Merge branch 'fix/archreview-p2' into main (P2 tier: completeness & polish)

# Conflicts:
#	archreview/remediation/00-tracking.md
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayCliSecretRedactor.cs
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
#	src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

src/ZB.MOM.WW.MxGateway.Worker.Tests/Conversion/MxStatusProxyConverterTests.cs

@@ -106,6 +106,35 @@ public sealed class MxStatusProxyConverterTests
         Assert.Contains("success", exception.Message);
     }
 
+    /// <summary>
+    ///     Verifies that repeated conversions of the same status type produce
+    ///     identical results. WRK-06 caches the resolved FieldInfo objects per
+    ///     type after the first conversion; the cached path must yield the same
+    ///     message the uncached first call produced.
+    /// </summary>
+    [Fact]
+    public void Convert_RepeatedForSameType_ProducesIdenticalResults()
+    {
+        FakeMxStatusProxy status = new()
+        {
+            success = 0,
+            category = 3,
+            detectedBy = 1,
+            detail = 21,
+        };
+
+        // First call populates the per-type FieldInfo cache; the second reuses it.
+        MxStatusProxy first = _converter.Convert(status);
+        MxStatusProxy second = _converter.Convert(status);
+
+        Assert.Equal(first, second);
+        Assert.Equal(MxStatusCategory.CommunicationError, second.Category);
+        Assert.Equal(MxStatusSource.RespondingLmx, second.DetectedBy);
+        Assert.Equal(0, second.Success);
+        Assert.Equal(21, second.Detail);
+        Assert.Equal("Invalid reference", second.DiagnosticText);
+    }
+
     public struct FakeMxStatusProxy
     {
         public short success;

src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

@@ -373,6 +373,43 @@ public sealed class WorkerFrameProtocolTests
         Assert.Equal(WorkerEnvelope.BodyOneofCase.WorkerEvent, frame3.BodyCase);
     }
 
+    /// <summary>
+    /// Verifies the writer coalesces the flush across a batch of frames drained together: four frames
+    /// queued behind an in-progress write drain in a single pass and share one FlushAsync, not four.
+    /// Every frame still reaches the wire intact.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task WriteAsync_WhenBatchDrainedTogether_FlushesOnce()
+    {
+        WorkerFrameProtocolOptions options = CreateOptions();
+        using GatedWriteStream stream = new();
+        WorkerFrameWriter writer = new(stream, options);
+
+        // A blocked first write occupies the writer and holds the lock while more frames queue behind it.
+        Task firstWrite = writer.WriteAsync(CreateGatewayHelloEnvelope(), WorkerFrameWritePriority.Control);
+        await AwaitWithTimeoutAsync(stream.FirstWriteStarted);
+
+        Task eventWrite1 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        Task eventWrite2 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        Task eventWrite3 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        await Task.Delay(50);
+
+        stream.ReleaseFirstWrite();
+        await AwaitWithTimeoutAsync(Task.WhenAll(firstWrite, eventWrite1, eventWrite2, eventWrite3));
+
+        // Four frames written in one drain pass => exactly one flush.
+        Assert.Equal(1, stream.FlushCount);
+
+        stream.Position = 0;
+        WorkerFrameReader reader = new(stream, options);
+        for (int index = 0; index < 4; index++)
+        {
+            WorkerEnvelope frame = await reader.ReadAsync();
+            Assert.NotEqual(WorkerEnvelope.BodyOneofCase.None, frame.BodyCase);
+        }
+    }
+
     /// <summary>Verifies a zero negotiated frame maximum keeps the constructor default.</summary>
     [Fact]
     public void AdoptNegotiatedMaxMessageBytes_WithZero_KeepsDefault()
@@ -451,10 +488,14 @@ public sealed class WorkerFrameProtocolTests
         private readonly TaskCompletionSource<bool> _firstWriteStarted =
             new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
         private int _writeCount;
+        private int _flushCount;
 
         /// <summary>Gets a task that completes once the first <see cref="WriteAsync"/> call has started blocking.</summary>
         public Task FirstWriteStarted => _firstWriteStarted.Task;
 
+        /// <summary>Gets the number of <see cref="FlushAsync"/> calls observed so far.</summary>
+        public int FlushCount => Volatile.Read(ref _flushCount);
+
         /// <summary>Releases the first blocked write so it can complete.</summary>
         public void ReleaseFirstWrite() => _release.Release();
 
@@ -470,6 +511,13 @@ public sealed class WorkerFrameProtocolTests
             await base.WriteAsync(buffer, offset, count, cancellationToken);
         }
 
+        /// <inheritdoc />
+        public override Task FlushAsync(CancellationToken cancellationToken)
+        {
+            Interlocked.Increment(ref _flushCount);
+            return base.FlushAsync(cancellationToken);
+        }
+
         /// <inheritdoc />
         protected override void Dispose(bool disposing)
         {

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessEventQueueTests.cs

@@ -29,6 +29,26 @@ public sealed class MxAccessEventQueueTests
         Assert.False(queue.TryDequeue(out _));
     }
 
+    /// <summary>
+    ///     Verifies that Enqueue takes ownership of the passed event instead of
+    ///     cloning it: the dequeued instance is the very reference passed in, and
+    ///     the worker sequence/timestamp are stamped on that same instance
+    ///     (WRK-11).
+    /// </summary>
+    [Fact]
+    public void Enqueue_TakesOwnershipOfPassedEventInstance()
+    {
+        MxAccessEventQueue queue = new(capacity: 4);
+        MxEvent original = CreateEvent(MxEventFamily.OnDataChange, itemHandle: 10);
+
+        queue.Enqueue(original);
+
+        Assert.True(queue.TryDequeue(out WorkerEvent? dequeued));
+        Assert.Same(original, dequeued?.Event);
+        Assert.Equal(1UL, original.WorkerSequence);
+        Assert.NotNull(original.WorkerTimestamp);
+    }
+
     /// <summary>Verifies that Drain removes at most the requested number of events.</summary>
     [Fact]
     public void Drain_RemovesAtMostRequestedEvents()

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessValueCacheTests.cs

@@ -46,6 +46,37 @@ public sealed class MxAccessValueCacheTests
         Assert.Equal(999, other.Value.Int32Value);
     }
 
+    /// <summary>
+    ///     Verifies that Set stores an independent deep-copied snapshot: mutating
+    ///     the source event's protobuf sub-messages after caching does not alter
+    ///     the cached value. WRK-11 stopped the event sink cloning before enqueue,
+    ///     so the same MxEvent instance now flows to the outbound queue; the cache
+    ///     must own its own copy so the two never share mutable state.
+    /// </summary>
+    [Fact]
+    public void Set_StoresIndependentSnapshot_UnaffectedByLaterEventMutation()
+    {
+        MxAccessValueCache cache = new();
+        Timestamp sourceTimestamp = Timestamp.FromDateTime(new(2026, 5, 19, 9, 0, 0, DateTimeKind.Utc));
+        MxEvent mxEvent = BuildEvent(serverHandle: 7, itemHandle: 21, intValue: 100, quality: 192, sourceTimestamp);
+
+        cache.Set(7, 21, mxEvent);
+
+        // Mutate the event in place after it was cached — as if it kept flowing
+        // through the (unrelated) outbound path. None of this must reach the cache.
+        mxEvent.Value.Int32Value = 999;
+        mxEvent.Quality = 0;
+        mxEvent.SourceTimestamp = Timestamp.FromDateTime(new(2030, 1, 1, 0, 0, 0, DateTimeKind.Utc));
+        mxEvent.Statuses[0].Category = MxStatusCategory.SecurityError;
+
+        Assert.True(cache.TryGet(7, 21, out MxAccessValueCache.CachedValue cached));
+        Assert.Equal(100, cached.Value.Int32Value);
+        Assert.Equal(192, cached.Quality);
+        Assert.Equal(sourceTimestamp, cached.SourceTimestamp);
+        Assert.Single(cached.Statuses);
+        Assert.Equal(MxStatusCategory.Ok, cached.Statuses[0].Category);
+    }
+
     /// <summary>Verifies that TryGet returns false for unknown handles.</summary>
     [Fact]
     public void TryGet_WithUnknownHandle_ReturnsFalse()