Merge branch 'fix/gwc-28-29-30-polish'

# Conflicts:
#	archreview/2026-07-12/remediation/00-tracking.md

src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs

@@ -116,9 +116,12 @@ public sealed class MxAccessGatewayService(
                 return bulkConstraintPlan.CreateDeniedReply(request);
             }
 
-            MxCommandRequest invokeRequest = request.Clone();
-            invokeRequest.Command = commandToInvoke;
-            WorkerCommand workerCommand = mapper.MapCommand(invokeRequest);
+            // Map from the command alone: cloning the whole request only to overwrite its command with
+            // commandToInvoke deep-cloned the (potentially large) original payload for nothing, since
+            // MapCommand reads nothing but the command (GWC-29). The one clone that matters still
+            // happens inside MapCommand, which is what keeps the worker-bound graph unaliased from
+            // commandToInvoke — the caller still reads it below via TrackCommandReply.
+            WorkerCommand workerCommand = mapper.MapCommand(commandToInvoke);
             WorkerCommandReply workerReply = await sessionManager
                 .InvokeAsync(request.SessionId, workerCommand, context.CancellationToken)
                 .ConfigureAwait(false);

src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGrpcMapper.cs

@@ -29,9 +29,27 @@ public sealed class MxAccessGrpcMapper
         ArgumentNullException.ThrowIfNull(request);
         ArgumentNullException.ThrowIfNull(request.Command);
 
+        return MapCommand(request.Command);
+    }
+
+    /// <summary>
+    /// Maps a gRPC MX command to a worker command. Callers that already hold the command — including
+    /// the constraint pipeline, whose rewritten command is not the one on the request — use this
+    /// overload rather than cloning a whole request to carry a single field (GWC-29); nothing outside
+    /// the command is read here.
+    /// </summary>
+    /// <param name="command">Command payload.</param>
+    /// <returns>The mapped <see cref="WorkerCommand"/> ready for worker dispatch.</returns>
+    public WorkerCommand MapCommand(MxCommand command)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+
+        // The clone is required and must stay: the caller may hand us the gRPC-owned request command,
+        // and the caller keeps reading it after dispatch (TrackCommandReply). Cloning here is what makes
+        // WorkerClient.CreateCommandEnvelope's no-aliasing invariant true.
         return new WorkerCommand
         {
-            Command = request.Command.Clone(),
+            Command = command.Clone(),
             EnqueueTimestamp = Timestamp.FromDateTimeOffset(_timeProvider.GetUtcNow()),
         };
     }

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerClient.cs

@@ -40,7 +40,9 @@ public sealed class WorkerClient : IWorkerClient
     private readonly ConcurrentDictionary<string, PendingCommand> _pendingCommands = new(StringComparer.Ordinal);
     private readonly SemaphoreSlim _pendingCommandSlots;
     private readonly CancellationTokenSource _stopCts = new();
-    private long _nextSequence;
+    // Touched only by WriteLoopAsync — the single consumer of _outboundEnvelopes — so it needs no
+    // interlocking. See WriteLoopAsync for why the stamp happens there rather than at construction.
+    private ulong _nextSequence;
     private WorkerClientState _state;
     private DateTimeOffset _lastHeartbeatAt;
     private int? _processId;
@@ -404,6 +406,13 @@ public sealed class WorkerClient : IWorkerClient
         {
             await foreach (WorkerEnvelope envelope in _outboundEnvelopes.Reader.ReadAllAsync(_stopCts.Token).ConfigureAwait(false))
             {
+                // GWC-28: stamp the sequence at the point of writing, not when the envelope is built.
+                // Stamping at construction let two concurrent InvokeAsync callers take 1 and 2 and then
+                // enqueue in the order 2, 1 — non-monotonic on the wire, breaking gateway.md's
+                // "monotonic per sender" contract. This loop is the channel's single consumer
+                // (SingleReader = true), so wire order and stamp order are the same thing here and
+                // _nextSequence needs no interlocking. Mirrors the worker's WRK-04 fix.
+                envelope.Sequence = unchecked(++_nextSequence);
                 await _writer.WriteAsync(envelope, _stopCts.Token).ConfigureAwait(false);
             }
         }
@@ -1072,11 +1081,13 @@ public sealed class WorkerClient : IWorkerClient
         string correlationId,
         Action<WorkerEnvelope> setBody)
     {
+        // Sequence is deliberately left unset here: WriteLoopAsync stamps it immediately before the
+        // frame goes out, so the numbers are monotonic in wire order however the callers interleave
+        // between construction and enqueue (GWC-28, mirroring the worker's WRK-04 fix).
         WorkerEnvelope envelope = new()
         {
             ProtocolVersion = _connection.FrameOptions.ProtocolVersion,
             SessionId = SessionId,
-            Sequence = (ulong)Interlocked.Increment(ref _nextSequence),
             CorrelationId = correlationId,
         };
         setBody(envelope);

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerFrameReader.cs

@@ -5,11 +5,24 @@ using ZB.MOM.WW.MxGateway.Contracts.Proto;
 
 namespace ZB.MOM.WW.MxGateway.Server.Workers;
 
+/// <summary>
+/// Reads length-prefixed WorkerEnvelope protobuf frames from a stream.
+/// </summary>
+/// <remarks>
+///     <see cref="ReadAsync"/> is not reentrant: the reader keeps a per-instance length-prefix scratch
+///     buffer, so exactly one consumer may be inside a read at a time. That matches how the reader is
+///     used — a single read loop per <c>WorkerClient</c>, with handshake reads completing before the
+///     loop starts.
+/// </remarks>
 public sealed class WorkerFrameReader
 {
     private readonly WorkerFrameProtocolOptions _options;
     private readonly Stream _stream;
 
+    // Reused across frames rather than allocated per read (GWC-30). Safe because ReadAsync is
+    // single-consumer by construction; the prefix is fully overwritten by every read.
+    private readonly byte[] _lengthPrefix = new byte[sizeof(uint)];
+
     /// <summary>
     /// Initializes a new instance of <see cref="WorkerFrameReader"/>.
     /// </summary>
@@ -30,10 +43,9 @@ public sealed class WorkerFrameReader
     /// <returns>Parsed worker envelope.</returns>
     public async ValueTask<WorkerEnvelope> ReadAsync(CancellationToken cancellationToken = default)
     {
-        byte[] lengthPrefix = new byte[sizeof(uint)];
-        await ReadExactlyOrThrowAsync(lengthPrefix, cancellationToken).ConfigureAwait(false);
+        await ReadExactlyOrThrowAsync(_lengthPrefix, cancellationToken).ConfigureAwait(false);
 
-        uint payloadLength = BinaryPrimitives.ReadUInt32LittleEndian(lengthPrefix);
+        uint payloadLength = BinaryPrimitives.ReadUInt32LittleEndian(_lengthPrefix);
         if (payloadLength == 0)
         {
             throw new WorkerFrameProtocolException(