed. CI reverts that one file (git checkout) before invoking this task; locally, do the
-// same when you did not touch a .proto. See docs/GatewayTesting.md "Continuous Integration".
+// The grpc/protobuf toolchain is pinned (build.gradle: grpcVersion / protobufVersion), so a
+// regeneration is byte-identical to the committed single-file aggregates modulo real .proto
+// changes — no spurious protobuf-runtime-version churn (IPC-24 verified this and deleted the old
+// unconditional CI churn-revert step, which masked message-level drift). Regenerate and commit
+// after any .proto change. See docs/GatewayTesting.md "Continuous Integration".
tasks.register('checkGeneratedClean') {
group = 'verification'
description = 'Fails if the committed generated Java tree differs from a fresh regeneration.'
@@ -83,9 +84,9 @@ tasks.register('checkGeneratedClean') {
def dirty = stdout.toString().trim()
if (!dirty.isEmpty()) {
throw new GradleException(
- "Generated Java is stale or churned:\n${dirty}\n" +
- "Regenerate and commit after a .proto change, or 'git checkout' the spurious " +
- "MxaccessGateway.java protobuf-version churn when no .proto changed.")
+ "Generated Java is stale:\n${dirty}\n" +
+ "Regenerate and commit the Java client after a .proto change " +
+ "(gradle :zb-mom-ww-mxgateway-client:generateProto).")
}
}
}
diff --git a/clients/proto/descriptors/mxaccessgw-client-v1.protoset b/clients/proto/descriptors/mxaccessgw-client-v1.protoset
index b42b792..c3d6da8 100644
Binary files a/clients/proto/descriptors/mxaccessgw-client-v1.protoset and b/clients/proto/descriptors/mxaccessgw-client-v1.protoset differ
diff --git a/clients/python/src/zb_mom_ww_mxgateway/generated/mxaccess_worker_pb2.py b/clients/python/src/zb_mom_ww_mxgateway/generated/mxaccess_worker_pb2.py
index 9344395..98db30a 100644
--- a/clients/python/src/zb_mom_ww_mxgateway/generated/mxaccess_worker_pb2.py
+++ b/clients/python/src/zb_mom_ww_mxgateway/generated/mxaccess_worker_pb2.py
@@ -27,7 +27,7 @@ from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__
import mxaccess_gateway_pb2 as mxaccess__gateway__pb2
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x15mxaccess_worker.proto\x12\x12mxaccess_worker.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x16mxaccess_gateway.proto\"\x95\x06\n\x0eWorkerEnvelope\x12\x18\n\x10protocol_version\x18\x01 \x01(\r\x12\x12\n\nsession_id\x18\x02 \x01(\t\x12\x10\n\x08sequence\x18\x03 \x01(\x04\x12\x16\n\x0e\x63orrelation_id\x18\x04 \x01(\t\x12\x39\n\rgateway_hello\x18\n \x01(\x0b\x32 .mxaccess_worker.v1.GatewayHelloH\x00\x12\x37\n\x0cworker_hello\x18\x0b \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerHelloH\x00\x12\x37\n\x0cworker_ready\x18\x0c \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerReadyH\x00\x12;\n\x0eworker_command\x18\r \x01(\x0b\x32!.mxaccess_worker.v1.WorkerCommandH\x00\x12\x46\n\x14worker_command_reply\x18\x0e \x01(\x0b\x32&.mxaccess_worker.v1.WorkerCommandReplyH\x00\x12\x39\n\rworker_cancel\x18\x0f \x01(\x0b\x32 .mxaccess_worker.v1.WorkerCancelH\x00\x12=\n\x0fworker_shutdown\x18\x10 \x01(\x0b\x32\".mxaccess_worker.v1.WorkerShutdownH\x00\x12\x44\n\x13worker_shutdown_ack\x18\x11 \x01(\x0b\x32%.mxaccess_worker.v1.WorkerShutdownAckH\x00\x12\x37\n\x0cworker_event\x18\x12 \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerEventH\x00\x12?\n\x10worker_heartbeat\x18\x13 \x01(\x0b\x32#.mxaccess_worker.v1.WorkerHeartbeatH\x00\x12\x37\n\x0cworker_fault\x18\x14 \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerFaultH\x00\x42\x06\n\x04\x62ody\"Z\n\x0cGatewayHello\x12\"\n\x1asupported_protocol_version\x18\x01 \x01(\r\x12\r\n\x05nonce\x18\x02 \x01(\t\x12\x17\n\x0fgateway_version\x18\x03 \x01(\t\"i\n\x0bWorkerHello\x12\x18\n\x10protocol_version\x18\x01 \x01(\r\x12\r\n\x05nonce\x18\x02 \x01(\t\x12\x19\n\x11worker_process_id\x18\x03 \x01(\x05\x12\x16\n\x0eworker_version\x18\x04 \x01(\t\"\x8e\x01\n\x0bWorkerReady\x12\x19\n\x11worker_process_id\x18\x01 \x01(\x05\x12\x17\n\x0fmxaccess_progid\x18\x02 \x01(\t\x12\x16\n\x0emxaccess_clsid\x18\x03 \x01(\t\x12\x33\n\x0fready_timestamp\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"w\n\rWorkerCommand\x12/\n\x07\x63ommand\x18\x01 \x01(\x0b\x32\x1e.mxaccess_gateway.v1.MxCommand\x12\x35\n\x11\x65nqueue_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x81\x01\n\x12WorkerCommandReply\x12\x32\n\x05reply\x18\x01 \x01(\x0b\x32#.mxaccess_gateway.v1.MxCommandReply\x12\x37\n\x13\x63ompleted_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x1e\n\x0cWorkerCancel\x12\x0e\n\x06reason\x18\x01 \x01(\t\"Q\n\x0eWorkerShutdown\x12/\n\x0cgrace_period\x18\x01 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x0e\n\x06reason\x18\x02 \x01(\t\"H\n\x11WorkerShutdownAck\x12\x33\n\x06status\x18\x01 \x01(\x0b\x32#.mxaccess_gateway.v1.ProtocolStatus\":\n\x0bWorkerEvent\x12+\n\x05\x65vent\x18\x01 \x01(\x0b\x32\x1c.mxaccess_gateway.v1.MxEvent\"\xa5\x02\n\x0fWorkerHeartbeat\x12\x19\n\x11worker_process_id\x18\x01 \x01(\x05\x12.\n\x05state\x18\x02 \x01(\x0e\x32\x1f.mxaccess_worker.v1.WorkerState\x12?\n\x1blast_sta_activity_timestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1d\n\x15pending_command_count\x18\x04 \x01(\r\x12\"\n\x1aoutbound_event_queue_depth\x18\x05 \x01(\r\x12\x1b\n\x13last_event_sequence\x18\x06 \x01(\x04\x12&\n\x1e\x63urrent_command_correlation_id\x18\x07 \x01(\t\"\xf4\x01\n\x0bWorkerFault\x12\x39\n\x08\x63\x61tegory\x18\x01 \x01(\x0e\x32\'.mxaccess_worker.v1.WorkerFaultCategory\x12\x16\n\x0e\x63ommand_method\x18\x02 \x01(\t\x12\x14\n\x07hresult\x18\x03 \x01(\x05H\x00\x88\x01\x01\x12\x16\n\x0e\x65xception_type\x18\x04 \x01(\t\x12\x1a\n\x12\x64iagnostic_message\x18\x05 \x01(\t\x12<\n\x0fprotocol_status\x18\x06 \x01(\x0b\x32#.mxaccess_gateway.v1.ProtocolStatusB\n\n\x08_hresult*\x97\x02\n\x0bWorkerState\x12\x1c\n\x18WORKER_STATE_UNSPECIFIED\x10\x00\x12\x19\n\x15WORKER_STATE_STARTING\x10\x01\x12\x1c\n\x18WORKER_STATE_HANDSHAKING\x10\x02\x12!\n\x1dWORKER_STATE_INITIALIZING_STA\x10\x03\x12\x16\n\x12WORKER_STATE_READY\x10\x04\x12\"\n\x1eWORKER_STATE_EXECUTING_COMMAND\x10\x05\x12\x1e\n\x1aWORKER_STATE_SHUTTING_DOWN\x10\x06\x12\x18\n\x14WORKER_STATE_STOPPED\x10\x07\x12\x18\n\x14WORKER_STATE_FAULTED\x10\x08*\xc7\x04\n\x13WorkerFaultCategory\x12%\n!WORKER_FAULT_CATEGORY_UNSPECIFIED\x10\x00\x12+\n\'WORKER_FAULT_CATEGORY_INVALID_ARGUMENTS\x10\x01\x12\x37\n3WORKER_FAULT_CATEGORY_GATEWAY_AUTHENTICATION_FAILED\x10\x02\x12+\n\'WORKER_FAULT_CATEGORY_PROTOCOL_MISMATCH\x10\x03\x12,\n(WORKER_FAULT_CATEGORY_PROTOCOL_VIOLATION\x10\x04\x12+\n\'WORKER_FAULT_CATEGORY_PIPE_DISCONNECTED\x10\x05\x12\x32\n.WORKER_FAULT_CATEGORY_MXACCESS_CREATION_FAILED\x10\x06\x12\x31\n-WORKER_FAULT_CATEGORY_MXACCESS_COMMAND_FAILED\x10\x07\x12:\n6WORKER_FAULT_CATEGORY_MXACCESS_EVENT_CONVERSION_FAILED\x10\x08\x12\"\n\x1eWORKER_FAULT_CATEGORY_STA_HUNG\x10\t\x12(\n$WORKER_FAULT_CATEGORY_QUEUE_OVERFLOW\x10\n\x12*\n&WORKER_FAULT_CATEGORY_SHUTDOWN_TIMEOUT\x10\x0b\x42&\xaa\x02#ZB.MOM.WW.MxGateway.Contracts.Protob\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x15mxaccess_worker.proto\x12\x12mxaccess_worker.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x16mxaccess_gateway.proto\"\x95\x06\n\x0eWorkerEnvelope\x12\x18\n\x10protocol_version\x18\x01 \x01(\r\x12\x12\n\nsession_id\x18\x02 \x01(\t\x12\x10\n\x08sequence\x18\x03 \x01(\x04\x12\x16\n\x0e\x63orrelation_id\x18\x04 \x01(\t\x12\x39\n\rgateway_hello\x18\n \x01(\x0b\x32 .mxaccess_worker.v1.GatewayHelloH\x00\x12\x37\n\x0cworker_hello\x18\x0b \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerHelloH\x00\x12\x37\n\x0cworker_ready\x18\x0c \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerReadyH\x00\x12;\n\x0eworker_command\x18\r \x01(\x0b\x32!.mxaccess_worker.v1.WorkerCommandH\x00\x12\x46\n\x14worker_command_reply\x18\x0e \x01(\x0b\x32&.mxaccess_worker.v1.WorkerCommandReplyH\x00\x12\x39\n\rworker_cancel\x18\x0f \x01(\x0b\x32 .mxaccess_worker.v1.WorkerCancelH\x00\x12=\n\x0fworker_shutdown\x18\x10 \x01(\x0b\x32\".mxaccess_worker.v1.WorkerShutdownH\x00\x12\x44\n\x13worker_shutdown_ack\x18\x11 \x01(\x0b\x32%.mxaccess_worker.v1.WorkerShutdownAckH\x00\x12\x37\n\x0cworker_event\x18\x12 \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerEventH\x00\x12?\n\x10worker_heartbeat\x18\x13 \x01(\x0b\x32#.mxaccess_worker.v1.WorkerHeartbeatH\x00\x12\x37\n\x0cworker_fault\x18\x14 \x01(\x0b\x32\x1f.mxaccess_worker.v1.WorkerFaultH\x00\x42\x06\n\x04\x62ody\"s\n\x0cGatewayHello\x12\"\n\x1asupported_protocol_version\x18\x01 \x01(\r\x12\r\n\x05nonce\x18\x02 \x01(\t\x12\x17\n\x0fgateway_version\x18\x03 \x01(\t\x12\x17\n\x0fmax_frame_bytes\x18\x04 \x01(\r\"i\n\x0bWorkerHello\x12\x18\n\x10protocol_version\x18\x01 \x01(\r\x12\r\n\x05nonce\x18\x02 \x01(\t\x12\x19\n\x11worker_process_id\x18\x03 \x01(\x05\x12\x16\n\x0eworker_version\x18\x04 \x01(\t\"\x8e\x01\n\x0bWorkerReady\x12\x19\n\x11worker_process_id\x18\x01 \x01(\x05\x12\x17\n\x0fmxaccess_progid\x18\x02 \x01(\t\x12\x16\n\x0emxaccess_clsid\x18\x03 \x01(\t\x12\x33\n\x0fready_timestamp\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"w\n\rWorkerCommand\x12/\n\x07\x63ommand\x18\x01 \x01(\x0b\x32\x1e.mxaccess_gateway.v1.MxCommand\x12\x35\n\x11\x65nqueue_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x81\x01\n\x12WorkerCommandReply\x12\x32\n\x05reply\x18\x01 \x01(\x0b\x32#.mxaccess_gateway.v1.MxCommandReply\x12\x37\n\x13\x63ompleted_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x1e\n\x0cWorkerCancel\x12\x0e\n\x06reason\x18\x01 \x01(\t\"Q\n\x0eWorkerShutdown\x12/\n\x0cgrace_period\x18\x01 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x0e\n\x06reason\x18\x02 \x01(\t\"H\n\x11WorkerShutdownAck\x12\x33\n\x06status\x18\x01 \x01(\x0b\x32#.mxaccess_gateway.v1.ProtocolStatus\":\n\x0bWorkerEvent\x12+\n\x05\x65vent\x18\x01 \x01(\x0b\x32\x1c.mxaccess_gateway.v1.MxEvent\"\xa5\x02\n\x0fWorkerHeartbeat\x12\x19\n\x11worker_process_id\x18\x01 \x01(\x05\x12.\n\x05state\x18\x02 \x01(\x0e\x32\x1f.mxaccess_worker.v1.WorkerState\x12?\n\x1blast_sta_activity_timestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1d\n\x15pending_command_count\x18\x04 \x01(\r\x12\"\n\x1aoutbound_event_queue_depth\x18\x05 \x01(\r\x12\x1b\n\x13last_event_sequence\x18\x06 \x01(\x04\x12&\n\x1e\x63urrent_command_correlation_id\x18\x07 \x01(\t\"\xf4\x01\n\x0bWorkerFault\x12\x39\n\x08\x63\x61tegory\x18\x01 \x01(\x0e\x32\'.mxaccess_worker.v1.WorkerFaultCategory\x12\x16\n\x0e\x63ommand_method\x18\x02 \x01(\t\x12\x14\n\x07hresult\x18\x03 \x01(\x05H\x00\x88\x01\x01\x12\x16\n\x0e\x65xception_type\x18\x04 \x01(\t\x12\x1a\n\x12\x64iagnostic_message\x18\x05 \x01(\t\x12<\n\x0fprotocol_status\x18\x06 \x01(\x0b\x32#.mxaccess_gateway.v1.ProtocolStatusB\n\n\x08_hresult*\x97\x02\n\x0bWorkerState\x12\x1c\n\x18WORKER_STATE_UNSPECIFIED\x10\x00\x12\x19\n\x15WORKER_STATE_STARTING\x10\x01\x12\x1c\n\x18WORKER_STATE_HANDSHAKING\x10\x02\x12!\n\x1dWORKER_STATE_INITIALIZING_STA\x10\x03\x12\x16\n\x12WORKER_STATE_READY\x10\x04\x12\"\n\x1eWORKER_STATE_EXECUTING_COMMAND\x10\x05\x12\x1e\n\x1aWORKER_STATE_SHUTTING_DOWN\x10\x06\x12\x18\n\x14WORKER_STATE_STOPPED\x10\x07\x12\x18\n\x14WORKER_STATE_FAULTED\x10\x08*\xc7\x04\n\x13WorkerFaultCategory\x12%\n!WORKER_FAULT_CATEGORY_UNSPECIFIED\x10\x00\x12+\n\'WORKER_FAULT_CATEGORY_INVALID_ARGUMENTS\x10\x01\x12\x37\n3WORKER_FAULT_CATEGORY_GATEWAY_AUTHENTICATION_FAILED\x10\x02\x12+\n\'WORKER_FAULT_CATEGORY_PROTOCOL_MISMATCH\x10\x03\x12,\n(WORKER_FAULT_CATEGORY_PROTOCOL_VIOLATION\x10\x04\x12+\n\'WORKER_FAULT_CATEGORY_PIPE_DISCONNECTED\x10\x05\x12\x32\n.WORKER_FAULT_CATEGORY_MXACCESS_CREATION_FAILED\x10\x06\x12\x31\n-WORKER_FAULT_CATEGORY_MXACCESS_COMMAND_FAILED\x10\x07\x12:\n6WORKER_FAULT_CATEGORY_MXACCESS_EVENT_CONVERSION_FAILED\x10\x08\x12\"\n\x1eWORKER_FAULT_CATEGORY_STA_HUNG\x10\t\x12(\n$WORKER_FAULT_CATEGORY_QUEUE_OVERFLOW\x10\n\x12*\n&WORKER_FAULT_CATEGORY_SHUTDOWN_TIMEOUT\x10\x0b\x42&\xaa\x02#ZB.MOM.WW.MxGateway.Contracts.Protob\x06proto3')
_globals = globals()
_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -35,32 +35,32 @@ _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'mxaccess_worker_pb2', _glob
if not _descriptor._USE_C_DESCRIPTORS:
_globals['DESCRIPTOR']._loaded_options = None
_globals['DESCRIPTOR']._serialized_options = b'\252\002#ZB.MOM.WW.MxGateway.Contracts.Proto'
- _globals['_WORKERSTATE']._serialized_start=2316
- _globals['_WORKERSTATE']._serialized_end=2595
- _globals['_WORKERFAULTCATEGORY']._serialized_start=2598
- _globals['_WORKERFAULTCATEGORY']._serialized_end=3181
+ _globals['_WORKERSTATE']._serialized_start=2341
+ _globals['_WORKERSTATE']._serialized_end=2620
+ _globals['_WORKERFAULTCATEGORY']._serialized_start=2623
+ _globals['_WORKERFAULTCATEGORY']._serialized_end=3206
_globals['_WORKERENVELOPE']._serialized_start=135
_globals['_WORKERENVELOPE']._serialized_end=924
_globals['_GATEWAYHELLO']._serialized_start=926
- _globals['_GATEWAYHELLO']._serialized_end=1016
- _globals['_WORKERHELLO']._serialized_start=1018
- _globals['_WORKERHELLO']._serialized_end=1123
- _globals['_WORKERREADY']._serialized_start=1126
- _globals['_WORKERREADY']._serialized_end=1268
- _globals['_WORKERCOMMAND']._serialized_start=1270
- _globals['_WORKERCOMMAND']._serialized_end=1389
- _globals['_WORKERCOMMANDREPLY']._serialized_start=1392
- _globals['_WORKERCOMMANDREPLY']._serialized_end=1521
- _globals['_WORKERCANCEL']._serialized_start=1523
- _globals['_WORKERCANCEL']._serialized_end=1553
- _globals['_WORKERSHUTDOWN']._serialized_start=1555
- _globals['_WORKERSHUTDOWN']._serialized_end=1636
- _globals['_WORKERSHUTDOWNACK']._serialized_start=1638
- _globals['_WORKERSHUTDOWNACK']._serialized_end=1710
- _globals['_WORKEREVENT']._serialized_start=1712
- _globals['_WORKEREVENT']._serialized_end=1770
- _globals['_WORKERHEARTBEAT']._serialized_start=1773
- _globals['_WORKERHEARTBEAT']._serialized_end=2066
- _globals['_WORKERFAULT']._serialized_start=2069
- _globals['_WORKERFAULT']._serialized_end=2313
+ _globals['_GATEWAYHELLO']._serialized_end=1041
+ _globals['_WORKERHELLO']._serialized_start=1043
+ _globals['_WORKERHELLO']._serialized_end=1148
+ _globals['_WORKERREADY']._serialized_start=1151
+ _globals['_WORKERREADY']._serialized_end=1293
+ _globals['_WORKERCOMMAND']._serialized_start=1295
+ _globals['_WORKERCOMMAND']._serialized_end=1414
+ _globals['_WORKERCOMMANDREPLY']._serialized_start=1417
+ _globals['_WORKERCOMMANDREPLY']._serialized_end=1546
+ _globals['_WORKERCANCEL']._serialized_start=1548
+ _globals['_WORKERCANCEL']._serialized_end=1578
+ _globals['_WORKERSHUTDOWN']._serialized_start=1580
+ _globals['_WORKERSHUTDOWN']._serialized_end=1661
+ _globals['_WORKERSHUTDOWNACK']._serialized_start=1663
+ _globals['_WORKERSHUTDOWNACK']._serialized_end=1735
+ _globals['_WORKEREVENT']._serialized_start=1737
+ _globals['_WORKEREVENT']._serialized_end=1795
+ _globals['_WORKERHEARTBEAT']._serialized_start=1798
+ _globals['_WORKERHEARTBEAT']._serialized_end=2091
+ _globals['_WORKERFAULT']._serialized_start=2094
+ _globals['_WORKERFAULT']._serialized_end=2338
# @@protoc_insertion_point(module_scope)
diff --git a/clients/rust/protos/mxaccess_gateway.proto b/clients/rust/protos/mxaccess_gateway.proto
index d3e3a53..be96d5a 100644
--- a/clients/rust/protos/mxaccess_gateway.proto
+++ b/clients/rust/protos/mxaccess_gateway.proto
@@ -676,6 +676,10 @@ message WorkerInfoReply {
}
message DrainEventsReply {
+ // The reply is bounded by both a server-side count cap and the negotiated
+ // worker-frame byte cap; a reply may therefore carry fewer events than
+ // `max_events` and fewer than are queued. Callers drain iteratively until an
+ // empty reply.
repeated MxEvent events = 1;
}
@@ -760,6 +764,11 @@ message ReplayGap {
// after_worker_sequence = oldest_available_sequence - 1 in the next
// StreamEventsRequest, which will cause the server to replay starting at
// oldest_available_sequence (the first retained event).
+ // When nothing is retained (the replay ring is empty), this is the next sequence
+ // that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ // formula remains valid: it resolves to the highest sequence already seen, so the
+ // follow-up resume replays nothing, reports no gap, and every newer live event
+ // passes. The interval evicted is unchanged.
uint64 oldest_available_sequence = 2;
}
diff --git a/clients/rust/protos/mxaccess_worker.proto b/clients/rust/protos/mxaccess_worker.proto
index e50c4ff..7a8a5e7 100644
--- a/clients/rust/protos/mxaccess_worker.proto
+++ b/clients/rust/protos/mxaccess_worker.proto
@@ -47,6 +47,9 @@ message GatewayHello {
// instead of a hard-coded default; 0 (an older gateway that never set the field) means
// "use the worker's built-in default". Sits above the public gRPC cap by an
// envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ // Every worker->gateway frame — events, heartbeats, faults, and control replies
+ // including DrainEvents — must serialize within this limit; reply builders truncate
+ // to fit rather than emit an oversized frame.
uint32 max_frame_bytes = 4;
}
diff --git a/docs/ClientProtoGeneration.md b/docs/ClientProtoGeneration.md
index fa21cb7..270ccf5 100644
--- a/docs/ClientProtoGeneration.md
+++ b/docs/ClientProtoGeneration.md
@@ -88,15 +88,23 @@ scripts assert the pin and resolve tools from `PATH`:
| Generator | Pinned version | Guard |
|-----------|----------------|-------|
| protoc (descriptor set) | 34.1 | version assertion in `scripts/publish-client-proto-inputs.ps1` |
-| `Grpc.Tools` (C# `Generated/`) | 2.80.0 (contracts csproj) | `scripts/check-codegen.ps1` git-diff of `Generated/` |
-| `grpcio-tools` (Python) | 1.80.0 (protobuf runtime 6.31.1) | version assertion in `clients/python/generate-proto.ps1` |
-| protobuf / grpc-java (Java) | `protobufVersion` / `grpcVersion` in `clients/java/build.gradle` | `checkGeneratedClean` gradle task |
+| `Grpc.Tools` (C# `Generated/`) | 2.80.0 (contracts csproj) | `scripts/check-codegen.ps1` git-diff of `Generated/` (Check 2) |
+| `protoc-gen-go` (Go) | v1.36.11 | version assertion in `clients/go/generate-proto.ps1`; `check-codegen.ps1` Check 4 |
+| `protoc-gen-go-grpc` (Go) | 1.6.2 | version assertion in `clients/go/generate-proto.ps1`; `check-codegen.ps1` Check 4 |
+| `grpcio-tools` (Python) | 1.80.0 (protobuf runtime 6.31.1) | version assertion in `clients/python/generate-proto.ps1`; `check-codegen.ps1` Check 4 |
+| protobuf / grpc-java (Java) | `protobufVersion` / `grpcVersion` in `clients/java/build.gradle` | CI `git diff --exit-code` over `clients/java/src/main/generated` after `gradle test` (the `checkGeneratedClean` gradle task is the equivalent local check) |
A newer `grpcio-tools` stamps a `GRPC_GENERATED_VERSION` above the pinned grpcio
-runtime and breaks Python `pytest`; the Java protobuf plugin rewrites
-`MxaccessGateway.java` with spurious protobuf-runtime-version churn on every build
-(revert that one file when no `.proto` changed — see
-[Gateway Testing](./GatewayTesting.md) "Continuous Integration").
+runtime and breaks Python `pytest`, so the Python and Go scripts assert their
+generator pins before regenerating. Under the pinned grpc/protobuf toolchain the
+Java protobuf plugin regenerates byte-identical output (modulo real `.proto`
+changes), so CI enforces Java freshness with a direct `git diff --exit-code -- clients/java/src/main/generated`
+step after `gradle test` (which transitively regenerates via `generateProto`); the
+`checkGeneratedClean` gradle task is the equivalent check for local/manual use. The
+old unconditional churn-revert CI step (which masked message-level drift in the
+single-file Java aggregates) was deleted (IPC-24). Go and Python committed
+bindings are guarded by `check-codegen.ps1` **Check 4**, which regenerates both
+and fails on any diff.
## Output Directories
diff --git a/docs/Contracts.md b/docs/Contracts.md
index f6ce3db..fc53b25 100644
--- a/docs/Contracts.md
+++ b/docs/Contracts.md
@@ -114,7 +114,11 @@ dotnet build src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csp
`scripts/check-codegen.ps1` enforces this in CI (it force-regenerates and fails on any
`git diff` against the committed `Generated/`) — that regeneration diff in the `portable`
job is the primary guard. The SSH-driven `windows-x86` job's net48 worker build is the
-secondary guard (a stale `Generated/` also breaks the x86 build with `CS0246`).
+secondary guard (a stale `Generated/` also breaks the x86 build with `CS0246`). The same
+script runs four checks in total: the committed client descriptor set (Check 1), the C#
+`Generated/` (Check 2), the Rust vendored protos (Check 3), and the Go/Python client bindings
+(Check 4) each regenerate and fail on any diff. See
+[Client Proto Generation](./ClientProtoGeneration.md) for the pinned generator versions.
Client generation inputs are published through
`clients/proto/proto-inputs.json` and the descriptor set under
diff --git a/docs/GatewayTesting.md b/docs/GatewayTesting.md
index 074a20f..f55b9aa 100644
--- a/docs/GatewayTesting.md
+++ b/docs/GatewayTesting.md
@@ -428,10 +428,13 @@ runtime because the x86 Worker cannot build on Linux:
gateway fake-worker tests, and builds/tests the clients that run on Linux: .NET client
build, Go (`gofmt` + `go build` + `go test`), Rust (`cargo fmt --check` + `cargo test`
+ `cargo clippy -D warnings`), and Python (`pytest`).
-- **`java`** (Linux, JDK 17) — `gradle test`. The protobuf gradle plugin rewrites
- `MxaccessGateway.java` with spurious protobuf-runtime-version churn on every build, so
- when no `.proto` changed the job reverts that one file (`git checkout`) before asserting
- the generated tree is clean. The dev Mac has no JRE, so Java verification is CI-only.
+- **`java`** (Linux, JDK 17) — `gradle test`, then `git diff --exit-code` over the generated
+ tree. The grpc/protobuf toolchain is pinned (`clients/java/build.gradle`), so a regeneration
+ is byte-identical to the committed single-file aggregates modulo real `.proto` changes; the
+ git-diff is therefore a true drift gate that now catches message-level proto drift in the Java
+ client (IPC-24 deleted the old unconditional churn-revert step, which masked exactly that
+ class). The dev Mac has a Homebrew JDK 17, so `gradle generateProto` can be run there to refresh
+ the Java aggregates when a `.proto` changes.
- **`windows-x86`** (Linux runner, per push/PR) — builds the **x86 / net48 Worker and
Worker.Tests**, which are Windows-only and out of scope for the Linux jobs. It runs on a
Linux runner that always schedules and SSHes to windev (`10.100.0.48`), where
@@ -449,10 +452,14 @@ runtime because the x86 Worker cannot build on Linux:
`xUnit1030`). Gated `if: github.event_name == 'schedule'`, so it never gates a push. On
failure it opens a Gitea issue via the Actions token, since nobody watches the Actions page.
-The freshness guard `scripts/check-codegen.ps1` fails the build when the committed
-client descriptor set or the C# `Generated/` no longer matches the current `.proto`
-sources — the codegen drift class this repo has hit repeatedly (stale client
-descriptors, net48 `CS0246` on unregenerated protos). The **primary** guard for the
+The freshness guard `scripts/check-codegen.ps1` runs four checks and fails the build when the
+committed client descriptor set (Check 1), the C# `Generated/` (Check 2), the Rust vendored
+protos (Check 3), or the Go/Python client bindings (Check 4, IPC-25) no longer match the current
+`.proto` sources — the codegen drift class this repo has hit repeatedly (stale client
+descriptors, net48 `CS0246` on unregenerated protos, silently stale Go/Python worker bindings).
+Check 4 regenerates the Go and Python bindings with their pinned generators (`protoc-gen-go`
+v1.36.11 / `protoc-gen-go-grpc` 1.6.2, `grpcio-tools` 1.80.0) and fails on any diff; a missing
+generator fails the check rather than skipping it. The **primary** guard for the
"regenerate and commit `Generated/`" rule is that regeneration diff in the `portable` job;
the `windows-x86` net48 compile is the **secondary** guard (a stale `Generated/` also breaks
the x86 build with `CS0246`). See [Client Proto Generation](./ClientProtoGeneration.md) and
diff --git a/scripts/check-codegen.ps1 b/scripts/check-codegen.ps1
index d7e4177..ab19901 100644
--- a/scripts/check-codegen.ps1
+++ b/scripts/check-codegen.ps1
@@ -1,7 +1,7 @@
#!/usr/bin/env pwsh
-# Codegen freshness guard for CI (IPC-01, IPC-19, IPC-20, CLI-02).
+# Codegen freshness guard for CI (IPC-01, IPC-19, IPC-20, IPC-25, CLI-02).
#
-# Three checks, all Linux/macOS-runnable (no Server build, no x86 worker):
+# Four checks, all Linux/macOS-runnable (no Server build, no x86 worker):
# 1. Published client descriptor set matches the current .proto sources (delegates to
# publish-client-proto-inputs.ps1 -Check, which normalizes source_code_info so it is
# protoc-version tolerant).
@@ -13,6 +13,12 @@
# crate buildable outside the repo, CLI-02) are byte-identical to the canonical Contracts
# protos. A drift means a .proto was edited without refreshing the vendored copies, which would
# publish a stale wire contract to crate consumers while the in-repo build stays correct.
+# 4. The committed Go and Python client bindings match a fresh regeneration (IPC-25). The two
+# per-client generate-proto.ps1 scripts pin their generators (protoc-gen-go v1.36.11 /
+# protoc-gen-go-grpc v1.6.2 for Go; grpcio-tools 1.80.0 for Python), so a clean checkout
+# regenerates deterministic output; a non-empty git diff means a .proto was edited without
+# regenerating and committing those bindings. A missing generator FAILS the check (a skipped
+# guard is the exact silent-drift hole IPC-25 closes), never skips it.
#
# The x86 Worker + Worker.Tests are Windows-only and are guarded by the SSH-driven `windows-x86`
# CI job (see docs/GatewayTesting.md, Continuous Integration), not here.
@@ -28,7 +34,7 @@ $generatedDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Generated
$contractsProject = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj'
$failures = New-Object System.Collections.Generic.List[string]
-Write-Host '== Check 1/2: client descriptor set freshness =='
+Write-Host '== Check 1/4: client descriptor set freshness =='
try {
& (Join-Path $PSScriptRoot 'publish-client-proto-inputs.ps1') -Check
if ($LASTEXITCODE -ne 0) {
@@ -40,7 +46,7 @@ catch {
}
Write-Host ''
-Write-Host '== Check 2/2: Contracts/Generated matches a fresh regeneration =='
+Write-Host '== Check 2/4: Contracts/Generated matches a fresh regeneration =='
try {
# Force a full regeneration: Grpc.Tools skips regen when the committed .cs look up to date, so
# remove them first (the documented "del Generated/*.cs to force regen" trick).
@@ -66,7 +72,7 @@ catch {
}
Write-Host ''
-Write-Host '== Check 3/3: Rust vendored protos match canonical Contracts protos =='
+Write-Host '== Check 3/4: Rust vendored protos match canonical Contracts protos =='
try {
$canonicalProtoDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Protos'
$vendoredProtoDir = Join-Path $repoRoot 'clients/rust/protos'
@@ -87,6 +93,28 @@ catch {
$failures.Add("Rust vendored proto check failed: $($_.Exception.Message)")
}
+Write-Host ''
+Write-Host '== Check 4/4: Go and Python client bindings match a fresh regeneration =='
+try {
+ # Regenerate both binding sets with their pinned generators, then diff. The per-client scripts
+ # throw on a missing or off-pin generator, so any failure here FAILS the check rather than
+ # skipping it (a skipped guard is exactly the silent-drift hole IPC-25 closes).
+ $goBindingDir = 'clients/go/internal/generated'
+ $pyBindingDir = 'clients/python/src/zb_mom_ww_mxgateway/generated'
+
+ & (Join-Path $repoRoot 'clients/go/generate-proto.ps1') | Out-Host
+ & (Join-Path $repoRoot 'clients/python/generate-proto.ps1') | Out-Host
+
+ $bindingDiff = (& git -C $repoRoot status --porcelain -- $goBindingDir $pyBindingDir | Out-String).Trim()
+ if (-not [string]::IsNullOrEmpty($bindingDiff)) {
+ Write-Host $bindingDiff
+ $failures.Add("Go/Python client bindings differ from a fresh regeneration. Run clients/go/generate-proto.ps1 and clients/python/generate-proto.ps1 with the pinned generators and commit $goBindingDir and $pyBindingDir.")
+ }
+}
+catch {
+ $failures.Add("Go/Python codegen check failed (tool missing or regeneration error): $($_.Exception.Message)")
+}
+
Write-Host ''
if ($failures.Count -gt 0) {
Write-Host 'Codegen freshness check FAILED:' -ForegroundColor Red
diff --git a/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessGateway.cs b/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessGateway.cs
index fe182a4..f78dc5b 100644
--- a/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessGateway.cs
+++ b/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessGateway.cs
@@ -22796,6 +22796,12 @@ namespace ZB.MOM.WW.MxGateway.Contracts.Proto {
private static readonly pb::FieldCodec _repeated_events_codec
= pb::FieldCodec.ForMessage(10, global::ZB.MOM.WW.MxGateway.Contracts.Proto.MxEvent.Parser);
private readonly pbc::RepeatedField events_ = new pbc::RepeatedField();
+ ///
+ /// The reply is bounded by both a server-side count cap and the negotiated
+ /// worker-frame byte cap; a reply may therefore carry fewer events than
+ /// `max_events` and fewer than are queued. Callers drain iteratively until an
+ /// empty reply.
+ ///
[global::System.Diagnostics.DebuggerNonUserCodeAttribute]
[global::System.CodeDom.Compiler.GeneratedCode("protoc", null)]
public pbc::RepeatedField Events {
@@ -24510,6 +24516,11 @@ namespace ZB.MOM.WW.MxGateway.Contracts.Proto {
/// after_worker_sequence = oldest_available_sequence - 1 in the next
/// StreamEventsRequest, which will cause the server to replay starting at
/// oldest_available_sequence (the first retained event).
+ /// When nothing is retained (the replay ring is empty), this is the next sequence
+ /// that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ /// formula remains valid: it resolves to the highest sequence already seen, so the
+ /// follow-up resume replays nothing, reports no gap, and every newer live event
+ /// passes. The interval evicted is unchanged.
///
[global::System.Diagnostics.DebuggerNonUserCodeAttribute]
[global::System.CodeDom.Compiler.GeneratedCode("protoc", null)]
diff --git a/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessWorker.cs b/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessWorker.cs
index d8e1444..892348a 100644
--- a/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessWorker.cs
+++ b/src/ZB.MOM.WW.MxGateway.Contracts/Generated/MxaccessWorker.cs
@@ -1164,6 +1164,9 @@ namespace ZB.MOM.WW.MxGateway.Contracts.Proto {
/// instead of a hard-coded default; 0 (an older gateway that never set the field) means
/// "use the worker's built-in default". Sits above the public gRPC cap by an
/// envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ /// Every worker->gateway frame — events, heartbeats, faults, and control replies
+ /// including DrainEvents — must serialize within this limit; reply builders truncate
+ /// to fit rather than emit an oversized frame.
///
[global::System.Diagnostics.DebuggerNonUserCodeAttribute]
[global::System.CodeDom.Compiler.GeneratedCode("protoc", null)]
diff --git a/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto b/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto
index d3e3a53..be96d5a 100644
--- a/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto
+++ b/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto
@@ -676,6 +676,10 @@ message WorkerInfoReply {
}
message DrainEventsReply {
+ // The reply is bounded by both a server-side count cap and the negotiated
+ // worker-frame byte cap; a reply may therefore carry fewer events than
+ // `max_events` and fewer than are queued. Callers drain iteratively until an
+ // empty reply.
repeated MxEvent events = 1;
}
@@ -760,6 +764,11 @@ message ReplayGap {
// after_worker_sequence = oldest_available_sequence - 1 in the next
// StreamEventsRequest, which will cause the server to replay starting at
// oldest_available_sequence (the first retained event).
+ // When nothing is retained (the replay ring is empty), this is the next sequence
+ // that can be delivered — `highest observed + 1` — and the `oldest - 1` resume
+ // formula remains valid: it resolves to the highest sequence already seen, so the
+ // follow-up resume replays nothing, reports no gap, and every newer live event
+ // passes. The interval evicted is unchanged.
uint64 oldest_available_sequence = 2;
}
diff --git a/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_worker.proto b/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_worker.proto
index e50c4ff..7a8a5e7 100644
--- a/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_worker.proto
+++ b/src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_worker.proto
@@ -47,6 +47,9 @@ message GatewayHello {
// instead of a hard-coded default; 0 (an older gateway that never set the field) means
// "use the worker's built-in default". Sits above the public gRPC cap by an
// envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+ // Every worker->gateway frame — events, heartbeats, faults, and control replies
+ // including DrainEvents — must serialize within this limit; reply builders truncate
+ // to fit rather than emit an oversized frame.
uint32 max_frame_bytes = 4;
}