Merge branch 'fix/archreview-p2' into main (P2 tier: completeness & polish)

# Conflicts:
#	archreview/remediation/00-tracking.md
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayCliSecretRedactor.cs
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
#	src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

src/ZB.MOM.WW.MxGateway.Worker/Ipc/WorkerFrameWriter.cs

@@ -116,36 +116,77 @@ public sealed class WorkerFrameWriter
     // Runs only under _writeLock. Drains control frames before event frames, stamping and writing each.
     // The stream write itself is not cancellable: a frame is written atomically or fails, never left
     // half-written on the pipe because a caller gave up waiting.
+    //
+    // Flushes are coalesced across the whole drained batch (WRK-12 / IPC-15): each frame is written to
+    // the stream but not flushed individually; a single FlushAsync runs after the batch, then every
+    // successfully-written frame is completed. A caller's Completion therefore still signals only after
+    // its bytes have been written AND flushed, so the "written and flushed" contract is unchanged — but
+    // a burst of N events now costs one flush syscall instead of N.
     private async Task DrainQueuedFramesAsync()
     {
+        List<PendingFrame> written = new List<PendingFrame>();
         while (true)
         {
             PendingFrame? frame = DequeueNext();
             if (frame is null)
             {
-                return;
+                break;
             }
 
             try
             {
                 await WriteFrameAsync(frame.Envelope).ConfigureAwait(false);
-                frame.Completion.TrySetResult(true);
+                written.Add(frame);
             }
             catch (WorkerFrameProtocolException exception) when (IsPerFrameRejection(exception))
             {
                 // Validation, empty-payload, and oversized-frame errors are specific to this frame and
-                // do not damage the stream; fail only this frame and keep draining the rest.
+                // do not damage the stream; fail only this frame and keep draining the rest. Nothing was
+                // written for it, so it needs no flush.
                 frame.Completion.TrySetException(exception);
             }
             catch (Exception exception)
             {
-                // A stream write/flush failure means the pipe is broken; fail this frame and every frame
-                // still queued so no caller awaits forever, then stop draining.
+                // A stream write failure means the pipe is broken; fail this frame, every frame already
+                // written this batch but not yet flushed, and every frame still queued so no caller
+                // awaits forever, then stop draining.
                 frame.Completion.TrySetException(exception);
+                FailFrames(written, exception);
                 FailAllQueued(exception);
                 return;
             }
         }
+
+        if (written.Count == 0)
+        {
+            return;
+        }
+
+        try
+        {
+            await _stream.FlushAsync(CancellationToken.None).ConfigureAwait(false);
+        }
+        catch (Exception exception)
+        {
+            // The batch reached the stream but the flush that guarantees delivery failed: the pipe is
+            // broken. Fail every frame in the batch (the queue was already drained) so no caller treats
+            // an unflushed write as delivered.
+            FailFrames(written, exception);
+            return;
+        }
+
+        foreach (PendingFrame frame in written)
+        {
+            frame.Completion.TrySetResult(true);
+        }
+    }
+
+    private static void FailFrames(List<PendingFrame> frames, Exception exception)
+    {
+        foreach (PendingFrame frame in frames)
+        {
+            frame.Completion.TrySetException(exception);
+        }
     }
 
     private static bool IsPerFrameRejection(WorkerFrameProtocolException exception)
@@ -215,14 +256,14 @@ public sealed class WorkerFrameWriter
 
         // Serialize once into a single buffer that carries the 4-byte length prefix followed by the
         // payload, then issue one stream write. This avoids a second serialization pass, a separate
-        // prefix array, and a separate prefix write.
+        // prefix array, and a separate prefix write. The flush is deferred to the end of the drained
+        // batch (see DrainQueuedFramesAsync) so a burst of frames shares one flush.
         int frameLength = sizeof(uint) + payloadLength;
         byte[] frame = new byte[frameLength];
         WriteUInt32LittleEndian(frame, (uint)payloadLength);
         envelope.WriteTo(new Span<byte>(frame, sizeof(uint), payloadLength));
 
         await _stream.WriteAsync(frame, 0, frameLength, CancellationToken.None).ConfigureAwait(false);
-        await _stream.FlushAsync(CancellationToken.None).ConfigureAwait(false);
     }
 
     private static void WriteUInt32LittleEndian(