chore(clients): regenerate Go/Java bindings and Rust vendored proto for the statuses contract comments

clients/go/internal/generated/mxaccess_gateway.pb.go

@@ -2697,6 +2697,9 @@ func (x *Write2Command) GetUserId() int32 {
 	return 0
 }
 
+// The unary reply's statuses field carries the correlated OnWriteComplete
+// outcome when it arrives within the worker's bounded wait — see
+// MxCommandReply.statuses.
 type WriteSecuredCommand struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
 	ServerHandle   int32                  `protobuf:"varint,1,opt,name=server_handle,json=serverHandle,proto3" json:"server_handle,omitempty"`
@@ -2775,6 +2778,9 @@ func (x *WriteSecuredCommand) GetValue() *MxValue {
 	return nil
 }
 
+// The unary reply's statuses field carries the correlated OnWriteComplete
+// outcome when it arrives within the worker's bounded wait — see
+// MxCommandReply.statuses.
 type WriteSecured2Command struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
 	ServerHandle   int32                  `protobuf:"varint,1,opt,name=server_handle,json=serverHandle,proto3" json:"server_handle,omitempty"`
@@ -4575,8 +4581,20 @@ type MxCommandReply struct {
 	// HRESULT captured from MXAccess or a COM exception. This remains separate
 	// from gateway protocol status so MXAccess parity details are not hidden by
 	// transport failures.
-	Hresult           *int32           `protobuf:"varint,5,opt,name=hresult,proto3,oneof" json:"hresult,omitempty"`
-	ReturnValue       *MxValue         `protobuf:"bytes,6,opt,name=return_value,json=returnValue,proto3" json:"return_value,omitempty"`
+	Hresult     *int32   `protobuf:"varint,5,opt,name=hresult,proto3,oneof" json:"hresult,omitempty"`
+	ReturnValue *MxValue `protobuf:"bytes,6,opt,name=return_value,json=returnValue,proto3" json:"return_value,omitempty"`
+	// Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+	// replies the worker holds the reply for a bounded window (default 1.5 s,
+	// MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+	// MXAccess OnWriteComplete callback and copies its status rows here, so
+	// statuses[0] carries the real MXAccess commit outcome (success OR failure)
+	// while protocol_status/hresult still describe command acceptance only.
+	// Empty statuses on a write reply means the completion did not arrive
+	// within the window — the write is unconfirmed, not failed. Correlation is
+	// best-effort per (server_handle, item_handle): MXAccess's callback carries
+	// no transaction id, so concurrent writes to the same item within the
+	// window can swap rows. The OnWriteComplete event still flows on the event
+	// stream unchanged. Other command kinds leave this field as before.
 	Statuses          []*MxStatusProxy `protobuf:"bytes,7,rep,name=statuses,proto3" json:"statuses,omitempty"`
 	DiagnosticMessage string           `protobuf:"bytes,8,opt,name=diagnostic_message,json=diagnosticMessage,proto3" json:"diagnostic_message,omitempty"`
 	// Types that are valid to be assigned to Payload:

clients/java/src/main/generated/main/java/mxaccess_gateway/v1/MxaccessGateway.java

@@ -26028,6 +26028,12 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
     mxaccess_gateway.v1.MxaccessGateway.MxValueOrBuilder getValueOrBuilder();
   }
   /**
+   * <pre>
+   * The unary reply's statuses field carries the correlated OnWriteComplete
+   * outcome when it arrives within the worker's bounded wait — see
+   * MxCommandReply.statuses.
+   * </pre>
+   *
    * Protobuf type {@code mxaccess_gateway.v1.WriteSecuredCommand}
    */
   public static final class WriteSecuredCommand extends
@@ -26357,6 +26363,12 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return builder;
     }
     /**
+     * <pre>
+     * The unary reply's statuses field carries the correlated OnWriteComplete
+     * outcome when it arrives within the worker's bounded wait — see
+     * MxCommandReply.statuses.
+     * </pre>
+     *
      * Protobuf type {@code mxaccess_gateway.v1.WriteSecuredCommand}
      */
     public static final class Builder extends
@@ -26976,6 +26988,12 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
     mxaccess_gateway.v1.MxaccessGateway.MxValueOrBuilder getTimestampValueOrBuilder();
   }
   /**
+   * <pre>
+   * The unary reply's statuses field carries the correlated OnWriteComplete
+   * outcome when it arrives within the worker's bounded wait — see
+   * MxCommandReply.statuses.
+   * </pre>
+   *
    * Protobuf type {@code mxaccess_gateway.v1.WriteSecured2Command}
    */
   public static final class WriteSecured2Command extends
@@ -27347,6 +27365,12 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return builder;
     }
     /**
+     * <pre>
+     * The unary reply's statuses field carries the correlated OnWriteComplete
+     * outcome when it arrives within the worker's bounded wait — see
+     * MxCommandReply.statuses.
+     * </pre>
+     *
      * Protobuf type {@code mxaccess_gateway.v1.WriteSecured2Command}
      */
     public static final class Builder extends
@@ -50488,24 +50512,99 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
     mxaccess_gateway.v1.MxaccessGateway.MxValueOrBuilder getReturnValueOrBuilder();
 
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     java.util.List<mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy> 
         getStatusesList();
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy getStatuses(int index);
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     int getStatusesCount();
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     java.util.List<? extends mxaccess_gateway.v1.MxaccessGateway.MxStatusProxyOrBuilder> 
         getStatusesOrBuilderList();
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     mxaccess_gateway.v1.MxaccessGateway.MxStatusProxyOrBuilder getStatusesOrBuilder(
@@ -51233,6 +51332,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
     @SuppressWarnings("serial")
     private java.util.List<mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy> statuses_;
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     @java.lang.Override
@@ -51240,6 +51354,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return statuses_;
     }
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     @java.lang.Override
@@ -51248,6 +51377,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return statuses_;
     }
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     @java.lang.Override
@@ -51255,6 +51399,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return statuses_.size();
     }
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     @java.lang.Override
@@ -51262,6 +51421,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
       return statuses_.get(index);
     }
     /**
+     * <pre>
+     * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+     * replies the worker holds the reply for a bounded window (default 1.5 s,
+     * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+     * MXAccess OnWriteComplete callback and copies its status rows here, so
+     * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+     * while protocol_status/hresult still describe command acceptance only.
+     * Empty statuses on a write reply means the completion did not arrive
+     * within the window — the write is unconfirmed, not failed. Correlation is
+     * best-effort per (server_handle, item_handle): MXAccess's callback carries
+     * no transaction id, so concurrent writes to the same item within the
+     * window can swap rows. The OnWriteComplete event still flows on the event
+     * stream unchanged. Other command kinds leave this field as before.
+     * </pre>
+     *
      * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
      */
     @java.lang.Override
@@ -53981,6 +54155,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
           mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy, mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.Builder, mxaccess_gateway.v1.MxaccessGateway.MxStatusProxyOrBuilder> statusesBuilder_;
 
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public java.util.List<mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy> getStatusesList() {
@@ -53991,6 +54180,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         }
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public int getStatusesCount() {
@@ -54001,6 +54205,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         }
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy getStatuses(int index) {
@@ -54011,6 +54230,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         }
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder setStatuses(
@@ -54028,6 +54262,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder setStatuses(
@@ -54042,6 +54291,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder addStatuses(mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy value) {
@@ -54058,6 +54322,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder addStatuses(
@@ -54075,6 +54354,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder addStatuses(
@@ -54089,6 +54383,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder addStatuses(
@@ -54103,6 +54412,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder addAllStatuses(
@@ -54118,6 +54442,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder clearStatuses() {
@@ -54131,6 +54470,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public Builder removeStatuses(int index) {
@@ -54144,6 +54498,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return this;
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.Builder getStatusesBuilder(
@@ -54151,6 +54520,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         return internalGetStatusesFieldBuilder().getBuilder(index);
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public mxaccess_gateway.v1.MxaccessGateway.MxStatusProxyOrBuilder getStatusesOrBuilder(
@@ -54161,6 +54545,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         }
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public java.util.List<? extends mxaccess_gateway.v1.MxaccessGateway.MxStatusProxyOrBuilder> 
@@ -54172,6 +54571,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
         }
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.Builder addStatusesBuilder() {
@@ -54179,6 +54593,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
             mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.getDefaultInstance());
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.Builder addStatusesBuilder(
@@ -54187,6 +54616,21 @@ public final class MxaccessGateway extends com.google.protobuf.GeneratedFile {
             index, mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.getDefaultInstance());
       }
       /**
+       * <pre>
+       * Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+       * replies the worker holds the reply for a bounded window (default 1.5 s,
+       * MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+       * MXAccess OnWriteComplete callback and copies its status rows here, so
+       * statuses[0] carries the real MXAccess commit outcome (success OR failure)
+       * while protocol_status/hresult still describe command acceptance only.
+       * Empty statuses on a write reply means the completion did not arrive
+       * within the window — the write is unconfirmed, not failed. Correlation is
+       * best-effort per (server_handle, item_handle): MXAccess's callback carries
+       * no transaction id, so concurrent writes to the same item within the
+       * window can swap rows. The OnWriteComplete event still flows on the event
+       * stream unchanged. Other command kinds leave this field as before.
+       * </pre>
+       *
        * <code>repeated .mxaccess_gateway.v1.MxStatusProxy statuses = 7;</code>
        */
       public java.util.List<mxaccess_gateway.v1.MxaccessGateway.MxStatusProxy.Builder> 

clients/rust/protos/mxaccess_gateway.proto

@@ -256,6 +256,9 @@ message Write2Command {
   int32 user_id = 5;
 }
 
+// The unary reply's statuses field carries the correlated OnWriteComplete
+// outcome when it arrives within the worker's bounded wait — see
+// MxCommandReply.statuses.
 message WriteSecuredCommand {
   int32 server_handle = 1;
   int32 item_handle = 2;
@@ -266,6 +269,9 @@ message WriteSecuredCommand {
   MxValue value = 5;
 }
 
+// The unary reply's statuses field carries the correlated OnWriteComplete
+// outcome when it arrives within the worker's bounded wait — see
+// MxCommandReply.statuses.
 message WriteSecured2Command {
   int32 server_handle = 1;
   int32 item_handle = 2;
@@ -525,6 +531,18 @@ message MxCommandReply {
   // transport failures.
   optional int32 hresult = 5;
   MxValue return_value = 6;
+  // Correlated per-item outcome rows. For WRITE_SECURED / WRITE_SECURED2
+  // replies the worker holds the reply for a bounded window (default 1.5 s,
+  // MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for the matching
+  // MXAccess OnWriteComplete callback and copies its status rows here, so
+  // statuses[0] carries the real MXAccess commit outcome (success OR failure)
+  // while protocol_status/hresult still describe command acceptance only.
+  // Empty statuses on a write reply means the completion did not arrive
+  // within the window — the write is unconfirmed, not failed. Correlation is
+  // best-effort per (server_handle, item_handle): MXAccess's callback carries
+  // no transaction id, so concurrent writes to the same item within the
+  // window can swap rows. The OnWriteComplete event still flows on the event
+  // stream unchanged. Other command kinds leave this field as before.
   repeated MxStatusProxy statuses = 7;
   string diagnostic_message = 8;
 

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessCommandExecutorTests.cs

@@ -956,6 +956,9 @@ public sealed class MxAccessCommandExecutorTests
             sink.WriteCompletionCache.Record(82, 820, CreateCompletionRows(detail: 4321));
         using StaRuntime runtime = CreateRuntime();
         using MxAccessStaSession session = new(runtime, factory, sink);
+        // Hermetic: don't inherit MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS
+        // from the test runner's environment.
+        session.WriteCompletionTimeout = TimeSpan.FromSeconds(10);
         await session.StartAsync(workerProcessId: 1234);
 
         MxCommandReply reply = await session.DispatchAsync(CreateWriteSecuredCommand(
@@ -981,6 +984,12 @@ public sealed class MxAccessCommandExecutorTests
         FakeMxAccessComObject fakeComObject = new(registerHandle: 83);
         FakeMxAccessComObjectFactory factory = new(fakeComObject);
         CompletionCacheEventSink sink = new();
+        // Deterministic ordering: the executor captures its version baseline
+        // BEFORE the COM call, so once the fake's WriteSecured has run the
+        // baseline is committed and a Record from the test thread is
+        // guaranteed to be "newer" — no fixed sleep racing the STA thread.
+        using System.Threading.ManualResetEventSlim comCallReached = new(initialState: false);
+        fakeComObject.OnWriteSecuredCallback = () => comCallReached.Set();
         using StaRuntime runtime = CreateRuntime();
         using MxAccessStaSession session = new(runtime, factory, sink);
         session.WriteCompletionTimeout = TimeSpan.FromSeconds(10);
@@ -988,7 +997,7 @@ public sealed class MxAccessCommandExecutorTests
 
         Task<MxCommandReply> pending = session.DispatchAsync(CreateWriteSecuredCommand(
             "write-secured-waiting", serverHandle: 83, itemHandle: 830, value: 1, currentUserId: 11, verifierUserId: 22));
-        await Task.Delay(50);
+        Assert.True(comCallReached.Wait(TimeSpan.FromSeconds(5)));
         sink.WriteCompletionCache.Record(83, 830, CreateCompletionRows(detail: 99));
 
         MxCommandReply reply = await pending;
@@ -1063,6 +1072,8 @@ public sealed class MxAccessCommandExecutorTests
             sink.WriteCompletionCache.Record(86, 860, CreateCompletionRows(detail: 2222));
         using StaRuntime runtime = CreateRuntime();
         using MxAccessStaSession session = new(runtime, factory, sink);
+        // Hermetic: same rationale as the WriteSecured fast-completion test.
+        session.WriteCompletionTimeout = TimeSpan.FromSeconds(10);
         await session.StartAsync(workerProcessId: 1234);
 
         MxCommandReply reply = await session.DispatchAsync(CreateWriteSecured2Command(

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs

@@ -15,6 +15,48 @@ namespace ZB.MOM.WW.MxGateway.Worker.Tests.MxAccess;
 /// </summary>
 public sealed class MxAccessStaSessionTests
 {
+    /// <summary>
+    ///     Verifies the launcher-env-var parse branches of
+    ///     <see cref="MxAccessStaSession.ResolveWriteCompletionTimeout"/>:
+    ///     a valid non-negative value is honored (0 = disabled), while a
+    ///     missing, malformed, or negative value falls back to the executor
+    ///     default. Env mutation is restored in a finally so parallel tests
+    ///     never observe the temporary value.
+    /// </summary>
+    /// <param name="rawValue">Raw env-var value, or null for unset.</param>
+    /// <param name="expectedMilliseconds">Expected resolved wait, or null for the executor default.</param>
+    [Theory]
+    [InlineData(null, null)]
+    [InlineData("", null)]
+    [InlineData("junk", null)]
+    [InlineData("-5", null)]
+    [InlineData("0", 0)]
+    [InlineData("250", 250)]
+    public void ResolveWriteCompletionTimeout_ParsesEnvironmentValue(string? rawValue, int? expectedMilliseconds)
+    {
+        string? original = Environment.GetEnvironmentVariable(
+            MxAccessStaSession.WriteCompletionWaitEnvironmentVariableName);
+        try
+        {
+            Environment.SetEnvironmentVariable(
+                MxAccessStaSession.WriteCompletionWaitEnvironmentVariableName,
+                rawValue);
+
+            TimeSpan resolved = MxAccessStaSession.ResolveWriteCompletionTimeout();
+
+            TimeSpan expected = expectedMilliseconds is null
+                ? MxAccessCommandExecutor.DefaultWriteCompletionTimeout
+                : TimeSpan.FromMilliseconds(expectedMilliseconds.Value);
+            Assert.Equal(expected, resolved);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(
+                MxAccessStaSession.WriteCompletionWaitEnvironmentVariableName,
+                original);
+        }
+    }
+
     /// <summary>
     /// Verifies that StartAsync creates the MXAccess COM object and attaches the event sink on the STA thread.
     /// </summary>