Merge branch 'fix/archreview-p2' into main (P2 tier: completeness & polish)

# Conflicts:
#	archreview/remediation/00-tracking.md
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayCliSecretRedactor.cs
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
#	src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

@@ -373,6 +373,43 @@ public sealed class WorkerFrameProtocolTests
         Assert.Equal(WorkerEnvelope.BodyOneofCase.WorkerEvent, frame3.BodyCase);
     }
 
+    /// <summary>
+    /// Verifies the writer coalesces the flush across a batch of frames drained together: four frames
+    /// queued behind an in-progress write drain in a single pass and share one FlushAsync, not four.
+    /// Every frame still reaches the wire intact.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task WriteAsync_WhenBatchDrainedTogether_FlushesOnce()
+    {
+        WorkerFrameProtocolOptions options = CreateOptions();
+        using GatedWriteStream stream = new();
+        WorkerFrameWriter writer = new(stream, options);
+
+        // A blocked first write occupies the writer and holds the lock while more frames queue behind it.
+        Task firstWrite = writer.WriteAsync(CreateGatewayHelloEnvelope(), WorkerFrameWritePriority.Control);
+        await AwaitWithTimeoutAsync(stream.FirstWriteStarted);
+
+        Task eventWrite1 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        Task eventWrite2 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        Task eventWrite3 = writer.WriteAsync(CreateEventEnvelope(), WorkerFrameWritePriority.Event);
+        await Task.Delay(50);
+
+        stream.ReleaseFirstWrite();
+        await AwaitWithTimeoutAsync(Task.WhenAll(firstWrite, eventWrite1, eventWrite2, eventWrite3));
+
+        // Four frames written in one drain pass => exactly one flush.
+        Assert.Equal(1, stream.FlushCount);
+
+        stream.Position = 0;
+        WorkerFrameReader reader = new(stream, options);
+        for (int index = 0; index < 4; index++)
+        {
+            WorkerEnvelope frame = await reader.ReadAsync();
+            Assert.NotEqual(WorkerEnvelope.BodyOneofCase.None, frame.BodyCase);
+        }
+    }
+
     /// <summary>Verifies a zero negotiated frame maximum keeps the constructor default.</summary>
     [Fact]
     public void AdoptNegotiatedMaxMessageBytes_WithZero_KeepsDefault()
@@ -451,10 +488,14 @@ public sealed class WorkerFrameProtocolTests
         private readonly TaskCompletionSource<bool> _firstWriteStarted =
             new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
         private int _writeCount;
+        private int _flushCount;
 
         /// <summary>Gets a task that completes once the first <see cref="WriteAsync"/> call has started blocking.</summary>
         public Task FirstWriteStarted => _firstWriteStarted.Task;
 
+        /// <summary>Gets the number of <see cref="FlushAsync"/> calls observed so far.</summary>
+        public int FlushCount => Volatile.Read(ref _flushCount);
+
         /// <summary>Releases the first blocked write so it can complete.</summary>
         public void ReleaseFirstWrite() => _release.Release();
 
@@ -470,6 +511,13 @@ public sealed class WorkerFrameProtocolTests
             await base.WriteAsync(buffer, offset, count, cancellationToken);
         }
 
+        /// <inheritdoc />
+        public override Task FlushAsync(CancellationToken cancellationToken)
+        {
+            Interlocked.Increment(ref _flushCount);
+            return base.FlushAsync(cancellationToken);
+        }
+
         /// <inheritdoc />
         protected override void Dispose(bool disposing)
         {