perf(worker): launcher-configurable event queue capacity

docs/MxAccessWorkerInstanceDesign.md

@@ -416,7 +416,11 @@ type on buffered events. `OperationComplete` is only emitted from the native
 `MxAccessEventQueue` is the bounded outbound event queue for one worker
 session. It assigns the monotonic `WorkerSequence` and `WorkerTimestamp` when an
 event is accepted, preserving the order in which MXAccess handlers enqueue
-events. The default capacity is `10000`. When the queue reaches capacity it
+events. The capacity is `10000` by default and comes from
+`MxGateway:Worker:EventQueueCapacity`, which the gateway stamps onto the worker
+launch environment as `MXGATEWAY_EVENT_QUEUE_CAPACITY`; a missing, unparseable,
+or out-of-range value (outside `1000`–`1000000`) leaves the worker on the
+default rather than failing the session. When the queue reaches capacity it
 records a `WorkerFaultCategory.QueueOverflow` fault and rejects further events.
 The event handler catches conversion and enqueue failures, records the first
 fault on the queue, and returns to the STA message pump instead of writing to