test(WRK-21): keep the drain-to-empty walk inside the pipe harness envelope

PipePair runs both ends of a duplex pipe in one process with blocking
FlushFileBuffers under every frame write, so it wedges after roughly 85 large
round trips. Drain the full 10,000 byte-heavy events to empty at the queue layer,
where the no-loss property actually lives, and keep the pipe walk at 1,000 events
(29 replies) so it still proves the split end to end. Also give the truncation
test's budget slack: item handle 0 is a proto3 default and is not serialized, so
the probe measurement is a lower bound on the fixture's per-event cost.

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessEventQueueTests.cs

@@ -142,9 +142,12 @@ public sealed class MxAccessEventQueueTests
             queue.Enqueue(CreateEventWithPayload(itemHandle, payloadLength: 256));
         }
 
+        // One-and-a-half events' worth of budget: the head fits, the next does not, and the next is
+        // comfortably smaller than the whole budget so it is a plain truncation rather than the
+        // oversized-head case.
         WorkerEventDrainResult result = queue.Drain(
             maxEvents: 0,
-            maxTotalBytes: MeasureDrainCost(payloadLength: 256));
+            maxTotalBytes: MeasureDrainCost(payloadLength: 256) * 3 / 2);
 
         Assert.Single(result.Events);
         Assert.True(result.TruncatedBySize);
@@ -175,6 +178,57 @@ public sealed class MxAccessEventQueueTests
         Assert.Equal(2, queue.Count);
     }
 
+    /// <summary>
+    ///     The no-loss half of the WRK-21 acceptance criterion, at full scale. Draining the review's
+    ///     10,000 byte-heavy events under a budget that fits only a fraction of them per call must
+    ///     return every event exactly once and in order: the pre-fix drain removed events from the
+    ///     queue before the reply was sized, so a rejected frame destroyed them. This runs at the
+    ///     queue layer because the property is the queue's, and because the pipe harness that covers
+    ///     the same walk end to end cannot sustain hundreds of large round trips.
+    /// </summary>
+    [Fact]
+    public void Drain_ByteBudget_RepeatedCalls_RecoverAllEventsInOrderWithoutLoss()
+    {
+        const int eventCount = 10_000;
+        const int payloadLength = 1_800;
+        MxAccessEventQueue queue = new(eventCount);
+        for (int index = 0; index < eventCount; index++)
+        {
+            queue.Enqueue(CreateEventWithPayload(index, payloadLength));
+        }
+
+        // A budget that fits roughly 35 events, so the walk takes hundreds of calls.
+        int budget = MeasureDrainCost(payloadLength) * 35;
+        List<ulong> recovered = new();
+        int calls = 0;
+        while (true)
+        {
+            WorkerEventDrainResult result = queue.Drain(maxEvents: 0, maxTotalBytes: budget);
+            calls++;
+            if (result.Events.Count == 0)
+            {
+                break;
+            }
+
+            foreach (WorkerEvent drained in result.Events)
+            {
+                recovered.Add(drained.Event.WorkerSequence);
+            }
+
+            Assert.Equal(eventCount - recovered.Count, result.RemainingCount);
+            Assert.True(calls < eventCount, "Drain made no progress.");
+        }
+
+        Assert.True(calls > 100, $"Expected the byte budget to split the drain, saw {calls} calls.");
+        Assert.Equal(eventCount, recovered.Count);
+        for (int index = 0; index < recovered.Count; index++)
+        {
+            Assert.Equal((ulong)(index + 1), recovered[index]);
+        }
+
+        Assert.Equal(0, queue.Count);
+    }
+
     /// <summary>
     ///     Verifies the count cap still binds when the byte budget is generous: the byte cap is an
     ///     additional bound, not a replacement.
@@ -254,7 +308,9 @@ public sealed class MxAccessEventQueueTests
     /// <summary>
     /// Measures what the queue charges one event of the given payload size against the byte budget:
     /// the serialized <see cref="WorkerEvent"/> as it exists after Enqueue (sequence and timestamp
-    /// stamped) plus the repeated-field allowance.
+    /// stamped) plus the repeated-field allowance. The probe uses item handle 0, a proto3 default
+    /// that is not serialized, so this is a lower bound on the fixtures' real per-event cost — the
+    /// budgets above carry slack rather than assuming byte equality.
     /// </summary>
     /// <param name="payloadLength">Length of the event's raw-status payload string.</param>
     /// <returns>The per-event byte cost.</returns>