ci(rust): allow generated result size lint

The subtag fallback's coverage was fixed at SubscribeAlarms time and never
re-examined. AlarmWatchListResolver deliberately swallows a Galaxy Repository
outage and returns whatever configuration contributed, so a discovery failure at
startup left the monitor subscribed with an empty watch-list for the rest of its
life. In Auto mode the alarmmgr primary keeps working, so nothing looks wrong
until the failover that needs the standby finds it covering zero alarms — with a
single LogWarning emitted possibly weeks earlier as the only evidence.

ResolveAsync now returns an AlarmWatchListResolution (targets + whether discovery
was attempted and whether it failed, with the failure message), which is what the
caller needed to tell "discovery produced nothing" from "nothing was configured".
GatewayAlarmMonitor grades that resolution against the effective mode and folds
the verdict into AlarmProviderStatus, so it reaches the feed, the dashboard badge
and every late-joining subscriber:

- zero targets while the mode can need them (Auto/ForceSubtag) -> degraded with
  SubtagWatchListEmpty; discovery enabled but failing adds SubtagDiscoveryFailed
  and the message. ForceAlarmManager builds no subtag consumer and is not graded.
- degraded is now the OR of "subtag is serving" and "the watch-list covers
  nothing", so the Auto case where alarmmgr is healthy and the standby is empty
  is visible. DashboardAlarmProviderStatus renders that combination as the amber
  "Alarm Manager (no subtag standby)" badge rather than the failover label, which
  would have named the wrong live provider.
- on the failover edge (ApplyProviderModeChangeAsync, toMode == Subtag) the
  monitor re-resolves BEFORE publishing the status and reports any difference as
  SubtagWatchListStale with both counts.

The re-resolution is deliberately NOT re-sent. The worker rejects a second
SubscribeAlarms while subscribed (AlarmCommandHandler.Subscribe), and the only
expressible replacement — UnsubscribeAlarms then SubscribeAlarms — rebuilds
FailoverAlarmConsumer, which restarts on the primary that just failed and
discards the warm standby state, so it would flap the feed rather than repair it.
The finding's other alternative (treat empty coverage as a lifecycle failure) was
rejected too: it would crash-loop the monitor every 5 s on a persistent GR outage
and take the working alarmmgr feed down with it. A monitor restart re-resolves and
re-sends, and the status now says so.

Docs: docs/AlarmClientDiscovery.md gains the grading rules and corrects two stale
claims (the resolver method name, and "re-runs discovery on its reconcile cadence
and pushes an updated watch-list", which never happened); gateway.md gains the
standby-coverage visibility paragraph; docs/GatewayConfiguration.md records the
consequence on the UseGalaxyRepository and Mode rows.

Tests: SubtagCoverage_WhenDiscoveryFailsAtSubscribe_ProviderStatusIsDegradedWith-
Reason and SubtagCoverage_WhenDiscoveryRecoversByFailover_ReResolvesAndReportsDrift
drive the fake-worker monitor; two resolver cases pin the new provenance fields.
The pre-existing dashboard case for degraded+ALARMMGR now asserts the new label.

.gitea/workflows/ci.yml

@@ -4,16 +4,16 @@
 # .NET Framework 4.8 / x86 and need MXAccess COM installed, so they build ONLY on a Windows host.
 # They are out of scope for this Linux `portable` job — the `windows-x86` job below builds and
 # tests them on windev (10.100.0.48) over SSH (see scripts/ci/run-windev-ci.sh), and the nightly
-# `nightly-windev` job additionally runs the live-MXAccess smoke, which is scheduled-only so it
-# never gates a push.
+# `nightly-windev` job additionally runs the full solution build, gateway suite, and live-MXAccess
+# smoke, which are scheduled-only so they never gate a push.
 name: ci
 
 on:
   push:
   pull_request:
   schedule:
-    # 06:00 UTC nightly: the `nightly-windev` job re-runs the x86 Worker build + full Worker.Tests on
-    # windev, then the live-MXAccess smoke (MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1) and a full-slnx build.
+    # 06:00 UTC nightly: x86 Worker build + Worker.Tests, full-slnx build, gateway tests, then the
+    # live-MXAccess smoke (MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1), serialized on windev's host lock.
     # Push/PR runs skip it — the job is gated `if: github.event_name == 'schedule'`.
     - cron: '0 6 * * *'
 
@@ -23,7 +23,12 @@ jobs:
     # tests, the codegen/descriptor freshness guards, and the clients that build on Linux.
     runs-on: ubuntu-latest
     steps:
+      # fetch-depth: 0 (full history + tags): the CLI-46 client-version-freshness check below
+      # diffs each client's source against its last publish tag (e.g. clients/go/vX.Y.Z), which
+      # a shallow, tagless checkout cannot resolve.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -77,6 +82,18 @@ jobs:
         shell: pwsh
         run: ./scripts/check-codegen.ps1
 
+      # CLI-46: catches a client whose source changed since its last publish
+      # tag while the version constant still reads that tag's already-shipped
+      # number — the drift the pack-clients.ps1/tag-go-module.ps1 collision
+      # guards only catch at actual publish time. Needs tag history, hence
+      # `fetch-depth: 0` on this job's checkout above.
+      - name: Client version freshness
+        shell: pwsh
+        run: ./scripts/check-client-versions.ps1
+
+      - name: Code-reviews README consistency
+        run: python code-reviews/regen-readme.py --check
+
       - name: Gateway fake-worker tests
         run: dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj -c Release --no-build
 
@@ -165,7 +182,7 @@ jobs:
         run: ./scripts/ci/run-windev-ci.sh test
 
   nightly-windev:
-    # TST-25: scheduled deep run — full Worker.Tests + live-MXAccess smoke + full-slnx build on windev.
+    # TST-35: scheduled deep run — Worker, full-slnx, gateway, and live-smoke tiers on windev.
     # Gated to the schedule event via `if:` (not an unsatisfiable `runs-on`), so push/PR runs mark it
     # skipped, not queued. Never gates a push. On failure it opens a Gitea issue so a red nightly is
     # visible even though nobody watches the Actions page.
@@ -181,7 +198,7 @@ jobs:
       PUBLIC_SERVER_URL: https://gitea.dohertylan.com
     steps:
       - uses: actions/checkout@v4
-      - name: Full Worker.Tests + live-MXAccess smoke on windev
+      - name: Worker + gateway tests + live-MXAccess smoke on windev
         env:
           # WINDEV_SSH_KEY is stored base64-encoded (single line) so Gitea's line-oriented secret
           # masker redacts it in the step env echo; run-windev-ci.sh decodes it. A raw multiline PEM

.gitignore

@@ -155,3 +155,4 @@ generated-scratch/
 
 # Agent worktrees (subagent isolation) — never commit
 .claude/worktrees/
+.worktrees/

CLAUDE.md

@@ -157,9 +157,9 @@ External analysis sources referenced by design docs:
 
 Gateway gRPC clients authenticate with an API key in metadata: `authorization: Bearer mxgw_<key-id>_<secret>`. Keys are stored hashed (with a peppered SHA) in a gateway-owned SQLite DB (default `C:\ProgramData\MxGateway\gateway-auth.db`). Scopes (`session:open`, `session:close`, `invoke:read`, `invoke:write`, `invoke:secure`, `events:read`, `metadata:read`, `admin`) gate specific RPCs; missing → `Unauthenticated`, insufficient → `PermissionDenied`. The `apikey` subcommand on the server exe manages keys; see `src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/`.
 
-Session event streaming is **owner-scoped**: the API key that opened a session is recorded on the session, and every `StreamEvents` attach/reattach is rejected with `PermissionDenied` unless the caller's key id matches the owner. Possessing the `event` scope and knowing a session id is not sufficient — this closes the reconnect/fan-out trust boundary (detach-grace and replay retention are on by default) so an `event`-scoped key cannot attach to another key's retained session.
+Session event streaming is **owner-scoped**: the API key that opened a session is recorded on the session, and every `StreamEvents` attach/reattach is rejected with `PermissionDenied` unless the caller's key id matches the owner. Possessing the `events:read` scope and knowing a session id is not sufficient — this closes the reconnect/fan-out trust boundary (detach-grace and replay retention are on by default) so an `events:read`-scoped key cannot attach to another key's retained session.
 
-Dashboard auth is LDAP-backed (separate from the gRPC API-key model). `/login` binds against `MxGateway:Ldap` and maps the user's LDAP groups to `Admin` or `Viewer` via `MxGateway:Dashboard:GroupToRole`, then issues an HTTP-only secure cookie named `__Host-MxGatewayDashboard` when `Dashboard:RequireHttpsCookie` is true (default) and no `Dashboard:CookieName` override is set, else the plain `MxGatewayDashboard` (the `__Host-` prefix requires a Secure cookie). SignalR hubs at `/hubs/{snapshot,alarms,events}` accept either the cookie or a 5-minute bearer minted at `/hubs/token`. Dashboard event visibility is **tag-scoped per session** (`IDashboardSessionAcl`, gating both the events hub and the session-details page's in-process subscribe): an Administrator sees every session, while any other caller sees a session only when its tags — inherited from the owning API key's `apikey --dashboard-tags`, never from the client's request — intersect the tags their LDAP groups grant via `Dashboard:GroupToTag`; untagged sessions follow `Dashboard:UntaggedSessionVisibility` (default `AdminOnly`), and a principal with no tag claims (anonymous localhost included) is an empty-grant Viewer. `Dashboard:AllowAnonymousLocalhost` (default `true`) grants **read-only** loopback access — it satisfies the Viewer requirement but never the Admin-only requirement, so anonymous localhost can view the dashboard but not reach API-key CRUD or session Close/Kill (`Authentication:Mode=Disabled` is scoped the same way). `Dashboard:DisableLogin` (default `false`) auto-authenticates every dashboard request — including remote browsers — as `Dashboard:AutoLoginUser` (default `multi-role`) with both Admin and Viewer roles; dev/test only, never enable in production.
+Dashboard auth is LDAP-backed (separate from the gRPC API-key model). `/login` binds against `MxGateway:Ldap` and maps the user's LDAP groups to `Admin` or `Viewer` via `MxGateway:Dashboard:GroupToRole`, then issues an HTTP-only secure cookie named `__Host-MxGatewayDashboard` when `Dashboard:RequireHttpsCookie` is true (default) and no `Dashboard:CookieName` override is set, else the plain `MxGatewayDashboard` (the `__Host-` prefix requires a Secure cookie). SignalR hubs at `/hubs/{snapshot,alarms,events}` accept either the cookie or a 5-minute bearer minted at `/hubs/token`; `/hubs/alarms` and the `/alarms` page additionally require a **real authenticated dashboard role** (`MxGateway.Dashboard.Alarms`, a requirement type the environment-bypass handler does not handle), because the alarm feed is gateway-central with no per-session provenance and so cannot be tag-scoped — its metadata stays galaxy-wide for authenticated Viewers, but anonymous localhost and `Authentication:Mode=Disabled` do not receive it at all. Dashboard event visibility is **tag-scoped per session** (`IDashboardSessionAcl`, gating both the events hub and the session-details page's in-process subscribe): an Administrator sees every session, while any other caller sees a session only when its tags — inherited from the owning API key's `apikey --dashboard-tags`, never from the client's request — intersect the tags their LDAP groups grant via `Dashboard:GroupToTag`. That grant is **re-resolved from the caller's LDAP group claims against current options on every subscribe** (not read from the tag claims stamped at login, which would outlive a config-revoked grant for the cookie's 8-hour sliding life); login-stamped tag claims are the fallback only for a principal carrying no group claims — i.e. the hub-token principal, whose grant the mint already re-resolved. Untagged sessions follow `Dashboard:UntaggedSessionVisibility` (default `AdminOnly`), and a principal with neither claim kind (anonymous localhost included) is an empty-grant Viewer. `Dashboard:AllowAnonymousLocalhost` (default `true`) grants **read-only** loopback access — it satisfies the Viewer requirement but never the Admin-only requirement, so anonymous localhost can view the dashboard but not reach API-key CRUD, session Close/Kill, or the alarm feed (`Authentication:Mode=Disabled` is scoped the same way). `Dashboard:DisableLogin` (default `false`) auto-authenticates every dashboard request — including remote browsers — as `Dashboard:AutoLoginUser` (default `multi-role`) with both Admin and Viewer roles; dev/test only, never enable in production.
 
 ## Process / Platform Notes
 

REVIEW-PROCESS.md

@@ -79,6 +79,12 @@ Add one entry per finding to the `## Findings` section of the module's
 
 - **Finding ID** — `<Module>-NNN`, numbered sequentially within the module and
   never reused (e.g. `Worker-001`). IDs are permanent even after resolution.
+  The `GWC`/`WRK`/`IPC`/`SEC`/`CLI`/`TST` prefixes are reserved for the
+  `archreview/` domain registers (a separate, whole-repo review series with its
+  own tracking documents) — never assign one of these prefixes to a
+  `code-reviews/` finding, and any other work stream (perf passes, ad hoc
+  remediation plans, etc.) that wants a stable per-item ID must mint its own
+  distinct prefix rather than borrowing one of these six.
 - **Severity:**
   - **Critical** — data loss, security breach, crash/deadlock, or outage.
   - **High** — incorrect behaviour with significant impact; no safe workaround.
@@ -127,8 +133,9 @@ finding carries an unrecognised Status value. The PowerShell wrapper
 `scripts/check-code-reviews-readme.ps1` runs that check and is the intended hook
 for CI or a pre-commit step.
 
-> The repo's installed `python` is the real interpreter; the bare `python3`
-> alias resolves to the Windows Store stub and fails. Use `python`.
+> On Windows, the installed interpreter may be available only as `python`
+> because `python3` can resolve to the Windows Store stub. macOS and Linux
+> normally use `python3`; CI uses the configured `python` executable.
 
 The per-module `findings.md` files are the source of truth; `README.md` is the
 aggregated index and must always agree with them — which the script guarantees.

archreview/2026-07-12/remediation/00-tracking.md

@@ -79,6 +79,9 @@ Full design + implementation for each row lives in the linked domain doc under i
 | WRK-26 | Low | P1 | S | WRK-23 (soft); discharges IPC-29 | Done | Write-priority and overflow doc drift from the WRK-07 change |
 | WRK-27 | Low | — | S | — | Done | Alarm poll bypasses the watchdog's in-flight suppression (15 s vs 75 s) |
 | WRK-28 | Low | — | S | WRK-21 (same batch) | Done | 10,000 drain cap is a duplicated magic constant |
+| WRK-29 | — | — | — | — | Reserved (do not reuse) | Interim ID space possibly burned alongside WRK-31 by `e913dab`'s ad hoc numbering; not confirmed in the repo or its history, held back defensively |
+| WRK-30 | — | — | — | — | Reserved (do not reuse) | Interim ID space possibly burned alongside WRK-31 by `e913dab`'s ad hoc numbering; not confirmed in the repo or its history, held back defensively |
+| WRK-31 | — | — | — | — | Reserved (do not reuse) | Interim ID burned by `e913dab` (session-owned transport disposal), cited in code at `Ipc/WorkerPipeSession.cs:45,177` and `Ipc/WorkerPipeSessionTests.cs` outside the register; not a finding — registered per cycle-3 `20-worker.md` (~line 9) so it is never reassigned. Cycle-3 new findings start at WRK-32. |
 
 ### Contracts & IPC — [30-contracts-ipc.md](30-contracts-ipc.md)
 
@@ -92,7 +95,7 @@ Full design + implementation for each row lives in the linked domain doc under i
 | IPC-28 | Low | — | S | — | Done | docs/Grpc.md missing CommandTooLarge → ResourceExhausted mapping |
 | IPC-29 | Low | — | S | WRK-26 (discharged by) | Done (discharged by WRK-26) | WorkerFrameProtocol.md missing write-scheduling/sequencing section |
 | IPC-30 | Low | P0 | M | WRK-21 (same batch) | Done | Oversized event frame: keep session-fatal, make the death structured |
-| IPC-31 | Info | — | — | — | N/A | Gateway creation-time sequence stamping accepted; diagnostic-only, decision recorded |
+| IPC-31 | Info | — | — | — | Done (superseded by GWC-28) | Gateway creation-time sequence stamping — resolved when GWC-28 moved gateway stamping to write time; the two sides now implement the same semantics |
 | IPC-32 | Info | — | S | IPC-25 (folded in) | Done | check-codegen banner relabel 1/4…4/4 |
 
 ### Security & dashboard — [40-security-dashboard.md](40-security-dashboard.md)
@@ -152,6 +155,14 @@ Sequence these together rather than piecemeal — several are one change set spa
 - ~~When CLI-38 lands, close old **CLI-08** with a pointer here.~~ Done 2026-08-07: CLI-38 landed and old CLI-08 is now `Done` in the first-cycle tracker, pointing at [CLI-38](50-clients.md#cli-38--align-netgojava-on-hresult--0-lands-prior-cli-08-cures-the-doc-drift---medium--p1).
 - ~~When WRK-26 lands, its doc section also discharges the WorkerFrameProtocol gap~~ Done 2026-08-07: WRK-26 landed and **IPC-29** is discharged, pointing at [WRK-26](20-worker.md#wrk-26--write-priority-and-overflow-doc-drift-from-the-wrk-07-change---low--p1). ~~When TST-25 lands, revisit old **TST-05** (scheduled live smoke) and **TST-24** (client wire tests), which it unlocks.~~ TST-05 revisited 2026-08-10: `Partially done` in the first-cycle tracker — the `nightly-windev` job closes the scheduled-cadence half, but the finding's coverage-audit half stays open (the live suite reaches all six late-added COM commands and none of the five control commands). TST-24 revisited in the same change and closed `Done`: Go/Rust/Java already had real-server wire tests, and the two genuine gaps (.NET, Python) now have them plus a CI step.
 
+## 2026-08-25 documentation correction
+
+The 2026-08-07 IPC-23 change-log entry's `docs/Grpc.md` deviation rationale is inaccurate:
+`DrainEvents` is not private worker IPC. It is a public `MxCommandKind` accepted by the
+`Invoke` RPC. Cycle-3 IPC-38 adds the missing public count-cap, byte-cap,
+drain-until-empty, and destructive-stream interaction contract to `docs/Grpc.md` while
+preserving the historical entry below.
+
 ## Change log
 
 | Date | Change |

archreview/2026-07-12/remediation/20-worker.md

@@ -24,6 +24,7 @@ members, no positional records). The worker builds and tests only on the Windows
 | WRK-26 | Low | P1 | S | WRK-23 (soft — sequence prose); discharges IPC-29 | Done | Write-priority and overflow doc drift from the WRK-07 change |
 | WRK-27 | Low | — | S | — | Done | Alarm poll bypasses the watchdog's in-flight suppression (15 s vs 75 s) |
 | WRK-28 | Low | — | S | WRK-21 (land in the same commit cluster) | Done | 10,000 drain cap is a duplicated magic constant with a comment-only sync contract |
+| WRK-31 | — | — | — | — | Reserved (do not reuse) | Not a finding. `e913dab` (session-owned transport disposal) coined "WRK-31" ad hoc in code comments (`Ipc/WorkerPipeSession.cs:45,177`) and in `Ipc/WorkerPipeSessionTests.cs`, before the register assigned it. WRK-29/WRK-30 appear nowhere in the repo or its history but may have been burned by the same interim numbering, so they are held back defensively too — see the tracker's WRK-29/30/31 rows. Registered here per cycle-3 `archreview/2026-08-19/20-worker.md` (~line 9, "Finding-ID note"); that review's new findings start at **WRK-32** to guarantee no collision. |
 
 ---
 

archreview/2026-07-12/remediation/30-contracts-ipc.md

@@ -231,6 +231,8 @@ The published-side collection (`CollectPublishedSymbols`, `:61-79`) grows matchi
 
 **Disposition: N/A — no action.** `gateway.md:328-330` already declares sequence a per-sender diagnostic aid, never validated; both validators ignore it; the divergence is harmless and now explicitly documented by the IPC-29 doc section (which states the two sides' stamping points). If sequence ever becomes load-bearing, stamp in the gateway write loop (`WorkerClient.cs:390-397`) — recorded here so the next editor finds the decision.
 
+**Resolution: Done — superseded by GWC-28 (2026-08-20, per cycle-3 verification).** GWC-28 moved the gateway-side stamp from creation to the point of writing: `WriteLoopAsync` now stamps `Sequence` immediately before `_writer.WriteAsync` (`Server/Workers/WorkerClient.cs:465-471`), and `CreateEnvelope` leaves it unset (`:1229-1236`); `gateway.md:425-431` was rewritten to "both sides stamp at the point of writing", closing the divergence this finding recorded. Regression test `WorkerClientTests.ConcurrentInvokesEmitStrictlyIncreasingSequencesOnTheWire` covers it. Per `archreview/2026-08-19/30-contracts-ipc.md` (IPC-31 row), tracker flipped from `N/A` to `Done (superseded by GWC-28)`. See cycle-3 **IPC-39** for the one interaction the change created with the IPC-03 pre-check.
+
 ---
 
 ## IPC-32 — `check-codegen.ps1` check labels are miscounted   `Info` · `—` (rides IPC-25)

archreview/2026-08-19/remediation/00-tracking.md

@@ -0,0 +1,238 @@
+# MxAccessGateway — Remediation Plan & Tracking (2026-08-19 review)
+
+Source review: [`../00-overall.md`](../00-overall.md) (HEAD `8b3e3b3`, committed as `f4919ba`). Generated 2026-08-20.
+Tracks the 34 cycle-3 IDs (GWC-31+, WRK-32+, IPC-33+, SEC-37+, CLI-46+, TST-31+) plus the tracker-housekeeping actions the overall asked for. Cycle-1/2 trackers remain the record for their own IDs.
+
+**Status legend:** `Not started` · `In progress` · `Done` · `Blocked (external)` · `Deferred (P2)` · `N/A`.
+
+## Execution model
+
+This plan is executed as **seven parallel batches**, each by one subagent working in an isolated git worktree on its own `fix/c3-<batch>` branch, merged back into `main` by the coordinator in the order listed (lowest conflict surface first). Every batch must: build the affected component(s) on macOS (`NonWindows.slnx` — the x86 worker cannot build here), run only the filtered tests it touches, update docs in the same commit, and cite finding IDs in commit messages (`fix(IPC-34): …`). Worker-side changes (batches E, F) are verified afterwards on windev via `windev-worker-ci.ps1 -Mode test`.
+
+**Model assignment rationale:** `opus` for batches that change concurrency/authorization logic or require reasoning across several interacting files with regression tests; `sonnet` for contained, well-specified edits with a clear recipe (version bumps, doc reconciliation, a two-line worker fix); `haiku` for none — every batch either touches code invariants or needs judgement about stale prose, where the cost of a wrong mechanical sweep exceeds the saving.
+
+| Batch | Branch | Findings | Model | Why this model | Status |
+|---|---|---|---|---|---|
+| A | `fix/c3-client-versions` | CLI-46 | sonnet | Mechanical five-client bump + README note + one script guard; recipe is fully specified | Done |
+| B | `fix/c3-glauth-doc` | TST-31 | sonnet | Reconcile a table against one TOML source of truth, re-derive one default, change an assert to a log | Done |
+| C | `fix/c3-tracker-hygiene` | GWC-31 + housekeeping (close GWC-16/IPC-08/IPC-31, refresh TST-06/TST-17, register WRK-31) | sonnet | Cross-file comment/ID sweep needs care about what each ID *means*, but no logic changes | Done (`3619152`) |
+| D | `fix/c3-dashboard-acl` | SEC-40, SEC-41, GWC-38 | opus | Authorization semantics, fail-closed decisions, claims re-resolution; each needs a regression test | **Done** (`b177636` GWC-38, `2ef7b93` SEC-41+SEC-40, `8257a03` comment fixup; branch not merged/pushed) |
+| E | `fix/c3-ipc-boundaries` | IPC-33, IPC-39, IPC-34, IPC-35 | opus | Changes the WorkerClient command lifecycle, the options validator, and the worker drain budget; race-sensitive | **Done** (`577a0db` IPC-33, `a71663a` IPC-39, `b27035b` IPC-34, `ab41362` IPC-35; branch `fix/c3-ipc-boundaries`, not merged/pushed) — worker half verified on windev (`f2ab9cc`, Worker.Tests 524/524) |
+| F | `fix/c3-worker-residuals` | WRK-32, WRK-33 (+WRK-34 opportunistic) | sonnet | Small, precisely located worker edits + doc prose; cannot be built on macOS so the agent's job is a careful, minimal diff | Done (windev x86 build + Worker.Tests 524/524 green on `f2ab9cc`) |
+| G | `fix/c3-session-lifecycle` | GWC-32, GWC-34, GWC-37 | opus | Distributor/dispose lifecycle races and an alarm-monitor re-resolve path; needs lock-discipline reasoning | Done (`058d8d5`, `282a0e7`, `1932217`) |
+
+**Out of scope for this execution (recorded, not dropped):**
+
+| ID | Status | Why |
+|---|---|---|
+| TST-32 | Blocked (external) | Gitea runner registration-token reset is a web-UI action on the Gitea admin page; no repo change. Operator to-do. |
+| SEC-37 | Blocked (external) | Family-wide: TLS on the shared GLAuth lives in `scadaproj/infra/glauth/` (separate repo + docker host). Plan separately; after it lands, move the deployed service to `Production`. |
+| CLI-47/48/49/50, IPC-36/37, TST-35 | Not started | Activated by the 2026-08-25 P2 continuation below. |
+| GWC-33/35, SEC-38/39 | Done | Closed by continuation batch I; regression counts and commits are recorded below. |
+| GWC-36, IPC-38, TST-33/34/36 | Done | Closed by continuation batch H; verification and commit are recorded below. |
+| WRK-34 | Done | Completed opportunistically in batch F (`3679e59`): watchdog faults use `CommandMethod=Watchdog` and carry the stuck correlation ID in the diagnostic message. Tracker correction recorded by the continuation audit. |
+
+## Batch specifications
+
+### A — CLI-46 client release-train bump (sonnet)
+- Bump .NET/Go/Python/Rust clients `0.2.0 → 0.2.1`, Java `0.2.1 → 0.2.2` in every version-bearing file (`pyproject.toml` + `version.py`, `Cargo.toml` workspace + any `version =` consumers, `Directory.Build.props`/csproj `<Version>`, Java `build.gradle`/`gradle.properties`, Go module is tag-driven — update any `Version` const if one exists). Follow `docs/ClientPackaging.md` for the authoritative file list.
+- `clients/python/README.md` + `docs/ClientPackaging.md`: note that published pypi 0.2.0 has a broken `connect()` (event-loop binding, fixed by `a8f86b5`) and is superseded by 0.2.1.
+- Add a PR-time check to `scripts/check-codegen.ps1` (or a new `scripts/check-client-versions.ps1` wired where the other checks run): fail if any `clients/<lang>` source differs from its last publish tag while the version constant still equals that tag's version. Document in `docs/ClientPackaging.md`.
+- Verify: `dotnet build clients/dotnet/...slnx`; `cargo check --workspace`; `python -m pytest` (clients/python); `JAVA_HOME=/opt/homebrew/opt/openjdk@17 gradle test` then **revert** spurious generated-proto churn; `go build ./... && go test ./...`.
+
+### B — TST-31 glauth.md + live-test credential (sonnet)
+- Reconcile `glauth.md` against `~/Desktop/scadaproj/infra/glauth/config.toml`: ReadOnly gid, the pre-provisioned users table (drop `readonly/readonly123`, fix `admin` password), the worked example at `:124`. Keep the OPC-UA taxonomy note.
+- Re-derive `MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_PASSWORD` default in `docs/GatewayTesting.md` and the `?? "admin123"` literal in `WorkerLiveMxAccessSmokeTests.cs` from the config; make the test **log** (not assert) whether `AuthenticateUser` succeeded.
+- Verify: `dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx` (IntegrationTests compiles on mac? if excluded, note it).
+
+### C — GWC-31 + tracker housekeeping (sonnet)
+- Sweep code comments citing unregistered `GWC-30`/`GWC-31` (perf pass) in `WorkerClient.cs`, `GatewayMetrics.cs`, `WorkerClientTests.cs`, worker `WorkerFrameReader/Writer.cs` to `PERF-nn` keyed to task numbers in `docs/plans/2026-08-15-perf-review-remediation.md`; add a PERF-ID table to that plan. Do not touch the genuine GWC-30 (frame-reader prefix) citations if any exist.
+- `archreview/REVIEW-PROCESS.md` (or wherever the ID rule lives): state that GWC/WRK/IPC/SEC/CLI/TST prefixes are reserved for archreview registers.
+- Cycle-2 tracker (`archreview/2026-07-12/remediation/00-tracking.md` + domain docs): GWC-16 → Won't fix (rationale from cycle-3 10-gateway-core.md), IPC-08 → Done (`7c1ea12`, residual IPC-34), IPC-31 → Done (superseded by GWC-28), refresh TST-06/TST-17 rows, register WRK-31 (interim ID burned by `e913dab`) so it is never reused.
+- Verify: `dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx`; `dotnet test --filter FullyQualifiedName~WorkerClientTests`.
+
+### D — SEC-40, SEC-41, GWC-38 (opus)
+- SEC-41: `DashboardSessionAcl` re-resolves tags from `LdapGroupClaimType` claims via `DashboardGroupTagMapping.MapGroupsToTags` against current options (as `HubTokenService` does) instead of trusting login-stamped tag claims; keep stamped claims only as fallback when no group claims exist (document). Test: principal with stale tag claim + group whose grant was removed → denied.
+- SEC-40: decide **tighten**: `AlarmsHub` gets a dedicated policy requiring a real role claim (anonymous-loopback/Disabled bypass excluded) — and document in `docs/GatewayDashboardDesign.md` ACL section + `docs/GatewayConfiguration.md` GroupToTag row that alarm metadata remains galaxy-wide for authenticated Viewers (central monitor, no per-session provenance). Test for the policy.
+- GWC-38: `GatewayBrowseScopeProvider` throws `RpcException(PermissionDenied)` (and logs) when `Current` is null **and** API-key auth is enabled; unchanged when auth mode is Disabled. Test both branches.
+- Verify: build Server; `dotnet test --filter "FullyQualifiedName~DashboardSessionAcl|FullyQualifiedName~AlarmsHub|FullyQualifiedName~BrowseScope"` (adjust to real class names).
+
+**Outcome (done, branch `fix/c3-dashboard-acl`, commits `b177636`, `2ef7b93`, `8257a03`; not merged, not pushed).** Decisions worth carrying forward:
+
+- **SEC-41 fallback:** the ACL re-resolves from `mxgateway:ldap_group` claims when the principal has any, and falls back to the stamped `zb:dashboardtag` claims only when it has none. That is exactly the hub-token principal — `HubTokenService.Validate` rehydrates roles and tags but **not** groups, so re-resolution already happened at mint. The fallback cannot re-open the cookie gap, because `DashboardAuthenticator` stamps both claim kinds from one group list.
+- **SEC-40 requirement type:** new `AuthenticatedDashboardRoleRequirement` + `AuthenticatedDashboardRoleHandler` and a `MxGateway.Dashboard.Alarms` policy. `DashboardAuthorizationHandler` is `AuthorizationHandler<DashboardAuthorizationRequirement>`, so it is never invoked for the new type — the same structural device the Secrets UI's `secrets:manage` already relies on. Both hub schemes are retained on the policy.
+- **SEC-40 scope answer:** the `/alarms` Blazor page carries the SAME policy (it reads the central monitor in process — gating only the hub left the disclosure one navigation away), and the side-rail Alarms link is wrapped in an `AuthorizeView` on that policy. `AlarmsHubPublisher` is unchanged and stays unfiltered by design: audience is decided at hub admission and the feed carries no per-session provenance.
+- **GWC-38:** `PermissionDenied` + warning only when `Authentication:Mode=ApiKey`; `Mode=Disabled` still returns unscoped. `GalaxyRepositoryHostWiringTests` phase 1 was changed to push an *unconstrained identity* rather than none — that is production's real unscoped case.
+- New/changed tests: `AlarmFeedAuthorizationTests` (new, 7), `DashboardSessionAclTests` (+5), `GatewayBrowseScopeProviderTests` (+2), `SecretsNavRenderTests` (+2, and it must register the new policy — an unregistered policy name *throws* inside `AuthorizeView` rather than denying). Filtered run over the touched classes: 92 passed / 0 failed; `NonWindows.slnx` builds zero-warning.
+
+### E — IPC-33, IPC-39, IPC-34, IPC-35 (opus)
+- IPC-33 option (a): `GatewayOptionsValidator` adds the upper coupling `Worker:MaxMessageBytes ≤ Protocol:MaxGrpcMessageBytes + 2×reserve`; worker `ResolveDrainReplyByteBudget` becomes `MaxMessageBytes − 2×DrainReplyFrameHeadroomBytes` (floor `MaxMessageBytes/2`); update `docs/GatewayConfiguration.md`, `docs/WorkerFrameProtocol.md`. Test: `GatewayOptionsTests` case for the new bound.
+- IPC-39: pre-check compares against `MaxMessageBytes − MaxSequenceEncodingBytes (11)`; fix the comment direction.
+- IPC-34: caller-cancellation arms call `TrySendCancelForAbandonedCommand` (renamed) gated on `removed`, skipped when `_stopCts` is the source; new `WorkerClientErrorCode.CallerCancelled` replacing the `GatewayShutdown` mislabel, mapped to `Cancelled` in the gRPC layer; update `docs/Grpc.md` mapping line, `gateway.md:913-919`, `docs/GatewayProcessDesign.md:596-602`. Test: twin of the timeout test driven by the caller token.
+- IPC-35: `ReadHandshakeEnvelopeAsync` special-cases `WorkerFault` → `WorkerClientException(WorkerFaulted, CreateWorkerFaultMessage(...))`. Test: fake writes `WorkerFault{MxaccessCreationFailed}` instead of `WorkerReady`, category text surfaces.
+- Verify: build Server; `dotnet test --filter "FullyQualifiedName~WorkerClientTests|FullyQualifiedName~GatewayOptions"`. Worker half → windev afterwards.
+
+### F — WRK-32, WRK-33 (sonnet)
+- WRK-33: `ObserveFaultWhenever(ObserveCommandTaskAsync(commandTask));` at `WorkerPipeSession.cs:1235` (or catch-all-and-log in the observer).
+- WRK-32: one `pumpStep()` before capturing the `CurrentVersion` baseline in `MxAccessCommandExecutor.cs`; rewrite the executor doc comment (`:996-1003`) to state the recency-based contract; add the same to `docs/MxAccessWorkerInstanceDesign.md` write-completion section and the reply-field comment in `mxaccess_gateway.proto` (**comment-only proto edit → regenerate all generated artifacts in the same commit**, per the repo rule; if regen tooling is unavailable on macOS, skip the proto comment and say so).
+- WRK-34 if trivial: `CreateFault(StaHung, "Watchdog", …)` with the correlation id moved into the message.
+- Cannot build on macOS: keep diff minimal, net48-safe (no init-only/positional records). Verified on windev afterwards.
+
+### G — GWC-32, GWC-34, GWC-37 (opus)
+- GWC-32: `DisposeAsync` transitions `_state` to `Closed` under `_syncRoot` before completing channels (or `if (_disposed || IsTerminalState()) return;` in `StageWorkerEvent`); update the XML doc to name all three completion paths. Test: dispose a Ready client mid-dispatch → no `ProtocolViolation` fault/metric.
+- GWC-34: `_eventDistributorDisposed` flag set under `_syncRoot` when nulling; `EnsureDistributorCreated` throws `SessionManagerException(SessionNotReady)` when set. Test: attach after dispose → throws, no silent hang.
+- GWC-37: on `ApplyProviderModeChangeAsync(toMode == Subtag)` re-resolve the watch list and re-subscribe; additionally surface "zero targets resolved while mode can need them" on the provider status (`Degraded` + reason). Update `docs/` alarm-subtag section. Test with the fake worker: GR discovery fails at start, succeeds at failover → watch list non-empty after failover.
+- Verify: build Server; `dotnet test --filter "FullyQualifiedName~WorkerClientTests|FullyQualifiedName~GatewaySession|FullyQualifiedName~AlarmMonitor|FullyQualifiedName~AlarmWatchList"`.
+- **Outcome (Done):** `058d8d5` GWC-32, `282a0e7` GWC-34, `1932217` GWC-37 on `fix/c3-session-lifecycle`. Filtered run 176/176 green; `NonWindows.slnx` clean.
+  - GWC-37 **does not re-send** the watch-list on the failover edge. The worker's `AlarmCommandHandler.Subscribe` rejects a second `SubscribeAlarms` while subscribed, and the only expressible replacement (`UnsubscribeAlarms` + `SubscribeAlarms`) rebuilds `FailoverAlarmConsumer` — restarting it on the primary that just failed and discarding the warm standby — so it would flap the feed rather than repair it. The re-resolve happens and any drift is reported on the same status frame as the failover; a monitor restart is the supported way to apply a new list. Adding a watch-list-update worker command is a possible future item, not done here.
+  - GWC-37 changes `IAlarmWatchListResolver.ResolveAsync` to return `AlarmWatchListResolution`, and gives `Degraded && Mode==ALARMMGR` a real meaning (empty/undiscoverable standby) with a new dashboard label `Alarm Manager (no subtag standby)`.
+  - GWC-32's dispose path now also records `WorkerStopped("dispose")` via the existing once-latch, closing a `workers_running` gauge leak on the dispose-a-Ready-client path. GWC-12's double-dispose interlock got a natural home (the `_disposed` claim moved under `_syncRoot`) but is **not** claimed as fixed.
+
+## Merge order
+C is merged **last** (its comment sweep touches the same files E and G edit). Order: A, B, F, D, G, E, C. After merge: full `NonWindows` build + one full gateway test run; then windev worker CI for E+F.
+
+## Integration gate (2026-08-20)
+All seven branches merged into `main` (A `ee68cc3`, B `f59c34a`, C `f2ab9cc`, D `9f0c3fd`, E `cfbc995`, F `aa07497`, G `c6650c1`). Merged tree: `NonWindows.slnx` 0 warnings; full gateway suite **1183/1183** passed; windev `windev-worker-ci.ps1 -Sha f2ab9cc -Mode test`: x86 Worker build succeeded, `Worker.Tests` **524 passed / 11 skipped / 0 failed**. Follow-ups surfaced by the batches: a worker command to refresh a live alarm subscription's watch-list (would let GWC-37's re-resolve be applied, not just reported); WRK-32's proto reply-field comment deferred until the next proto regen wave; the five clients are bumped but not yet published.
+
+## P2 continuation (planned 2026-08-25)
+
+Current-state audit: refreshed `origin/main` and re-checked every deferred finding and integration-gate follow-up. Sixteen of the seventeen P2 findings remain open; WRK-34 was already completed by `3679e59`. All three follow-ups remain open. Exact target client coordinates are still absent from Gitea (HTTP 404), and `clients/go/v0.2.1` does not exist.
+
+Approved design: [`../../../docs/plans/2026-08-25-cycle-3-p2-followups-design.md`](../../../docs/plans/2026-08-25-cycle-3-p2-followups-design.md) (`30548da`).
+
+Execution plan: [`../../../docs/plans/2026-08-25-cycle-3-p2-followups.md`](../../../docs/plans/2026-08-25-cycle-3-p2-followups.md).
+
+The continuation runs serially in the isolated `.worktrees/c3-p2-followups` worktree on `codex/c3-p2-followups`, with a tracker update at every batch boundary. Codex equivalents are selected from the implementation risk: `gpt-5.6-terra`/medium for contained documentation, CI, and client work; `gpt-5.6-sol`/high for concurrency, authorization, protocol, and live alarm lifecycle changes.
+
+| Batch | Findings / follow-ups | Codex model | Status | Exit gate |
+|---|---|---|---|---|
+| H — tracker and currency | WRK-34 record, GWC-36, IPC-38, TST-33/34/36 | `gpt-5.6-terra` medium | Done | Currency greps clean; README check in portable CI; NonWindows build clean |
+| I — gateway correctness/security | GWC-33/35, SEC-38/39 | `gpt-5.6-sol` high | Done | Focused regression tests green; NonWindows build clean |
+| J — secondary contracts | IPC-36/37 | `gpt-5.6-sol` high | Done | Shared launch constants and descriptor parity tests green |
+| K — client alarm parity | CLI-47/48/49/50 | `gpt-5.6-terra` high | Done | All five client suites green |
+| L — live watch-list/proto wave | watch-list refresh follow-up + WRK-32 proto comment | `gpt-5.6-sol` high | Done | Codegen clean; portable alarm/contract tests green; windev Worker.Tests green |
+| M — Windows gateway CI | TST-35 | `gpt-5.6-terra` medium | Done | windev `live` mode proves Worker, gateway, full-slnx, and live smoke tiers |
+| N — integration and release | publish five clients + Contracts | `gpt-5.6-sol` high | In progress | Full local/windev gates; merged `main`; registry coordinates and Go tag verified |
+
+### Continuation tasklist
+
+#### H — tracker and currency
+
+- [x] Correct WRK-34 from Deferred to Done with commit `3679e59`.
+- [x] GWC-36: correct `EventSubscriberReplayAttachment.OldestAvailableSequence` semantics.
+- [x] IPC-38: add public `DrainEvents` behavior to `docs/Grpc.md` and correct the cycle-2 omission rationale.
+- [x] TST-33: reconcile the five stale/self-contradictory `stillpending.md` claims and mark its live-status boundary.
+- [x] TST-34: run `code-reviews/regen-readme.py --check` in portable CI and qualify the interpreter note.
+- [x] TST-36: replace prose ``event`` scope references with canonical ``events:read``.
+- [x] Record batch-H commit and verification evidence here.
+
+Batch-H verification (2026-08-25): `python3 code-reviews/regen-readme.py --check`
+reported the generated README current and consistent; the TST-33 and live-document
+TST-36 stale-pattern greps returned no matches; `docs/Grpc.md` contains the public
+`DrainEvents` contract; and `dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx`
+succeeded with **0 warnings / 0 errors** in 1.59 s. Batch commit: `92aae28`.
+
+#### I — gateway correctness and security
+
+- [x] GWC-33: unregister terminal clients from the event-queue-depth gauge without shortening fault retention.
+- [x] GWC-35: repair acknowledged-to-active snapshot deltas with a Raise transition and instance identity.
+- [x] SEC-38: feed/consult the aggregate for valid key IDs that overflow the peer partition cap.
+- [x] SEC-39: prove a null effective key ID cannot reset the shared fallback partition.
+- [x] Run focused tests and clean NonWindows build; record counts and commits here.
+
+Batch-I verification (2026-08-25): the combined `WorkerClientTests`,
+`GatewayAlarmMonitorAttachOrderTests`, and `ApiKeyFailureLimiterTests` filter passed
+**55/55** tests in 12 s; `dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx`
+succeeded with **0 warnings / 0 errors** in 3.42 s. Finding commits: GWC-33
+`b0156c6`, GWC-35 `7807201`, and SEC-38/SEC-39 `1875426`.
+
+#### J — secondary contracts
+
+- [x] IPC-36: centralize all six worker-launch environment names in Contracts and consume them on both sides.
+- [x] IPC-36: document variable/config/default mapping and test launcher completeness.
+- [x] IPC-37: add normalized retained-vs-served Galaxy descriptor parity test.
+- [x] Run focused tests and clean NonWindows build; record counts and commits here.
+
+Batch-J verification (2026-08-25): the combined `WorkerProcessLauncherTests` and
+`GalaxyContractParityTests` filter passed **10/10** tests in 1 s; the descriptor
+mutation proof identified the changed protobuf message; and `dotnet build
+src/ZB.MOM.WW.MxGateway.NonWindows.slnx` succeeded with **0 warnings / 0
+errors** in 2.20 s. IPC-36/IPC-37 commit: `d6c5a11`.
+
+#### K — client alarm-feed parity
+
+- [x] CLI-47: make .NET text status flags explicit and document deliberate JSON differences.
+- [x] CLI-48: test provider/snapshot status arms in .NET, Go, and Java; add Go stream-alarm scaffold.
+- [x] CLI-49: export Go aliases for `AlarmProviderStatus` and `AlarmSnapshotStatus`; fix five-arm documentation.
+- [x] CLI-50: stream Python alarm rows incrementally with an unbounded default and bounded opt-in.
+- [x] Run .NET, Go, Python, Rust, and Java client suites; record counts and commits here.
+
+Batch-K verification (2026-08-25): `dotnet test
+clients/dotnet/ZB.MOM.WW.MxGateway.Client.slnx` passed **134/134** portable
+tests (1 live test skipped); `go test ./...` passed both tested packages;
+`python -m pytest` passed **169/169** portable tests (1 opt-in TLS test
+skipped); `cargo test --workspace` passed **108/108** tests; and
+`JAVA_HOME=/opt/homebrew/opt/openjdk@17 gradle test` passed **132/132** tests.
+CLI-47/CLI-48/CLI-49/CLI-50 commit: `5cdb3da`.
+
+#### L — live watch-list refresh and protobuf wave
+
+- [x] Add explicit fallback-enabled subscription semantics for an initially empty discovered list.
+- [x] Add and round-trip `UpdateAlarmWatchListCommand` and its `MxCommandKind`.
+- [x] Route the command through the worker executor and alarm handler on the STA.
+- [x] Build/subscribe/attach a replacement standby before swap; preserve the old standby on failure.
+- [x] Preserve current primary/subtag mode during a successful replacement.
+- [x] Re-resolve on the existing gateway reconciliation cadence and send only material changes/recovery.
+- [x] Refresh immediately at failover edge, update acknowledged fingerprint only after worker OK, and reconcile after success.
+- [x] Expand WRK-32's public reply-field comment to the sequential stale-callback/recency case.
+- [x] Replace IPC-36's internal env-var name in the proto comment with the public configuration key.
+- [x] Regenerate Contracts and all client generated trees once; run codegen and all affected suites.
+- [x] Verify x86 Worker build and Worker.Tests on windev; record SHA/counts here.
+
+Batch-L verification (2026-08-25): `pwsh scripts/check-codegen.ps1` passed all
+four descriptor/C#/Rust/Go/Python freshness checks, and Java
+`checkGeneratedClean` passed. The exact portable alarm/contract/descriptor
+filter passed **77/77**; `NonWindows.slnx` built with **0 warnings / 0 errors**;
+the .NET, Go, Python, Rust, and Java client suites were green (respectively
+**134 passed / 1 live skip**, both Go packages, **169 passed / 1 opt-in TLS
+skip**, **108 passed**, and **132 passed**). Windev `test` mode at
+`986c6c0ce4f02c62b4f59ec44780de5af6d291b8` built the x86/net48 Worker with
+**0 warnings / 0 errors** and passed Worker.Tests **529 passed / 11 opt-in
+skips / 0 failed**. Feature/proto commit: `484028e`; Batch-J x86 compile
+follow-up: `986c6c0`.
+
+#### M — Windows gateway CI
+
+- [x] TST-35: add the serialized net10 gateway suite to windev `live` mode.
+- [x] Update `docs/GatewayTesting.md` and `scripts/ci/README.md` with order/failure semantics.
+- [x] Execute `live` mode on windev and record Worker, gateway, full-slnx, and live-smoke evidence here.
+
+Batch-M verification (2026-08-25): windev `live` mode at exact commit
+`cc143b52cf04be0b2f08350922a987b2e250bc1d` completed the serialized sequence in
+**4m45s** with remote exit code 0. The x86/net48 Worker build succeeded with **0
+warnings / 0 errors** in 22.59 s; Worker.Tests passed **529**, skipped **11**
+opt-in probes, and failed **0**; the full Windows `slnx` build succeeded with **0
+warnings / 0 errors** in 43.24 s; the net10 gateway suite passed **1193/1193**
+in 53 s; and the live-MXAccess smoke passed **8/8** in 1m46s. TST-35 commit:
+`cc143b5`.
+
+#### N — integration and release
+
+- [x] Run `git diff --check`, codegen, client-version, README, NonWindows build, and full gateway suite gates.
+- [x] Run all five client suites on the final candidate.
+- [ ] Run final windev `live` gate at the exact candidate SHA.
+- [ ] Merge/push the verified continuation to `main`; wait for green CI.
+- [ ] Re-query all package coordinates and Go tag immediately before publish; abort on collision.
+- [ ] Publish .NET Client + Contracts 0.2.1, Python 0.2.1, Rust 0.2.1, Java 0.2.2.
+- [ ] Create/push `clients/go/v0.2.1` at the exact release commit.
+- [ ] Verify every registry coordinate and Go module/tag, update `docs/ClientPackaging.md`, and record immutable release evidence here.
+
+Batch-N portable verification (2026-08-25): `git diff --check`, codegen freshness,
+client-version freshness, and the generated README check all passed without changing
+the worktree. `NonWindows.slnx` built with **0 warnings / 0 errors**; the gateway
+suite passed **1193/1193**, and the portable integration suite passed **5** with
+**19** live-only skips. The final .NET, Go, Python, Rust, and Java client gates were
+green (respectively **134 passed / 1 live skip**, all Go packages built/tested with
+clean `gofmt`, **169 passed / 1 opt-in TLS skip** from a clean virtual environment,
+**108 passed** plus clean `cargo fmt`/Clippy, and **132 passed / 0 failed** with the
+generated Java tree unchanged).

archreview/remediation/00-tracking.md

@@ -74,7 +74,7 @@ Full design + implementation for each row lives in the linked domain doc under i
 | GWC-13 | Low | — | M | — | Not started | Worker-ready wait is a 25 ms poll loop |
 | GWC-14 | Low | P2 | M | — | Done | Replay ring is a `LinkedList` with a node alloc per event |
 | GWC-15 | Low | P2 | S | — | Done | Per-event gauge reads `ChannelReader.Count` every event |
-| GWC-16 | Low | — | S | — | Not started | `Invoke` resolves the session twice per command |
+| GWC-16 | Low | — | S | — | Won't fix | `Invoke` resolves the session twice per command — measured negligible, deliberately not collapsed (see domain doc) |
 | GWC-17 | Low | — | M | — | Not started | Sessions layer throws `Grpc.Core.RpcException` (layering leak) |
 | GWC-18 | Low | — | S | — | Not started | `GatewaySession` implements `DisposeAsync` without `IAsyncDisposable` |
 | GWC-19 | Low | — | S | — | Not started | Dead `GatewaySession.KillWorker(string)` + stale doc |
@@ -119,7 +119,7 @@ Full design + implementation for each row lives in the linked domain doc under i
 | IPC-05 | Medium | P2 | S | — | Done | Redundant deep copies on command and event hot paths |
 | IPC-06 | Medium | P2 | S | — | Done | `gateway.md` Worker Envelope sketch no longer matches the contract |
 | IPC-07 | Medium | P2 | S | — | Done | `docs/Grpc.md` says six RPCs; there are seven |
-| IPC-08 | Medium | — | M | — | Not started | `WorkerCancel` defined and handled but never sent |
+| IPC-08 | Medium | — | M | — | Done | `WorkerCancel` defined and handled but never sent — resolved by `7c1ea12`/`a1a38b5`; residual (caller-cancellation leg) tracked as cycle-3 IPC-34 |
 | IPC-09 | Medium | P1 | M | IPC-01 | Done | Known codegen fragilities have no in-repo guards |
 | IPC-10 | Low | — | S | — | Not started | Envelope `sequence` is write-only; monotonicity never validated |
 | IPC-11 | Low | — | S | — | Not started | No protocol version negotiation despite `supported_protocol_version` name |
@@ -218,7 +218,7 @@ Full design + implementation for each row lives in the linked domain doc under i
 | TST-03 | High | P1 | M | — | Done | No CI exists |
 | TST-04 | High | P2 | L | — | Done | Session-resilience epic 16/28 tasks unfinished |
 | TST-05 | Medium | P1 | S | TST-03 | Partially done | Real-worker control/COM paths verified opt-in only. **Scheduling half closed 2026-08-10** by the TST-25 `nightly-windev` job (`.gitea/workflows/ci.yml`, cron `0 6 * * *` → `scripts/ci/run-windev-ci.sh live`, which sets `MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`, runs `WorkerLiveMxAccessSmokeTests`, and opens a Gitea issue on failure) — "opt-in, run by memory" is now "runs nightly, reports failures". **Residual: the coverage-audit half.** The live suite's 8 facts cover all six late-added COM commands but none of the five control commands (`Ping`, `GetSessionState`, `GetWorkerInfo`, `DrainEvents`, `ShutdownWorker`), which real workers answer in `Worker/Ipc/WorkerPipeSession.cs` yet are still only exercised through `FakeWorkerHarness` canned replies — precisely the masking the finding named |
-| TST-06 | Medium | — | M | — | Not started | Dashboard live-data path untested |
+| TST-06 | Medium | — | M | — | Materially narrowed | Dashboard live-data path untested — `DashboardLiveDataServiceTests`, `EventsHubTests`, `EventsHubViewerRegistryTests`, `AlarmsHubPublisherTests`, `SessionDetailsPageEventAclTests` now exist (landed with SEC-25/TST-16); needs a re-audit-and-close pass, not re-implementation |
 | TST-07 | Medium | — | S | — | Not started | Real-clock sleeps with negative assertions are latent flakes |
 | TST-08 | Medium | P1 | M | — | Done | Full-suite orphaned testhost processes (does not reproduce; doc de-stale) |
 | TST-09 | Medium | — | M | — | Not started | Health checks cover only the auth store |
@@ -229,7 +229,7 @@ Full design + implementation for each row lives in the linked domain doc under i
 | TST-14 | Medium | P2 | S | — | Not started | Repo-root working artifacts need triage |
 | TST-15 | Medium | P2 | M | TST-04 | Done | Dashboard EventsHub has no per-session ACL |
 | TST-16 | Medium | P1 | S | — | Done | `Dashboard:ShowTagValues` is a dead flag |
-| TST-17 | Medium | — | S | — | Not started | Vendor-gated alarm parity residuals silently lossy |
+| TST-17 | Medium | — | S | — | Materially changed | Vendor-gated alarm parity residuals silently lossy — `WnWrapAlarmConsumer.cs:309-327` now passes `szDomainName`/`szOprFullName`; the vendor 8-arg leg is recorded "unavailable by configuration" with evidence (`docs/AlarmProbeFindings.md`, `d1ae43d`, `540a118`); "silent drop, unchanged" is no longer accurate — needs a worker-domain refresh pass |
 | TST-18 | Low | — | S | — | Not started | Hosted-service wrappers untested |
 | TST-19 | Low | — | S | — | Not started | Keep FakeWorkerHarness canned replies in lockstep |
 | TST-20 | Low | — | S | — | Not started | E2E script papers over a real advise-without-consumer sharp edge |

archreview/remediation/10-gateway-core.md

@@ -330,6 +330,8 @@ Open question the review cannot settle: whether a future probe (COM-init readine
 
 **Verification.** `dotnet build src/ZB.MOM.WW.MxGateway.Server`; `dotnet test src/ZB.MOM.WW.MxGateway.Tests --filter "FullyQualifiedName~SessionManager"`.
 
+**Resolution: Won't fix (2026-08-20, closed by cycle-3 verification).** `Grpc/MxAccessGatewayService.cs:111-115` carries a `PERF(followup)` comment documenting the double session lookup as measured-negligible and deliberately not collapsed — the fix would duplicate `InvokeAsync`'s fault mapping at a second entry point, trading a negligible per-command cost for a maintenance liability. Per the cycle-3 gateway-core review (`archreview/2026-08-19/10-gateway-core.md`, GWC-16 row), the rationale is sound; tracker flipped from `Not started` to `Won't fix`.
+
 ---
 
 ## GWC-17 — Sessions layer throws `Grpc.Core.RpcException`   `Low` · `—`

archreview/remediation/30-contracts-ipc.md

@@ -175,6 +175,8 @@ The frame protocol and proto evolution hygiene are sound; the remediable risk cl
 
 **Verification.** `dotnet build src/ZB.MOM.WW.MxGateway.Server` + `dotnet test ...Tests --filter FullyQualifiedName~WorkerClient`; worker side `-p:Platform=x86`.
 
+**Resolution: Done (2026-08-20, closed by cycle-3 verification, residual filed).** Wired up substantially as designed: `InvokeAsync` forwards a `WorkerCancel` when the gateway's own command timeout fires and it owned the removal (`Server/Workers/WorkerClient.cs:269-291`), `TrySendCancelForTimedOutCommand` is structurally no-throw (`:835-870`), the worker routes it to `CancelCommand` (`Worker/Ipc/WorkerPipeSession.cs:755-756` → `MxAccess/MxAccessStaSession.cs:529-532` → `Sta/StaCommandDispatcher.CancelQueuedCommand:151`), regression test `WorkerClientTests.InvokeAsync_WhenCommandTimesOut_SendsWorkerCancelForThatCorrelation` exists, and `docs/GatewayProcessDesign.md:596-602` documents it. Landed in `7c1ea12`/`a1a38b5`. **Residual, not covered by this closure:** the caller-cancellation leg (context deadline / client disconnect, as opposed to the gateway's own `CommandTimeout`) sends nothing — filed as cycle-3 **IPC-34**. Per `archreview/2026-08-19/30-contracts-ipc.md` (IPC-08 row), tracker flipped from `Not started` to `Done` with the residual cross-referenced.
+
 ---
 
 ## IPC-09 — Known codegen fragilities have no in-repo guards   `Medium` · `P1`

archreview/remediation/60-testing-docs-gaps.md

@@ -191,6 +191,8 @@ This finding is the umbrella; TST-01/02/15 are its actionable slices. The remedi
 
 **Verification.** `dotnet test ... --filter FullyQualifiedName~DashboardLiveDataServiceTests`.
 
+**Status refresh (2026-08-20, per cycle-3 verification).** Materially narrowed — the tracker row was stale. `Tests/Gateway/Dashboard/DashboardLiveDataServiceTests.cs`, `EventsHubTests.cs`, `EventsHubViewerRegistryTests.cs`, `AlarmsHubPublisherTests.cs`, and `SessionDetailsPageEventAclTests.cs` all exist now (mostly landed with the SEC-25/TST-16 closeouts and the in-process dashboard-feed work). Per `archreview/2026-08-19/60-testing-docs-gaps.md` (TST-06 row), this needs a re-audit-and-close pass against the current coverage rather than fresh implementation — left open pending that audit, tracker status changed from `Not started` to `Materially narrowed` to reflect the actual state.
+
 ---
 
 ## TST-07 — Real-clock sleeps with negative assertions are latent flakes   `Medium` · `—`
@@ -371,6 +373,8 @@ If TST-02's interim mitigation (flip retention off) is chosen instead of impleme
 
 **Verification.** `dotnet build src/ZB.MOM.WW.MxGateway.Worker -p:Platform=x86`; `dotnet test src/ZB.MOM.WW.MxGateway.Worker.Tests/... -p:Platform=x86` (Windows).
 
+**Status refresh (2026-08-20, per cycle-3 verification).** Materially changed — the tracker row needs a refresh from the worker domain. `WnWrapAlarmConsumer.cs:309-327` now passes `szDomainName`/`szOprFullName` into the COM call (the `_ = ackOperatorDomain` discard is gone), and the 2026-08 probe cycle recorded the vendor 8-arg leg as "unavailable by configuration" with evidence (`docs/AlarmProbeFindings.md`, commits `d1ae43d`, `540a118`). Per `archreview/2026-08-19/60-testing-docs-gaps.md` (TST-17 row), "silent drop, unchanged" is no longer an accurate description of the row; whether a caller-visible degrade signal now exists is the worker reviewer's call to close out. Tracker status changed from `Not started` to `Materially changed`.
+
 ---
 
 ## TST-18 — Hosted-service wrappers untested   `Low` · `—`

clients/dotnet/README.md

@@ -166,6 +166,11 @@ when the gateway's alarm monitor restarts and drops a truncated verdict. Track
 it if you need set completeness on a live feed without polling
 `QueryActiveAlarmsAsync`.
 
+The CLI's text rows always spell out `degraded=false` and `truncated=false` so
+healthy and clearing frames remain visible. Its protobuf-JSON modes retain the
+standard proto3 omission rule, so those same false-valued payloads appear as
+`{"providerStatus": {}}` and `{"snapshotStatus": {}}`; absent means false.
+
 `MxGatewaySession.CloseAsync` is explicit and idempotent. Repeated calls return
 the first `CloseSessionReply` instead of sending another close request.
 
@@ -285,7 +290,7 @@ dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- advise --s
 dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- write --session-id <id> --server-handle 1 --item-handle 1 --type int32 --value 123 --json
 dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- write2 --session-id <id> --server-handle 1 --item-handle 1 --type int32 --value 123 --timestamp 2026-01-01T00:00:00Z --json
 dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- stream-events --session-id <id> --max-events 1 --json
-dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- stream-alarms --filter-prefix Area001 --max-events 1 --json
+dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- stream-alarms --filter-prefix Area001 --max-events 4 --json
 dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- acknowledge-alarm --reference "\\Galaxy\Area001.Pump001.PumpFault" --comment "ack from cli" --operator operator1 --json
 dotnet run --project clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli -- smoke --endpoint http://localhost:5000 --api-key-env MXGATEWAY_API_KEY --item Area001.Pump001.Speed --json
 ```

clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs

@@ -1561,9 +1561,9 @@ public static class MxGatewayClientCli
             AlarmFeedMessage.PayloadOneofCase.Transition =>
                 $"transition {ProtobufJsonFormatter.Format(feedMessage.Transition)}",
             AlarmFeedMessage.PayloadOneofCase.ProviderStatus =>
-                $"provider-status {ProtobufJsonFormatter.Format(feedMessage.ProviderStatus)}",
+                $"provider-status mode={feedMessage.ProviderStatus.Mode} degraded={feedMessage.ProviderStatus.Degraded.ToString().ToLowerInvariant()} reason=\"{feedMessage.ProviderStatus.Reason}\"",
             AlarmFeedMessage.PayloadOneofCase.SnapshotStatus =>
-                $"snapshot-status {ProtobufJsonFormatter.Format(feedMessage.SnapshotStatus)}",
+                $"snapshot-status truncated={feedMessage.SnapshotStatus.Truncated.ToString().ToLowerInvariant()}",
             _ => $"unknown-payload {feedMessage.PayloadCase}",
         };
     }

clients/dotnet/ZB.MOM.WW.MxGateway.Client.Tests/MxGatewayClientCliTests.cs

@@ -705,6 +705,50 @@ public sealed class MxGatewayClientCliTests
         Assert.Equal(string.Empty, error.ToString());
     }
 
+    /// <summary>Verifies that false alarm-feed status flags remain explicit in text while protobuf JSON omits defaults.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task RunAsync_StreamAlarms_StatusFramesDistinguishTextFromProtobufJson()
+    {
+        FakeCliClient fakeClient = new();
+        fakeClient.AlarmFeedMessages.Add(new AlarmFeedMessage
+        {
+            ProviderStatus = new AlarmProviderStatus { Degraded = false },
+        });
+        fakeClient.AlarmFeedMessages.Add(new AlarmFeedMessage
+        {
+            SnapshotStatus = new AlarmSnapshotStatus { Truncated = false },
+        });
+
+        using var textOutput = new StringWriter();
+        using var textError = new StringWriter();
+        int textExit = await MxGatewayClientCli.RunAsync(
+            ["stream-alarms", "--endpoint", "http://localhost:5000", "--api-key", "test-api-key", "--max-events", "2"],
+            textOutput,
+            textError,
+            _ => fakeClient);
+
+        Assert.Equal(0, textExit);
+        Assert.Equal(
+            ["provider-status mode=Unspecified degraded=false reason=\"\"", "snapshot-status truncated=false"],
+            textOutput.ToString().Split(Environment.NewLine, StringSplitOptions.RemoveEmptyEntries));
+        Assert.Equal(string.Empty, textError.ToString());
+
+        using var jsonOutput = new StringWriter();
+        using var jsonError = new StringWriter();
+        int jsonExit = await MxGatewayClientCli.RunAsync(
+            ["stream-alarms", "--endpoint", "http://localhost:5000", "--api-key", "test-api-key", "--max-events", "2", "--jsonl"],
+            jsonOutput,
+            jsonError,
+            _ => fakeClient);
+
+        Assert.Equal(0, jsonExit);
+        Assert.Equal(
+            ["{ \"providerStatus\": { } }", "{ \"snapshotStatus\": { } }"],
+            jsonOutput.ToString().Split(Environment.NewLine, StringSplitOptions.RemoveEmptyEntries));
+        Assert.Equal(string.Empty, jsonError.ToString());
+    }
+
     /// <summary>Verifies that acknowledge-alarm builds a request and prints the JSON reply.</summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]

clients/dotnet/ZB.MOM.WW.MxGateway.Client/ZB.MOM.WW.MxGateway.Client.csproj

@@ -19,7 +19,7 @@
   <PropertyGroup>
     <IsPackable>true</IsPackable>
     <PackageId>ZB.MOM.WW.MxGateway.Client</PackageId>
-    <Version>0.2.0</Version>
+    <Version>0.2.1</Version>
     <Description>.NET 10 gRPC client for the MxAccessGateway service. Provides typed wrappers, retry, and a lazy-browse walker over the Galaxy Repository hierarchy.</Description>
     <PackageReadmeFile>README.md</PackageReadmeFile>
     <!-- Only the shipped library generates XML docs (matching src/Contracts). The Cli and

clients/go/README.md

@@ -162,6 +162,11 @@ on every verdict change — including the clearing frame sent when the gateway's
 alarm monitor restarts and drops a truncated verdict. Track it if you need set
 completeness on a live feed without polling `QueryActiveAlarms`.
 
+The CLI's text rows always spell out `degraded=false` and `truncated=false`.
+Its protobuf-JSON mode retains the standard proto3 omission rule, so those
+false-valued payloads appear as `{"providerStatus":{}}` and
+`{"snapshotStatus":{}}`; absent means false.
+
 ## Write Semantics And Common Pitfalls
 
 These are MXAccess parity behaviors that surprise new callers. The gateway
@@ -439,7 +444,7 @@ go run ./cmd/mxgw-go write -session-id <id> -server-handle 1 -item-handle 1 -typ
 go run ./cmd/mxgw-go write-bulk -session-id <id> -server-handle 1 -item-handles 1,2 -values 10,20 -type int32 -plaintext -json
 go run ./cmd/mxgw-go read-bulk -session-id <id> -item-handles 1,2 -plaintext -json
 go run ./cmd/mxgw-go stream-events -session-id <id> -plaintext -json
-go run ./cmd/mxgw-go stream-alarms -plaintext -json
+go run ./cmd/mxgw-go stream-alarms -plaintext -limit 4 -json
 go run ./cmd/mxgw-go smoke -item Area001.Tag.Value -plaintext -json
 go run ./cmd/mxgw-go galaxy-test-connection -plaintext -json
 go run ./cmd/mxgw-go galaxy-last-deploy -plaintext -json

clients/go/cmd/mxgw-go/main_test.go

@@ -283,6 +283,68 @@ type pingFakeGateway struct {
 	pb.UnimplementedMxAccessGatewayServer
 }
 
+// alarmStatusFakeGateway emits both status arms with their proto3 boolean
+// defaults so the CLI contract covers values that protobuf JSON omits.
+type alarmStatusFakeGateway struct {
+	pb.UnimplementedMxAccessGatewayServer
+}
+
+func (g *alarmStatusFakeGateway) StreamAlarms(
+	_ *pb.StreamAlarmsRequest,
+	stream grpc.ServerStreamingServer[pb.AlarmFeedMessage],
+) error {
+	if err := stream.Send(&pb.AlarmFeedMessage{
+		Payload: &pb.AlarmFeedMessage_ProviderStatus{
+			ProviderStatus: &pb.AlarmProviderStatus{Degraded: false},
+		},
+	}); err != nil {
+		return err
+	}
+	return stream.Send(&pb.AlarmFeedMessage{
+		Payload: &pb.AlarmFeedMessage_SnapshotStatus{
+			SnapshotStatus: &pb.AlarmSnapshotStatus{Truncated: false},
+		},
+	})
+}
+
+func startAlarmStatusGateway(t *testing.T) string {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	server := grpc.NewServer()
+	pb.RegisterMxAccessGatewayServer(server, &alarmStatusFakeGateway{})
+	go func() { _ = server.Serve(listener) }()
+	t.Cleanup(func() {
+		server.Stop()
+		_ = listener.Close()
+	})
+	return listener.Addr().String()
+}
+
+func TestRunStreamAlarmsPrintsStatusArmsInTextAndProtobufJSON(t *testing.T) {
+	endpoint := startAlarmStatusGateway(t)
+	baseArgs := []string{"stream-alarms", "-endpoint", endpoint, "-plaintext", "-api-key", "test", "-limit", "2"}
+
+	var textOut, textErr bytes.Buffer
+	if err := runWithIO(t.Context(), baseArgs, &textOut, &textErr); err != nil {
+		t.Fatalf("text stream-alarms error = %v; stderr = %s", err, textErr.String())
+	}
+	if got, want := strings.TrimSpace(textOut.String()), "provider-status mode=ALARM_PROVIDER_MODE_UNSPECIFIED degraded=false reason=\"\"\nsnapshot-status truncated=false"; got != want {
+		t.Fatalf("text stream-alarms output = %q, want %q", got, want)
+	}
+
+	var jsonOut, jsonErr bytes.Buffer
+	jsonArgs := append(append([]string{}, baseArgs...), "-json")
+	if err := runWithIO(t.Context(), jsonArgs, &jsonOut, &jsonErr); err != nil {
+		t.Fatalf("JSON stream-alarms error = %v; stderr = %s", err, jsonErr.String())
+	}
+	if got, want := strings.TrimSpace(jsonOut.String()), "{\"providerStatus\":{}}\n{\"snapshotStatus\":{}}"; got != want {
+		t.Fatalf("JSON stream-alarms output = %q, want protobuf JSON %q", got, want)
+	}
+}
+
 func (g *pingFakeGateway) Invoke(_ context.Context, req *pb.MxCommandRequest) (*pb.MxCommandReply, error) {
 	echo := "pong:" + req.GetCommand().GetPing().GetMessage()
 	return &pb.MxCommandReply{

clients/go/mxgateway/types.go

@@ -127,9 +127,14 @@ type (
 	QueryActiveAlarmsRequest = pb.QueryActiveAlarmsRequest
 	// StreamAlarmsRequest is the gateway StreamAlarms request message.
 	StreamAlarmsRequest = pb.StreamAlarmsRequest
-	// AlarmFeedMessage is one message on the StreamAlarms feed — an
-	// active-alarm snapshot row, a snapshot-complete sentinel, or a transition.
+	// AlarmFeedMessage is one message on the StreamAlarms feed — an active-alarm
+	// snapshot row, snapshot-complete sentinel, transition, provider status, or
+	// snapshot-completeness status.
 	AlarmFeedMessage = pb.AlarmFeedMessage
+	// AlarmProviderStatus reports the alarm provider mode and degradation state.
+	AlarmProviderStatus = pb.AlarmProviderStatus
+	// AlarmSnapshotStatus reports whether the cached alarm snapshot is truncated.
+	AlarmSnapshotStatus = pb.AlarmSnapshotStatus
 	// ActiveAlarmSnapshot is one row in a ConditionRefresh stream.
 	ActiveAlarmSnapshot = pb.ActiveAlarmSnapshot
 	// OnAlarmTransitionEvent is the body carried by alarm-transition MxEvents.

clients/go/mxgateway/types_alias_test.go

@@ -0,0 +1,17 @@
+package mxgateway_test
+
+import (
+	"testing"
+
+	"gitea.dohertylan.com/dohertj2/mxaccessgw/clients/go/mxgateway"
+)
+
+// TestAlarmFeedStatusAliasesArePublic is a compile-time consumer contract for
+// the two status payloads carried by AlarmFeedMessage.
+func TestAlarmFeedStatusAliasesArePublic(t *testing.T) {
+	t.Helper()
+	var provider mxgateway.AlarmProviderStatus
+	var snapshot mxgateway.AlarmSnapshotStatus
+	_ = provider
+	_ = snapshot
+}

clients/go/mxgateway/version.go

@@ -3,7 +3,7 @@ package mxgateway
 const (
 	// ClientVersion is the released semantic version of this Go client module.
 	// Keep it in sync with the module tag applied by scripts/tag-go-module.ps1.
-	ClientVersion = "0.2.0"
+	ClientVersion = "0.2.1"
 
 	// GatewayProtocolVersion matches GatewayContractInfo.GatewayProtocolVersion
 	// in the shared .NET contracts.

clients/java/README.md

@@ -135,6 +135,11 @@ the clearing frame sent when the gateway's alarm monitor restarts and drops a
 truncated verdict. Track it if you need set completeness on a live feed without
 polling `queryActiveAlarms`.
 
+The CLI's text rows always spell out `degraded=false` and `truncated=false`.
+Its protobuf-JSON mode retains the standard proto3 omission rule, so those
+false-valued payloads appear as `{"providerStatus":{}}` and
+`{"snapshotStatus":{}}`; absent means false.
+
 ## Write Semantics And Common Pitfalls
 
 These are MXAccess parity behaviors that surprise new callers. The gateway
@@ -411,7 +416,7 @@ gradle :zb-mom-ww-mxgateway-cli:run --args="advise-supervisory --endpoint localh
 gradle :zb-mom-ww-mxgateway-cli:run --args="authenticate-user --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --session-id <id> --server-handle 1 --verify-user operator --password-env MXGATEWAY_VERIFY_PASSWORD --json"
 gradle :zb-mom-ww-mxgateway-cli:run --args="write-secured --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --session-id <id> --server-handle 1 --item-handle 1 --type int32 --value 123 --current-user-id 100 --verifier-user-id 100 --json"
 gradle :zb-mom-ww-mxgateway-cli:run --args="stream-events --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --session-id <id> --limit 1 --json"
-gradle :zb-mom-ww-mxgateway-cli:run --args="stream-alarms --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --filter-prefix Galaxy --limit 1 --json"
+gradle :zb-mom-ww-mxgateway-cli:run --args="stream-alarms --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --filter-prefix Galaxy --limit 4 --json"
 gradle :zb-mom-ww-mxgateway-cli:run --args="acknowledge-alarm --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --reference \"\\Galaxy\Area001.Pump001.PumpFault\" --json"
 gradle :zb-mom-ww-mxgateway-cli:run --args="smoke --endpoint localhost:5000 --api-key-env MXGATEWAY_API_KEY --plaintext --item TestObject.TestInt --json"
 ```
@@ -483,7 +488,7 @@ repositories {
 }
 
 dependencies {
-    implementation 'com.zb.mom.ww.mxgateway:zb-mom-ww-mxgateway-client:0.2.1'
+    implementation 'com.zb.mom.ww.mxgateway:zb-mom-ww-mxgateway-client:0.2.2'
 }
 ````
 

clients/java/build.gradle

@@ -16,11 +16,14 @@ subprojects {
     // 0.2.0 was already published to the Gitea Maven feed on 2026-06-26,
     // before the CLI-37/38/40/41 conformance fixes changed the client's
     // observable behavior (status.category-based validation, hresult < 0,
-    // exact-secret redaction, typed malformed-reply errors). Bump to 0.2.1
-    // so the published coordinate matches the conformant behavior the other
-    // four clients ship at 0.2.0 for the first time. See CLI-39 and the
+    // exact-secret redaction, typed malformed-reply errors). Bumped to 0.2.1
+    // so the published coordinate matched the conformant behavior the other
+    // four clients shipped at 0.2.0 for the first time. See CLI-39 and the
     // "Versioning" section of docs/ClientPackaging.md.
-    version = '0.2.1'
+    // 0.2.1 was itself published (Maven, 2026-08-07); this is the next
+    // release-train bump (CLI-46), one ahead of the other four clients'
+    // 0.2.1 because the Java coordinate has always trailed by one number.
+    version = '0.2.2'
 
     pluginManager.withPlugin('java') {
         java {

clients/java/zb-mom-ww-mxgateway-cli/src/test/java/com/zb/mom/ww/mxgateway/cli/MxGatewayCliTests.java

@@ -27,6 +27,8 @@ import mxaccess_gateway.v1.MxaccessGateway.ActiveAlarmSnapshot;
 import mxaccess_gateway.v1.MxaccessGateway.AddItemReply;
 import mxaccess_gateway.v1.MxaccessGateway.AlarmConditionState;
 import mxaccess_gateway.v1.MxaccessGateway.AlarmFeedMessage;
+import mxaccess_gateway.v1.MxaccessGateway.AlarmProviderStatus;
+import mxaccess_gateway.v1.MxaccessGateway.AlarmSnapshotStatus;
 import mxaccess_gateway.v1.MxaccessGateway.AlarmTransitionKind;
 import mxaccess_gateway.v1.MxaccessGateway.BulkReadResult;
 import mxaccess_gateway.v1.MxaccessGateway.BulkWriteResult;
@@ -60,7 +62,7 @@ final class MxGatewayCliTests {
 
         assertEquals(0, run.exitCode());
         assertEquals("", run.errors());
-        assertTrue(run.output().contains("mxgateway-java 0.2.1"));
+        assertTrue(run.output().contains("mxgateway-java 0.2.2"));
         assertTrue(run.output().contains("gatewayProtocolVersion=3"));
         assertTrue(run.output().contains("workerProtocolVersion=1"));
     }
@@ -90,7 +92,7 @@ final class MxGatewayCliTests {
         CliRun run = execute(new FakeClientFactory(), "version", "--json");
 
         assertEquals(0, run.exitCode());
-        assertTrue(run.output().contains("\"clientVersion\":\"0.2.1\""));
+        assertTrue(run.output().contains("\"clientVersion\":\"0.2.2\""));
         assertTrue(run.output().contains("\"gatewayProtocolVersion\":3"));
     }
 
@@ -685,6 +687,21 @@ final class MxGatewayCliTests {
         assertTrue(run.output().contains("\"snapshotComplete\""), run.output());
     }
 
+    @Test
+    void streamAlarmsCommandPrintsStatusArmsInTextAndProtobufJson() {
+        FakeClientFactory factory = new FakeClientFactory();
+
+        CliRun text = execute(factory, "stream-alarms");
+        List<String> textRows = text.output().lines().filter(line -> !line.isBlank()).toList();
+        assertEquals("provider-status mode=ALARM_PROVIDER_MODE_UNSPECIFIED degraded=false reason=", textRows.get(3));
+        assertEquals("snapshot-status truncated=false", textRows.get(4));
+
+        CliRun json = execute(factory, "stream-alarms", "--json");
+        List<String> jsonRows = json.output().lines().filter(line -> !line.isBlank()).toList();
+        assertEquals("{\"providerStatus\":{}}", jsonRows.get(3));
+        assertEquals("{\"snapshotStatus\":{}}", jsonRows.get(4));
+    }
+
     @Test
     void acknowledgeAlarmCommandForwardsOptionsAndPrintsReply() {
         FakeClientFactory factory = new FakeClientFactory();
@@ -1409,6 +1426,12 @@ final class MxGatewayCliTests {
                             .setTransitionKind(AlarmTransitionKind.ALARM_TRANSITION_KIND_ACKNOWLEDGE)
                             .setSeverity(700))
                     .build());
+            observer.onNext(AlarmFeedMessage.newBuilder()
+                    .setProviderStatus(AlarmProviderStatus.newBuilder().setDegraded(false))
+                    .build());
+            observer.onNext(AlarmFeedMessage.newBuilder()
+                    .setSnapshotStatus(AlarmSnapshotStatus.newBuilder().setTruncated(false))
+                    .build());
             observer.onCompleted();
             return new MxGatewayAlarmFeedSubscription();
         }

clients/java/zb-mom-ww-mxgateway-client/src/main/java/com/zb/mom/ww/mxgateway/client/MxGatewayClientVersion.java

@@ -9,7 +9,7 @@ package com.zb.mom.ww.mxgateway.client;
 public final class MxGatewayClientVersion {
     private static final int GATEWAY_PROTOCOL_VERSION = 3;
     private static final int WORKER_PROTOCOL_VERSION = 1;
-    private static final String CLIENT_VERSION = "0.2.1";
+    private static final String CLIENT_VERSION = "0.2.2";
 
     private MxGatewayClientVersion() {
     }

clients/python/README.md

@@ -132,6 +132,14 @@ sent when the gateway's alarm monitor restarts and drops a truncated verdict.
 Track it if you need set completeness on a live feed without polling
 `query_active_alarms`.
 
+`mxgw-py stream-alarms` writes one JSON row as each feed message arrives. The
+default `--max-messages 0` is unbounded; use a positive value for a finite
+sample, remembering that the provider-status and snapshot-status preamble both
+count toward it. `--timeout` ends the command after an idle wait and the stream
+is closed in every exit path. Protobuf JSON omits false-valued scalar defaults,
+so healthy/clearing frames appear as `{"providerStatus": {}}` and
+`{"snapshotStatus": {}}`; absent means false.
+
 Canceling a Python task cancels the client-side gRPC call or stream wait. It
 does not abort an in-flight MXAccess COM call inside the worker process.
 
@@ -448,7 +456,7 @@ mxgw-py register --session-id <id> --client-name python-client --json
 mxgw-py add-item --session-id <id> --server-handle 1 --item Object.Attribute --json
 mxgw-py advise --session-id <id> --server-handle 1 --item-handle 2 --json
 mxgw-py stream-events --session-id <id> --max-events 1 --json
-mxgw-py stream-alarms --max-messages 1 --json
+mxgw-py stream-alarms --max-messages 4 --json
 mxgw-py acknowledge-alarm --reference "\\Galaxy\Area001.Pump001.PumpFault" --json
 mxgw-py write --session-id <id> --server-handle 1 --item-handle 2 --type int32 --value 123 --json
 ```
@@ -484,6 +492,15 @@ mxgw-py smoke --endpoint $env:MXGATEWAY_ENDPOINT --plaintext --api-key-env MXGAT
 
 ## Installing from the Gitea PyPI Feed
 
+**The published `0.2.0` artifact cannot connect.** Its `connect()` built the
+`grpc.aio` channel inside `asyncio.to_thread`, and a `grpc.aio` channel binds
+to the event loop current on the *constructing* thread — so every
+non-stub connection raised `RuntimeError: There is no current event loop in
+thread`. Fixed in-tree by commit `a8f86b5` (`resolve_channel_security` now
+runs off-loop, `create_channel` runs on-loop). The fix is superseded by
+`0.2.1`; do not install `0.2.0` from the feed below — use `0.2.1` or later,
+or install from source at a commit at or after `a8f86b5`.
+
 The client publishes to the internal Gitea PyPI feed:
 
 ````bash

clients/python/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "zb-mom-ww-mxaccess-gateway-client"
-version = "0.2.0"
+version = "0.2.1"
 description = "Async Python client for MXAccess Gateway."
 readme = "README.md"
 requires-python = ">=3.12"

clients/python/src/zb_mom_ww_mxgateway/version.py

@@ -1,3 +1,3 @@
 """Package version information."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

clients/python/src/zb_mom_ww_mxgateway_cli/commands.py

@@ -511,16 +511,15 @@ def stream_events(**kwargs: Any) -> None:
 @main.command("stream-alarms")
 @gateway_options
 @click.option("--filter-prefix", default="", help="Alarm-reference prefix filter.")
-@click.option("--max-messages", default=1, type=int, show_default=True)
+@click.option("--max-messages", default=0, type=int, show_default=True, help="Maximum rows to emit; 0 means unbounded.")
 @click.option("--timeout", default=5.0, type=float, show_default=True)
 @click.option("--correlation-id", default="", help="Client correlation id.")
 @click.option("--json", "output_json", is_flag=True, help="Emit JSON output.")
 def stream_alarms(**kwargs: Any) -> None:
-    """Stream a bounded number of messages from the gateway's central alarm feed."""
+    """Stream messages from the gateway's central alarm feed as they arrive."""
 
-    _run(
+    _run_streaming(
         _stream_alarms(**kwargs),
-        output_json=kwargs["output_json"],
         secrets=_secrets(kwargs),
     )
 
@@ -1119,19 +1118,39 @@ async def _stream_events(**kwargs: Any) -> dict[str, Any]:
         return {"events": [_event_row(event) for event in events]}
 
 
-async def _stream_alarms(**kwargs: Any) -> dict[str, Any]:
-    async with await _connect(kwargs) as client:
-        messages = await _collect_alarm_messages(
-            client.stream_alarms(
-                pb.StreamAlarmsRequest(
-                    client_correlation_id=kwargs["correlation_id"],
-                    alarm_filter_prefix=kwargs["filter_prefix"],
-                ),
-            ),
-            max_messages=kwargs["max_messages"],
-            timeout=kwargs["timeout"],
+async def _stream_alarms(**kwargs: Any) -> None:
+    max_messages = int(kwargs["max_messages"])
+    if max_messages > MAX_AGGREGATE_EVENTS:
+        raise click.BadParameter(
+            f"must be less than or equal to {MAX_AGGREGATE_EVENTS}",
+            param_hint="--max-messages",
         )
-        return {"messages": [_message_dict(message) for message in messages]}
+
+    async with await _connect(kwargs) as client:
+        messages = client.stream_alarms(
+            pb.StreamAlarmsRequest(
+                client_correlation_id=kwargs["correlation_id"],
+                alarm_filter_prefix=kwargs["filter_prefix"],
+            ),
+        )
+        iterator = messages.__aiter__()
+        emitted = 0
+        try:
+            while max_messages == 0 or emitted < max_messages:
+                try:
+                    message = await asyncio.wait_for(
+                        iterator.__anext__(),
+                        timeout=kwargs["timeout"],
+                    )
+                except (StopAsyncIteration, asyncio.TimeoutError):
+                    break
+                _emit(_message_dict(message), output_json=kwargs["output_json"])
+                sys.stdout.flush()
+                emitted += 1
+        finally:
+            close = getattr(iterator, "aclose", None)
+            if close is not None:
+                await close()
 
 
 async def _acknowledge_alarm(**kwargs: Any) -> dict[str, Any]:
@@ -1489,6 +1508,17 @@ def _run(
     _emit(payload, output_json=output_json)
 
 
+def _run_streaming(
+    awaitable: Awaitable[None],
+    *,
+    secrets: list[str | None],
+) -> None:
+    try:
+        asyncio.run(awaitable)
+    except MxGatewayError as error:
+        raise click.ClickException(redact_secret(str(error), secrets)) from error
+
+
 def _emit(
     payload: dict[str, Any],
     *,
@@ -1536,34 +1566,6 @@ async def _collect_events(
     return collected
 
 
-async def _collect_alarm_messages(
-    messages: Any,
-    *,
-    max_messages: int,
-    timeout: float,
-) -> list[pb.AlarmFeedMessage]:
-    if max_messages > MAX_AGGREGATE_EVENTS:
-        raise click.BadParameter(
-            f"must be less than or equal to {MAX_AGGREGATE_EVENTS}",
-            param_hint="--max-messages",
-        )
-
-    collected: list[pb.AlarmFeedMessage] = []
-    iterator = messages.__aiter__()
-    try:
-        while len(collected) < max_messages:
-            collected.append(await asyncio.wait_for(iterator.__anext__(), timeout=timeout))
-    except StopAsyncIteration:
-        pass
-    except asyncio.TimeoutError:
-        pass
-    finally:
-        close = getattr(iterator, "aclose", None)
-        if close is not None:
-            await close()
-    return collected
-
-
 async def _collect_deploy_events(
     events: Any,
     *,

clients/python/tests/test_review_findings_022_to_026.py

@@ -7,6 +7,7 @@ fixed source.
 
 from __future__ import annotations
 
+import asyncio
 import json
 import re
 import time as _time_module_ref
@@ -296,6 +297,22 @@ class _AlarmFakeStream:
         self.cancelled = True
 
 
+class _IncrementalAlarmFakeStream(_AlarmFakeStream):
+    def __init__(self, messages: list[pb.AlarmFeedMessage], emitted: list[str]) -> None:
+        super().__init__(messages)
+        self._emitted = emitted
+        self._yielded = 0
+
+    async def __anext__(self) -> pb.AlarmFeedMessage:
+        if self._yielded > 0:
+            assert len(self._emitted) >= self._yielded, "previous alarm row was buffered"
+        if not self._messages:
+            await asyncio.Event().wait()
+            raise AssertionError("unreachable")
+        self._yielded += 1
+        return self._messages.pop(0)
+
+
 class _BulkFakeUnary:
     def __init__(self, replies: list[Any]) -> None:
         self.replies = replies
@@ -667,8 +684,15 @@ def test_cli_write_bulk_happy_path(monkeypatch) -> None:
     assert cmd.kind == pb.MX_COMMAND_KIND_WRITE_BULK
 
 
-def test_cli_stream_alarms_happy_path(monkeypatch) -> None:
-    transitions = [
+def test_cli_stream_alarms_default_streams_status_cached_and_live_rows_incrementally(
+    monkeypatch,
+) -> None:
+    messages = [
+        pb.AlarmFeedMessage(provider_status=pb.AlarmProviderStatus(degraded=False)),
+        pb.AlarmFeedMessage(snapshot_status=pb.AlarmSnapshotStatus(truncated=False)),
+        pb.AlarmFeedMessage(
+            active_alarm=pb.ActiveAlarmSnapshot(alarm_full_reference="Tank01.Level.HiHi"),
+        ),
         pb.AlarmFeedMessage(
             transition=pb.OnAlarmTransitionEvent(
                 alarm_full_reference="Tank01.Level.HiHi",
@@ -676,7 +700,15 @@ def test_cli_stream_alarms_happy_path(monkeypatch) -> None:
             ),
         ),
     ]
-    stream = _AlarmFakeStream(transitions)
+    emitted: list[str] = []
+    real_echo = cli_commands.click.echo
+
+    def recording_echo(message=None, **kwargs) -> None:
+        emitted.append(str(message))
+        real_echo(message, **kwargs)
+
+    monkeypatch.setattr(cli_commands.click, "echo", recording_echo)
+    stream = _IncrementalAlarmFakeStream(messages, emitted)
     stub = _BulkFakeStub()
     stub.set_alarm_stream(stream)
     _install_fake_connect(monkeypatch, stub)
@@ -689,10 +721,8 @@ def test_cli_stream_alarms_happy_path(monkeypatch) -> None:
             "--endpoint",
             "localhost:5000",
             "--plaintext",
-            "--max-messages",
-            "1",
             "--timeout",
-            "5.0",
+            "0.01",
             "--filter-prefix",
             "Tank01.",
             "--json",
@@ -700,8 +730,44 @@ def test_cli_stream_alarms_happy_path(monkeypatch) -> None:
     )
 
     assert result.exit_code == 0, result.output
-    payload = json.loads(result.output)
-    assert payload["messages"][0]["transition"]["alarmFullReference"] == "Tank01.Level.HiHi"
+    rows = [json.loads(line) for line in result.output.splitlines()]
+    assert [next(iter(row)) for row in rows] == [
+        "providerStatus",
+        "snapshotStatus",
+        "activeAlarm",
+        "transition",
+    ]
+    assert stream.cancelled
+
+
+def test_cli_stream_alarms_positive_max_messages_remains_finite(monkeypatch) -> None:
+    messages = [
+        pb.AlarmFeedMessage(provider_status=pb.AlarmProviderStatus()),
+        pb.AlarmFeedMessage(snapshot_status=pb.AlarmSnapshotStatus()),
+        pb.AlarmFeedMessage(active_alarm=pb.ActiveAlarmSnapshot()),
+    ]
+    stream = _AlarmFakeStream(messages)
+    stub = _BulkFakeStub()
+    stub.set_alarm_stream(stream)
+    _install_fake_connect(monkeypatch, stub)
+
+    result = CliRunner().invoke(
+        main,
+        [
+            "stream-alarms",
+            "--endpoint",
+            "localhost:5000",
+            "--plaintext",
+            "--max-messages",
+            "2",
+            "--json",
+        ],
+    )
+
+    assert result.exit_code == 0, result.output
+    rows = [json.loads(line) for line in result.output.splitlines()]
+    assert [next(iter(row)) for row in rows] == ["providerStatus", "snapshotStatus"]
+    assert stream.cancelled
 
 
 def test_cli_acknowledge_alarm_happy_path(monkeypatch) -> None:

clients/rust/Cargo.lock

@@ -590,7 +590,7 @@ checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
 [[package]]
 name = "mxgw-cli"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "clap",
  "futures-util",
@@ -1490,7 +1490,7 @@ dependencies = [
 
 [[package]]
 name = "zb-mom-ww-mxgateway-client"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "futures-core",
  "futures-util",

clients/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "zb-mom-ww-mxgateway-client"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 authors = ["Joseph Doherty"]
 description = "Async Rust client for the MxAccessGateway gRPC service, including a lazy-browse walker over the Galaxy Repository hierarchy."
@@ -25,7 +25,7 @@ resolver = "2"
 
 [workspace.package]
 edition = "2021"
-version = "0.2.0"
+version = "0.2.1"
 authors = ["Joseph Doherty"]
 license = "Proprietary"
 repository = "https://gitea.dohertylan.com/dohertj2/mxaccessgw"

clients/rust/README.md

@@ -77,7 +77,7 @@ cargo run -p mxgw-cli -- register --session-id <session-id> --client-name mxgw-r
 cargo run -p mxgw-cli -- add-item --session-id <session-id> --server-handle 1 --item TestChildObject.TestInt --json
 cargo run -p mxgw-cli -- advise --session-id <session-id> --server-handle 1 --item-handle 1 --json
 cargo run -p mxgw-cli -- stream-events --session-id <session-id> --max-events 1 --json
-cargo run -p mxgw-cli -- stream-alarms --session-id <session-id> --max-messages 1 --json
+cargo run -p mxgw-cli -- stream-alarms --session-id <session-id> --max-messages 4 --json
 cargo run -p mxgw-cli -- acknowledge-alarm --session-id <session-id> --alarm-reference "\\Galaxy\Area001.Pump001.PumpFault" --json
 cargo run -p mxgw-cli -- write --session-id <session-id> --server-handle 1 --item-handle 1 --value-type int32 --value 123 --json
 ```
@@ -141,6 +141,11 @@ every verdict change — including the clearing frame sent when the gateway's
 alarm monitor restarts and drops a truncated verdict. Track it if you need set
 completeness on a live feed without polling `query_active_alarms`.
 
+Unlike the protobuf-JSON formatters used by the other CLIs, the Rust CLI's
+hand-built JSON status rows always include `"degraded": false` and
+`"truncated": false`. This deliberate representational difference is
+documented in the cross-language smoke matrix; both shapes mean the same thing.
+
 The session helpers keep MXAccess handles visible:
 
 ```rust

clients/rust/protos/mxaccess_gateway.proto

@@ -130,6 +130,7 @@ message MxCommand {
     WriteSecuredBulkCommand write_secured_bulk = 41;
     WriteSecured2BulkCommand write_secured2_bulk = 42;
     ReadBulkCommand read_bulk = 43;
+    UpdateAlarmWatchListCommand update_alarm_watch_list = 44;
     PingCommand ping = 100;
     GetSessionStateCommand get_session_state = 101;
     GetWorkerInfoCommand get_worker_info = 102;
@@ -174,6 +175,7 @@ enum MxCommandKind {
   MX_COMMAND_KIND_WRITE_SECURED_BULK = 32;
   MX_COMMAND_KIND_WRITE_SECURED2_BULK = 33;
   MX_COMMAND_KIND_READ_BULK = 34;
+  MX_COMMAND_KIND_UPDATE_ALARM_WATCH_LIST = 35;
   MX_COMMAND_KIND_PING = 100;
   MX_COMMAND_KIND_GET_SESSION_STATE = 101;
   MX_COMMAND_KIND_GET_WORKER_INFO = 102;
@@ -344,8 +346,8 @@ enum AlarmProviderMode {
 // Subscription expression follows the canonical
 // `\\<machine>\Galaxy!<area>` format (literal "Galaxy" provider). The
 // worker spins up a wnwrapConsumer-backed subscription on its STA on
-// first call; subsequent calls are an error (use UnsubscribeAlarms then
-// SubscribeAlarms to reconfigure).
+// first call; subsequent calls are an error. Use UpdateAlarmWatchList to
+// replace the standby targets without restarting the primary subscription.
 message SubscribeAlarmsCommand {
   string subscription_expression = 1;
   // UNSPECIFIED = auto-failover/failback. ALARMMGR/SUBTAG force one provider.
@@ -354,6 +356,17 @@ message SubscribeAlarmsCommand {
   // alarmmgr mode; in subtag mode it bounds what the consumer can observe.
   repeated AlarmSubtagTarget watch_list = 3;
   AlarmFailoverConfig failover = 4;
+  // True when auto mode should retain subtag-fallback capability even if the
+  // gateway's initial discovery produced an empty watch list. False leaves an
+  // empty list as an intentional alarm-manager-only subscription.
+  bool fallback_enabled = 5;
+}
+
+// Replace the live alarm subscription's subtag standby targets. The worker
+// constructs and attaches the replacement before swapping it into service, so
+// a setup failure leaves the existing standby and active provider unchanged.
+message UpdateAlarmWatchListCommand {
+  repeated AlarmSubtagTarget watch_list = 1;
 }
 
 // Tear down the worker's alarm consumer. No-op if no subscription is
@@ -537,11 +550,14 @@ message MxCommandReply {
   MxValue return_value = 6;
   // Correlated per-item outcome rows. For WRITE / WRITE2 / WRITE_SECURED /
   // WRITE_SECURED2 replies the worker holds the reply for a bounded window
-  // (default 1.5 s, MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for
+  // (default 1.5 s, MxGateway:Worker:WriteCompletionWaitMilliseconds) waiting for
   // the matching MXAccess OnWriteComplete callback and copies its status rows
   // here, so statuses[0] carries the real MXAccess commit outcome (success OR
   // failure) while protocol_status/hresult still describe command acceptance
-  // only. Empty statuses on a write reply means the completion did not arrive
+  // only. Callback correlation is recency-based per item handle: after the
+  // bounded wait, a sequential write's callback supersedes a timed-out
+  // predecessor, and a later stale callback for that predecessor is ignored.
+  // Empty statuses on a write reply means the completion did not arrive
   // within the window — the write is unconfirmed, not failed. Correlation is
   // best-effort per (server_handle, item_handle): MXAccess's callback carries
   // no transaction id, so concurrent writes to the same item within the

clients/rust/src/generated.rs

@@ -13,7 +13,7 @@ pub mod mxaccess_gateway {
     /// `mxaccess_gateway.v1` package — the v1 wire contract surfaced by the
     /// gateway to language clients.
     pub mod v1 {
-        #![allow(clippy::large_enum_variant)]
+        #![allow(clippy::large_enum_variant, clippy::result_large_err)]
 
         tonic::include_proto!("mxaccess_gateway.v1");
     }
@@ -24,7 +24,7 @@ pub mod mxaccess_worker {
     /// `mxaccess_worker.v1` package — frame and envelope types used inside
     /// the named-pipe transport between gateway and worker.
     pub mod v1 {
-        #![allow(clippy::large_enum_variant)]
+        #![allow(clippy::large_enum_variant, clippy::result_large_err)]
 
         tonic::include_proto!("mxaccess_worker.v1");
     }
@@ -35,7 +35,7 @@ pub mod galaxy_repository {
     /// `galaxy_repository.v1` package — types for the Galaxy hierarchy
     /// discovery and deploy-event watch RPCs.
     pub mod v1 {
-        #![allow(clippy::large_enum_variant)]
+        #![allow(clippy::large_enum_variant, clippy::result_large_err)]
 
         tonic::include_proto!("galaxy_repository.v1");
     }

docs/AlarmClientDiscovery.md

@@ -835,7 +835,7 @@ carries `degraded = true`.
 ### Watch-list discovery
 
 `GatewayAlarmMonitor` resolves the subtag watch-list at subscribe time by
-calling `IAlarmWatchListResolver.GetAlarmAttributesAsync`. The resolver merges:
+calling `IAlarmWatchListResolver.ResolveAsync`. The resolver merges:
 
 1. Galaxy Repository SQL (`GetAlarmAttributesAsync`) — objects that have alarm
    extensions in the configured area.
@@ -847,8 +847,47 @@ The resolved list is a set of `AlarmSubtagTarget` messages sent to the worker
 inside `SubscribeAlarmsCommand.watch_list`. Each target carries the composed
 MXAccess item addresses for the `InAlarm`, `Acked`, `AckMsg`, and `Priority`
 subtags (confirmed AVEVA `AlarmExtension` field names, verified against the live
-ZB Galaxy `attribute_definition` rows). The gateway re-runs discovery on its
-reconcile cadence and pushes an updated watch-list when the model changes.
+ZB Galaxy `attribute_definition` rows).
+
+The gateway refreshes this list on the existing alarm reconciliation cadence
+and immediately before publishing a failover-to-subtag status. It compares a
+canonical fingerprint of all six target fields and sends
+`UpdateAlarmWatchListCommand` only for a material change. The worker constructs,
+subscribes, and attaches the replacement standby on its STA before swapping it
+in; a setup failure leaves the previous standby and the current primary/subtag
+mode unchanged. The gateway advances its acknowledged fingerprint only after an
+OK reply, so a rejected update remains degraded and is retried.
+
+`SubscribeAlarmsCommand.fallback_enabled` distinguishes an initially empty but
+discovery-enabled fallback from an intentionally alarm-manager-only
+subscription. In the former case the worker creates an empty standby that can be
+hot-swapped after discovery recovers. `ForceAlarmManager` leaves the field false
+and does not create a standby.
+
+Because the list is fixed, the resolution is **graded** rather than merely
+logged (GWC-37). `ResolveAsync` returns an `AlarmWatchListResolution` carrying
+whether Galaxy Repository discovery was attempted and whether it failed, and the
+monitor folds the verdict into the alarm feed's `AlarmProviderStatus`:
+
+- Zero targets while the effective mode can need them (`Auto` or `ForceSubtag`)
+  sets `degraded = true` with reason `AlarmProviderReasons.SubtagWatchListEmpty`
+  — the subtag provider covers no alarms.
+- Discovery enabled but failing adds
+  `AlarmProviderReasons.SubtagDiscoveryFailed` and the failure message, so a
+  Galaxy Repository outage at startup is a standing status rather than one log
+  line emitted possibly weeks before the failover that needs the list.
+- If the worker rejects a material update, the monitor retains the previous
+  acknowledged fingerprint and reports
+  `AlarmProviderReasons.SubtagWatchListStale` with the rejection diagnostic.
+  The next reconciliation or failover edge retries the same resolved targets.
+
+`degraded` on the status is therefore the OR of "the subtag provider is the one
+serving" and "the subtag watch-list cannot cover anything". In `Auto` the second
+can be true while the mode is still `ALARMMGR`: the live feed is healthy and the
+standby behind it is empty. The dashboard renders that combination as the amber
+`Alarm Manager (no subtag standby)` badge rather than the failover label, so the
+badge never names the wrong live provider. `ForceAlarmManager` never builds a
+subtag consumer, so its watch-list is not graded at all.
 
 Each target's canonical `AlarmFullReference` is composed as
 `Galaxy!{area}.{reference}` (literal `Galaxy` provider). The `{area}` is the

docs/Authentication.md

@@ -138,7 +138,9 @@ would otherwise let any peer throttle a key it does not hold — and it joins th
 partition only when the presented token is validly shaped
 (`mxgw_<keyId>_<secret>`, key id at most 64 characters), with at most 32 key-id
 partitions per address before the overflow collapses onto that address's fallback
-partition. An over-limit state admits one probe per
+partition. That peer-layer collapse does not exempt a validly shaped key id from
+the cross-peer aggregate: its failures still feed and consult the key-id aggregate,
+whose own cardinality is bounded by the configured LRU cap. An over-limit state admits one probe per
 `ApiKeyFailureProbeIntervalSeconds` through to the real verifier and refuses
 everything else with `ResourceExhausted` before the store read, so a legitimate
 holder presenting the correct secret always reaches the constant-time compare and

docs/Authorization.md

@@ -180,6 +180,21 @@ Supported constraints are:
 | `read_historized_only` | Read/subscription commands must target objects with historized attributes. |
 | `dashboard_tags` | Dashboard event-visibility tags. **Not a data-access constraint** — see below. |
 
+`browse_subtrees` is applied by `GatewayBrowseScopeProvider`, the host seam the
+shared `ZB.MOM.WW.GalaxyRepository` package calls through `IGalaxyBrowseScopeProvider`;
+it reads the constraint off the ambient per-call identity that
+`GatewayGrpcAuthorizationInterceptor` pushed earlier in the same call. An empty
+`browse_subtrees` list is the library's "no scoping" signal, so the provider has to
+distinguish two states that look alike (GWC-38): an authenticated key with no browse
+constraint is legitimately unscoped and returns the empty list, whereas **no ambient
+identity at all** means the interceptor did not run before the Galaxy service and the
+request's scope cannot be established. In that second case, with
+`MxGateway:Authentication:Mode = ApiKey`, the provider logs a warning naming the broken
+ordering invariant and fails the call with `PermissionDenied` rather than serving the full
+hierarchy — a narrowing control's silent absence is invisible in normal operation, so it is
+made loud instead. Under `Mode = Disabled` an absent identity is the expected steady state
+(nothing authenticates, so no key and no constraints exist) and browse stays unscoped.
+
 `dashboard_tags` is the one member of the blob that constrains nothing on the
 gRPC data path. No read, write, browse, or subscribe check consults it, and
 `HasReadConstraints` / `HasWriteConstraints` deliberately ignore it: adding a tag

docs/ClientPackaging.md

@@ -72,6 +72,23 @@ carries the equivalent guard for the Go module: it refuses to create a
 `ClientVersion` already equals `X.Y.Z` (CLI-21/CLI-39), so a forgotten
 version bump fails the tag instead of shipping a mismatched module.
 
+Both of those guards only fire when someone actually runs a publish.
+CLI-46 found the same hazard recurring silently *between* publishes: a
+real bug fix (the pypi 0.2.0 `connect()` fix above, commit `a8f86b5`) plus
+later wire-surface changes shipped into the tree while every version
+constant still read the already-published number, and nothing recorded
+that the registry artifact and the in-repo source had diverged.
+`scripts/check-client-versions.ps1` is the PR-time half of that guard —
+wired into CI (`.gitea/workflows/ci.yml`, the `portable` job, next to the
+codegen freshness checks): for each client it finds the latest publish tag
+(`clients/go/vX.Y.Z` for Go — the only client with a git tag at all; .NET,
+Python, Rust, and Java publish straight to a package registry via
+`pack-clients.ps1 -Publish` with no corresponding git tag, so the check
+reports "no tags found" and passes for those four today) and fails if
+`clients/<lang>` differs from that tag while the version constant still
+equals the tag's version. A client with no publish tag is not a
+violation — there is no "since the last publish" window to check yet.
+
 As of 2026-08-07 (CLI-39) all five clients — plus `ZB.MOM.WW.MxGateway.Contracts`,
 which releases in lockstep with the .NET Client — moved to **0.2.0**,
 converging on one number after four of the five had drifted onto the
@@ -111,6 +128,26 @@ confirmed present through the Gitea package API after the push, and
 `go list -m` resolves the Go tag. These are the numbers a future release
 bumps off.
 
+**The published pypi `0.2.0` artifact has a broken `connect()` (CLI-46).**
+Its `connect()` built the `grpc.aio` channel inside `asyncio.to_thread`, and
+a `grpc.aio` channel binds to the event loop current on the *constructing*
+thread, so every non-stub connection raised `RuntimeError: There is no
+current event loop in thread` — TST-24's first real-wire run caught it.
+Fixed in-tree by commit `a8f86b5` (2026-08-10): `resolve_channel_security`
+now runs off-loop, `create_channel` runs on-loop. That fix, plus later
+wire-surface additions (`d9ea8a8`, `c748361`), shipped after the 2026-08-07
+publish while the version constants still read the already-published
+0.2.0/0.2.1 numbers above — see `clients/python/README.md` for the
+user-facing warning. **0.2.0 is superseded by 0.2.1; do not install it.**
+
+As of this remediation (CLI-46), the in-source version constants for the
+.NET, Go, Python, and Rust clients (plus Contracts) read **0.2.1**, and the
+Java client reads **0.2.2**. These are not yet published — the numbers
+above (0.2.0 four clients + Contracts, 0.2.1 Java) remain the live registry
+state until the next `pack-clients.ps1` / `tag-go-module.ps1` run. Once that
+publish lands, update this section with the new coordinates and commit(s),
+the same way the 2026-08-07 record above was written after the fact.
+
 ## .NET
 
 The .NET client uses .NET 10 and references

docs/Contracts.md

@@ -40,6 +40,15 @@ the corresponding MXAccess `AddItem`, `Advise`, `UnAdvise`, and `RemoveItem`
 calls sequentially on the session STA and preserves input order in the result
 list.
 
+The shared alarm command model includes `SubscribeAlarms` and
+`UpdateAlarmWatchList`. `SubscribeAlarmsCommand.fallback_enabled` makes an empty
+initial watch list explicitly fallback-capable, allowing discovery recovery to
+populate a standby without restarting the primary alarm-manager subscription.
+`UpdateAlarmWatchListCommand.watch_list` is the complete replacement list. The
+worker prepares the replacement on its STA before swapping it into the existing
+failover consumer and returns a normal `MxCommandReply`; callers must treat only
+`protocol_status = OK` as acknowledgement of the new list.
+
 The command model also includes bulk write/read command kinds:
 `WriteBulk`, `Write2Bulk`, `WriteSecuredBulk`, `WriteSecured2Bulk`, and
 `ReadBulk`. They are unary `Invoke` payloads on the same `MxAccessGateway`
@@ -94,6 +103,15 @@ only and does not share types with `mxaccess_gateway.proto`. See
 [Galaxy Repository Browse](./GalaxyRepository.md) for the RPC catalog and
 behavior.
 
+The retained proto remains the client-generation source of truth while the
+gateway serves the wire-identical descriptor from the
+`ZB.MOM.WW.GalaxyRepository` package. `GalaxyContractParityTests` converts both
+loaded descriptors to `FileDescriptorProto`, removes source locations, and
+normalizes the C# namespace and file name before comparing deterministic bytes.
+Its mutation test also requires drift failures to identify the first differing
+protobuf message. Any parity failure must be resolved before publishing either
+Contracts or clients.
+
 Generated C# output is written to `src/ZB.MOM.WW.MxGateway.Contracts/Generated/`. Do not
 hand-edit generated files.
 
@@ -140,6 +158,13 @@ Run the focused contract tests after changing either `.proto` file:
 dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter ProtobufContractRoundTripTests
 ```
 
+When changing `galaxy_repository.proto` or the served Galaxy Repository
+package, also run the retained-vs-served parity guard:
+
+```bash
+dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter GalaxyContractParityTests
+```
+
 The full solution build also regenerates the C# contracts before compiling
 gateway and test projects:
 

docs/CrossLanguageSmokeMatrix.md

@@ -66,6 +66,23 @@ declaration-ordered JSON; and the row sits alone on its own line for Go and for
 Rust's `--jsonl`, but inside an `events` array for Python and for Rust's
 aggregate `--json`.
 
+Alarm-feed status rows deliberately preserve each CLI's established JSON
+mapping while making false values explicit in every text formatter:
+
+| CLI | Healthy provider text | Clearing snapshot text | JSON false-value shape |
+|-----|-----------------------|------------------------|------------------------|
+| `mxgw-dotnet` | `provider-status mode=Unspecified degraded=false reason=""` | `snapshot-status truncated=false` | `{"providerStatus": {}}` / `{"snapshotStatus": {}}` |
+| `mxgw-go` | `provider-status mode=ALARM_PROVIDER_MODE_UNSPECIFIED degraded=false reason=""` | `snapshot-status truncated=false` | `{"providerStatus":{}}` / `{"snapshotStatus":{}}` |
+| `mxgw-py` | same JSON row as `--json` | same JSON row as `--json` | `{"providerStatus": {}}` / `{"snapshotStatus": {}}`, emitted one row at a time |
+| `mxgw-java` | `provider-status mode=ALARM_PROVIDER_MODE_UNSPECIFIED degraded=false reason=` | `snapshot-status truncated=false` | `{"providerStatus":{}}` / `{"snapshotStatus":{}}` |
+| `mxgw-rs` | explicit `degraded=false` summary | explicit `truncated=false` summary | always includes `"degraded":false` / `"truncated":false` |
+
+For the protobuf-JSON rows, an absent proto3 boolean means `false`; Rust's
+always-explicit booleans are semantically equivalent. Python `stream-alarms`
+defaults to an unbounded feed and emits each row immediately; a positive
+`--max-messages` value provides a bounded sample and includes both status
+preamble rows in the count.
+
 ## Integration Gate
 
 Cross-language smoke execution is opt-in. Runners should skip the matrix unless

docs/DesignDecisions.md

@@ -90,9 +90,9 @@ detach-grace and replay-retention windows are on by default, the reconnect
 surface is a trust boundary — a retained session outlives the stream that opened
 it. The session records the opening key id (`GatewaySession.OwnerKeyId`) and
 every `StreamEvents` attach/reattach is rejected with `PermissionDenied` unless
-the caller's key id matches the owner. Gating on the `event` scope alone was
-rejected: it would let any `event`-scoped key that learned a session id attach to
-another key's retained session and receive its replayed and live data. The check
+the caller's key id matches the owner. Gating on the `events:read` scope alone was
+rejected: it would let any `events:read`-scoped key that learned a session id
+attach to another key's retained session and receive its replayed and live data. The check
 runs before any subscriber is attached, so a foreign key never touches the
 replay ring. Admin-scope override is deferred.
 

docs/GatewayConfiguration.md

@@ -194,7 +194,7 @@ events (a "gap") and must re-snapshot; whatever is still retained is replayed.
 | Option | Default | Description |
 |--------|---------|-------------|
 | `MxGateway:Dashboard:Enabled` | `true` | Enables Blazor Server dashboard route mapping. The dashboard mounts at the host root (`/`); there is no separate path-base prefix. |
-| `MxGateway:Dashboard:AllowAnonymousLocalhost` | `true` | Allows loopback dashboard requests to bypass the dashboard cookie requirement for local development. Remote requests still require dashboard authentication. |
+| `MxGateway:Dashboard:AllowAnonymousLocalhost` | `true` | Allows loopback dashboard requests to bypass the dashboard cookie requirement for local development. Remote requests still require dashboard authentication. The bypass is **read-only** — it satisfies a requirement including the `Viewer` role but never `AdminOnly`, so API-key CRUD and session Close/Kill stay closed — and since SEC-40 it does **not** reach the alarm feed: `/alarms` and `/hubs/alarms` carry `MxGateway.Dashboard.Alarms`, a policy built from a requirement type the bypass handler does not handle, so an anonymous loopback caller is denied the page, denied the hub, and not offered the Alarms link. The alarm monitor is gateway-central and its messages carry no session provenance, so alarm metadata cannot be tag-scoped the way session events are — requiring a real role claim is the narrowing that exists. Sign in (or use `DisableLogin` in dev, which mints a genuine principal) to see alarms; no setting re-opens the feed to the bypass. The same exclusion applies to `Authentication:Mode=Disabled`. |
 | `MxGateway:Dashboard:RequireHttpsCookie` | `true` | Sets the dashboard auth cookie's secure policy. `true` keeps `CookieSecurePolicy.Always` — the cookie is only sent over HTTPS, which matches a production HTTPS deployment. Set to `false` for plain-HTTP dev deployments to use `CookieSecurePolicy.SameAsRequest`; the cookie is still flagged Secure on HTTPS requests, but it can round-trip over HTTP. Browsers drop Secure cookies set over HTTP from non-localhost hosts, so leaving this `true` while serving the dashboard over plain HTTP will break login from any remote browser. |
 | `MxGateway:Dashboard:CookieName` | _(unset)_ | Dashboard auth cookie name. Leave unset (null/blank) to use the resolved default: `__Host-MxGatewayDashboard` when `RequireHttpsCookie` is `true` (Secure cookie, so the `__Host-` prefix's Secure/no-Domain/`Path=/` guarantees apply), else the plain `MxGatewayDashboard` (a `__Host-` cookie without Secure is silently dropped by browsers). Override it to give a distinct name to a gateway that shares a hostname with another gateway instance: browser cookies are scoped by host+path but **not** by port, so two instances on the same host would otherwise clobber each other's dashboard session under a shared cookie name. An explicit override always wins over the `__Host-` default. Changing it signs out existing dashboard sessions on next deploy. |
 | `MxGateway:Dashboard:SnapshotIntervalMilliseconds` | `1000` | Dashboard snapshot refresh interval used by the snapshot SignalR hub and the pages that subscribe to it. |
@@ -202,7 +202,7 @@ events (a "gap") and must re-snapshot; whatever is still retained is replayed.
 | `MxGateway:Dashboard:RecentSessionLimit` | `200` | Maximum number of session summaries projected into each dashboard snapshot. |
 | `MxGateway:Dashboard:ShowTagValues` | `false` | Controls whether tag values reach the dashboard at all. `false` (the default) suppresses them on all three seams that carry one: (1) the **events hub mirror** — `DashboardEventBroadcaster` blanks `MxEvent.value` plus the alarm body's `current_value`/`limit_value` from a deep-cloned copy before it reaches any hub subscriber (see `docs/GatewayDashboardDesign.md`'s `EventsHub` row); (2) the **alarms hub** — `AlarmsHubPublisher` clears `current_value`/`limit_value` from a deep-cloned copy of each `AlarmFeedMessage`, on both value-bearing payload arms (`transition` and `active_alarm`), before broadcasting to `/hubs/alarms`; (3) the **`/browse` live-value panel** — `DashboardLiveDataService` substitutes the literal `[redacted]` for the value text of each **successfully read** tag; a failed read keeps its `-` placeholder (there was no value to suppress, and the row's error is left untouched, so the two cannot contradict each other). Both hub redactions clone: the source `MxEvent` is shared with the gRPC event stream and the replay ring, and the source `AlarmFeedMessage` fans out to gRPC `StreamAlarms` subscribers, so neither is mutated in place and **no gRPC client is affected by this flag** — it is a dashboard-display control only. Everything that is not the value survives on every seam: tag reference, alarm reference/severity/state/operator, data type, quality, status, and timestamps still render, so the dashboard stays diagnostic without disclosing process values. This is one of two independent layers: `IDashboardSessionAcl` decides *which* sessions a caller may subscribe to at all (see `GroupToTag` / `UntaggedSessionVisibility` below), while this flag decides what a permitted subscriber sees. Setting it `true` exposes tag values to everyone the ACL admits — every Administrator, plus each Viewer holding a matching tag — and, because the alarms hub is session-less, exposes alarm values to every dashboard client that can reach `/hubs/alarms`. |
 | `MxGateway:Dashboard:GroupToRole` | _(empty)_ | LDAP group → dashboard role mapping. Keys must be **short** LDAP group names — the CN / first-RDN value, e.g. `GwAdmin`, not `ou=GwAdmin,ou=groups,dc=zb,dc=local` — matched case-insensitively. The shared `ZB.MOM.WW.Auth.Ldap` provider delivers a user's groups already stripped to short names, so a full-DN key can never match and the group silently maps to nothing. (The mapper does try the full literal string before falling back to the leading-RDN value, but on the live login path both branches see the same short name; the fallback only matters to non-library callers of the `IGroupRoleMapper<string>` seam.) Values must be `Administrator` (read/write, API-key CRUD) or `Viewer` (read-only) — matched ordinally by the startup validator, so the spelling is exact and `Admin` is rejected. A user whose LDAP groups don't intersect this map cannot sign in; with no mapping at all, only the loopback bypass admits anyone. |
-| `MxGateway:Dashboard:GroupToTag` | _(empty)_ | LDAP group → dashboard visibility tags. Keys follow the same convention as `GroupToRole` — short LDAP group names (CN / first-RDN value), matched case-insensitively; a full-DN key never matches the pre-stripped groups the LDAP provider returns. Values are tag lists. A dashboard user's granted tag set is the union over the groups they belong to; an unmapped group contributes nothing. **Visibility only:** tags scope which sessions' event streams a Viewer may observe on the dashboard — they never grant or deny data access, which stays with the API key's scopes and constraints. Independent of `GroupToRole`: a group may appear in either map, both, or neither. Empty (the default) means Viewers hold no tags, so under the default `UntaggedSessionVisibility` they observe no session's events. |
+| `MxGateway:Dashboard:GroupToTag` | _(empty)_ | LDAP group → dashboard visibility tags. Keys follow the same convention as `GroupToRole` — short LDAP group names (CN / first-RDN value), matched case-insensitively; a full-DN key never matches the pre-stripped groups the LDAP provider returns. Values are tag lists. A dashboard user's granted tag set is the union over the groups they belong to; an unmapped group contributes nothing. **Visibility only:** tags scope which sessions' event streams a Viewer may observe on the dashboard — they never grant or deny data access, which stays with the API key's scopes and constraints. Independent of `GroupToRole`: a group may appear in either map, both, or neither. Empty (the default) means Viewers hold no tags, so under the default `UntaggedSessionVisibility` they observe no session's events. **Applies to session event streams only:** the alarm feed (`/alarms`, `/hubs/alarms`) is deliberately *not* tag-scoped — the alarm monitor is gateway-central and session-less, so an `AlarmFeedMessage` carries no session or owning key to intersect a tag grant against. Alarm metadata (reference, state, severity, category, area, acknowledging operator) is therefore galaxy-wide for every authenticated dashboard role, regardless of tag grant; alarm *values* still follow `ShowTagValues`. What SEC-40 narrowed there is admission rather than scope: the environment bypasses (`AllowAnonymousLocalhost`, `Authentication:Mode=Disabled`) no longer receive the feed at all. **Revocation:** the ACL re-resolves a caller's grant from their LDAP group claims against this map on every subscribe, so removing an entry takes effect at the next subscribe after the gateway restart that rebinds options (options bind once at startup); a change to the user's LDAP group membership takes effect when their principal is rebuilt — at re-login for cookie sessions, within one 5-minute hub-token lifetime for token clients. An already-open subscription is never re-checked and lives until it drops. |
 | `MxGateway:Dashboard:UntaggedSessionVisibility` | `AdminOnly` | Who may observe a session that carries no tags (its owning API key declared none). `AdminOnly` (default, fail-closed) restricts untagged sessions to dashboard Administrators. `AllViewers` shows them to every Viewer — opt-in for a single-tenant deployment that wants the pre-tag behaviour. Administrators always see every session regardless of tags. |
 | `MxGateway:Dashboard:DisableLogin` | `false` | Dev/test only. When `true`, replaces the cookie authentication handler with `DashboardAutoLoginAuthenticationHandler`, which auto-authenticates every dashboard request — including requests from remote browsers, not just loopback — as `AutoLoginUser` holding both `Administrator` and `Viewer` roles. No login form, LDAP bind, or cookie is involved. A loud one-time startup warning is logged. Differs from `AllowAnonymousLocalhost`: `DisableLogin` mints a real authenticated principal (so role-gated write affordances appear), whereas `AllowAnonymousLocalhost` satisfies the authorization requirement on loopback only without minting a principal (write affordances stay hidden). Never enable in production. **Production hard-stop (SEC-04):** when the host runs in the `Production` environment and `DisableLogin` is `true`, startup validation fails and the process aborts — the flag is only accepted outside Production, where the one-time startup warning still fires. |
 | `MxGateway:Dashboard:AutoLoginUser` | `(null)` | Username stamped on the synthetic principal when `DisableLogin` is `true`. Default `(null)` — a null or blank value falls back to `multi-role`. Has no effect when `DisableLogin` is `false`. |
@@ -439,7 +439,7 @@ behavior.
 | `MxGateway:Alarms:Enabled` | `false` | Gates the gateway's always-on central alarm monitor. When `true`, the gateway opens one gateway-owned worker session dedicated to alarms, caches the active-alarm set, and fans it out to every client through the `StreamAlarms` RPC — no client opens its own session to see alarms. |
 | `MxGateway:Alarms:SubscriptionExpression` | _(empty)_ | AVEVA alarm-subscription expression the monitor subscribes on startup, in canonical `\\<machine>\Galaxy!<area>` form. The literal `Galaxy` provider is correct regardless of the Galaxy database name. When empty and `Enabled` is `true`, the gateway falls back to `\\<MachineName>\Galaxy!<DefaultArea>` if `DefaultArea` is set. |
 | `MxGateway:Alarms:DefaultArea` | _(empty)_ | Area name used to compose a default subscription when `SubscriptionExpression` is empty. If both are empty while `Enabled` is `true`, the monitor faults with a configuration diagnostic. |
-| `MxGateway:Alarms:ReconcileIntervalSeconds` | `30` | How often the monitor reconciles its in-process alarm cache against the worker's authoritative active-alarm snapshot, catching transitions the live poll-and-diff feed missed. Floored at 5 seconds. |
+| `MxGateway:Alarms:ReconcileIntervalSeconds` | `30` | How often the monitor re-resolves and, on material change, hot-swaps the subtag fallback watch-list, then reconciles its in-process alarm cache against the worker's authoritative active-alarm snapshot. The acknowledged watch-list fingerprint advances only after an OK worker reply. Floored at 5 seconds. |
 | `MxGateway:Alarms:PollIntervalMilliseconds` | `500` | Cadence at which the worker's STA polls the AVEVA alarm consumer (`GetXmlCurrentAlarms2`) for the active-alarm snapshot the live feed diffs. Must be between `100` and `3600000` (one hour): every poll is a COM call plus an XML parse on the same STA that serves reads and writes, so a tighter cadence starves the command path, while a value above an hour stops being a cadence and silently disables alarm polling. The gateway conveys the value to the worker via the `MXGATEWAY_ALARM_POLL_INTERVAL_MS` environment variable; a missing or out-of-range value leaves the worker on the 500 ms default rather than failing the session. |
 | `MxGateway:Alarms:MaxAlarmsPerFetch` | `1024` | Cap the worker passes to `GetXmlCurrentAlarms2`'s `maxAlmCnt`. Must be between `64` and `65536` — the worker is a 32-bit process that materializes each reply as one BSTR plus a full `XmlDocument`, so an unbounded cap faults the STA with an out-of-memory rather than merely slowing it. It doubles as the **truncation threshold**: a fetch returning exactly this many records is treated as truncated, because the COM API caps its reply with no "more available" flag. On a truncated poll the worker retains the alarms the capped reply could not mention instead of letting their absence read as a clear, and logs a rate-limited `AlarmSnapshotTruncated` warning to its stderr (identifiers and counts only). **Remediation when you see that warning: raise this value** so the steady-state active-alarm count fits inside one fetch. A galaxy permanently above the cap holds stale entries in the snapshot until a sub-cap poll, and loses clear→re-raise cycles that happen entirely out of window (see `docs/DesignDecisions.md`). Conveyed to the worker via the `MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH` environment variable; a missing or out-of-range value leaves the worker on the 1024 default. |
 
@@ -453,11 +453,11 @@ native wnwrap alarm-manager provider and the subtag-monitoring fallback.
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `MxGateway:Alarms:Fallback:Mode` | `Auto` | Provider selection mode. `Auto` uses the alarm manager as primary and fails over to subtag monitoring after consecutive COM failures, then fails back automatically. `ForceAlarmManager` disables failover. `ForceSubtag` forces subtag monitoring on from startup. Values are case-insensitive. |
+| `MxGateway:Alarms:Fallback:Mode` | `Auto` | Provider selection mode. `Auto` uses the alarm manager as primary and fails over to subtag monitoring after consecutive COM failures, then fails back automatically. `ForceAlarmManager` disables failover (and is the one mode whose subtag watch-list is never graded, because no subtag consumer is built). `ForceSubtag` forces subtag monitoring on from startup. Values are case-insensitive. |
 | `MxGateway:Alarms:Fallback:ConsecutiveFailureThreshold` | `3` | Number of consecutive wnwrap COM failures (`COMException` or failure HRESULT from `Subscribe` / `GetXmlCurrentAlarms2`) before the monitor switches to subtag mode. Floored at 1. |
 | `MxGateway:Alarms:Fallback:FailbackProbeIntervalSeconds` | `30` | While in subtag mode, how often (in seconds) the monitor probes the wnwrap provider to detect recovery. Floored at 1. |
 | `MxGateway:Alarms:Fallback:FailbackStableProbes` | `3` | Number of consecutive clean wnwrap probes required before the monitor switches back to the alarm manager. Floored at 1. |
-| `MxGateway:Alarms:Fallback:Discovery:UseGalaxyRepository` | `true` | When `true`, the monitor queries the Galaxy Repository SQL database to build the subtag watch-list for the configured area. |
+| `MxGateway:Alarms:Fallback:Discovery:UseGalaxyRepository` | `true` | When `true`, the monitor queries the Galaxy Repository SQL database to build the subtag watch-list for the configured area. A failed query is not fatal — the monitor continues with whatever configuration contributed — but with `Mode` `Auto` or `ForceSubtag` the resulting coverage gap is reported on the alarm feed's `AlarmProviderStatus` (`degraded = true` with a `Subtag watch-list is empty` / `Galaxy Repository alarm discovery failed` reason) and shown on the dashboard as the amber `Alarm Manager (no subtag standby)` badge, instead of only a startup log line. |
 | `MxGateway:Alarms:Fallback:Discovery:Area` | _(empty)_ | Galaxy area to scope the Repository query to. Falls back to `MxGateway:Alarms:DefaultArea` when empty. Ignored when `UseGalaxyRepository` is `false`. This area is **not** used to compose a Repository-derived alarm's canonical `Galaxy!{area}.{reference}`: each discovered alarm uses its object's real Galaxy area (discovered via `gobject.area_gobject_id`), so the reference's group matches what the native alarmmgr emits. `Discovery:Area` / `DefaultArea` is used as the composition area only for explicit `IncludeAttributes` entries, which carry no discovered area. |
 | `MxGateway:Alarms:Fallback:Discovery:IncludeAttributes` | _(empty)_ | Explicit MXAccess attribute paths to add to the subtag watch-list, supplementing (or replacing, when `UseGalaxyRepository` is `false`) the Repository-derived list. |
 | `MxGateway:Alarms:Fallback:Discovery:ExcludeAttributes` | _(empty)_ | Attribute paths to remove from the merged watch-list (case-insensitive). The exclude is applied after the Repository-derived rows and the explicit `IncludeAttributes` entries are combined, so an exclude that matches an explicit include suppresses it too — excludes win. Ignored when `UseGalaxyRepository` is `false`. |

docs/GatewayDashboardDesign.md

@@ -274,7 +274,7 @@ bearer). Each hub class is `[Authorize(Policy = HubClientsPolicy)]`.
 | Hub | Path | Producer | Payload | Routing |
 |---|---|---|---|---|
 | `DashboardSnapshotHub` | `/hubs/snapshot` | `DashboardSnapshotPublisher` (BackgroundService consuming `IDashboardSnapshotService.WatchSnapshotsAsync`) | `DashboardSnapshot` | Sent to all connected clients on every snapshot tick, but only while at least one client is connected (see "Idle gating" below); new connections receive the current snapshot synchronously in `OnConnectedAsync`. |
-| `AlarmsHub` | `/hubs/alarms` | `AlarmsHubPublisher` (BackgroundService consuming `IGatewayAlarmService.StreamAsync(filter: null)`) | `AlarmFeedMessage` (`active_alarm` / `snapshot_complete` / `transition` / `provider_status` / `snapshot_status`) | Connected clients auto-join `__alarms__`; all clients receive every message. Publisher auto-reconnects every 5s on stream faults. The alarm value fields (`current_value` / `limit_value`) are stripped from a deep-cloned copy of the message when `Dashboard:ShowTagValues` is false (the default) — on both value-bearing payload arms, so neither a live transition nor a snapshot record leaks a process value; every other field still renders. The source message is never mutated: it fans out from the same feed to gRPC `StreamAlarms` subscribers, which this dashboard-display flag does not govern. Arms carrying no value are forwarded as-is, uncloned. |
+| `AlarmsHub` | `/hubs/alarms` | `AlarmsHubPublisher` (BackgroundService consuming `IGatewayAlarmService.StreamAsync(filter: null)`) | `AlarmFeedMessage` (`active_alarm` / `snapshot_complete` / `transition` / `provider_status` / `snapshot_status`) | Guarded by `MxGateway.Dashboard.Alarms`, not `HubClients`: a real authenticated dashboard role is required, so the `Authentication:Mode=Disabled` and anonymous-localhost bypasses are excluded (SEC-40). Connected clients auto-join `__alarms__`; all admitted clients receive every message — the feed is galaxy-wide and carries no session provenance, so no per-caller scoping applies (see "Alarm-feed visibility"). Publisher auto-reconnects every 5s on stream faults. The alarm value fields (`current_value` / `limit_value`) are stripped from a deep-cloned copy of the message when `Dashboard:ShowTagValues` is false (the default) — on both value-bearing payload arms, so neither a live transition nor a snapshot record leaks a process value; every other field still renders. The source message is never mutated: it fans out from the same feed to gRPC `StreamAlarms` subscribers, which this dashboard-display flag does not govern. Arms carrying no value are forwarded as-is, uncloned. |
 | `EventsHub` | `/hubs/events` | `DashboardEventBroadcaster` invoked by each session's internal dashboard-mirror subscriber on its `SessionEventDistributor` (registered when the session becomes Ready) | `MxEvent` | Clients call `SubscribeSession(sessionId)` to join `session:{id}`, which also registers them in `EventsHubViewerRegistry` — the mirror is gated on that registry, which counts hub and in-process viewers alike (see "Mirror gating" below). The dashboard is a first-class distributor subscriber, so it receives the session's events whether or not a gRPC client is streaming. It sees RAW session events — not the per-gRPC-subscriber `AfterWorkerSequence` filtering that `EventStreamService` applies at its own boundary — because the dashboard is a separate LDAP-authenticated monitoring view meant to show the session's full event activity. Tag values are stripped from the mirrored `MxEvent` copy by `DashboardEventBroadcaster` when `Dashboard:ShowTagValues` is false (the default) — event metadata (tag reference, quality, status, timestamps) still renders, but the value fields are blanked, so no value leaks through this seam. `SubscribeSession` is gated by `IDashboardSessionAcl` (SEC-25 / TST-15): a denied caller gets a `HubException`, is not joined to the group, and is not registered as a viewer, so the mirror stays off for a session nobody is legitimately watching. The same ACL gates the in-process seam the session-details page uses, so neither path is the weaker one. Value redaction remains an independent layer — it bounds what a *permitted* subscriber sees. |
 
 ### Default cadences
@@ -556,6 +556,14 @@ re-asserts the truncation verdict as the reconcile baseline. If `MxGateway:Alarm
 false the central monitor never starts, and the page says so instead of showing
 an empty list with no explanation.
 
+The page carries `[Authorize(Policy = MxGateway.Dashboard.Alarms)]` rather than relying on the
+`Viewer` policy `MapRazorComponents<App>()` applies to every component route (SEC-40), so it
+needs a real authenticated dashboard role: the `Authentication:Mode=Disabled` and
+anonymous-localhost bypasses reach every other read-only page but not this one. It is the same
+policy `AlarmsHub` carries — the two read one central monitor and must not disagree about who
+may see it — and the side rail hides the Alarms link for callers the policy denies. What a
+permitted caller sees is galaxy-wide and not tag-scoped; see "Alarm-feed visibility".
+
 ### Live data source
 
 Both the Browse subscription panel and the Alarms page read live MXAccess data
@@ -706,14 +714,25 @@ Implemented behavior:
   generic credential-rejected message;
 - antiforgery tokens guard the login and logout POSTs.
 
-Three authorization policies are registered:
+Four authorization policies are registered:
 
 - `MxGateway.Dashboard.Viewer` — Razor component routes. Satisfied by Admin or
   Viewer.
 - `MxGateway.Dashboard.Admin` — Admin-only write surfaces (API-key CRUD).
-- `MxGateway.Dashboard.HubClients` — SignalR hubs. Accepts the dashboard
-  cookie OR a `MxGateway.Dashboard.HubToken` bearer (used by WebSocket upgrades
-  where the cookie can't be forwarded).
+- `MxGateway.Dashboard.HubClients` — the snapshot and events SignalR hubs. Accepts
+  the dashboard cookie OR a `MxGateway.Dashboard.HubToken` bearer (used by WebSocket
+  upgrades where the cookie can't be forwarded).
+- `MxGateway.Dashboard.Alarms` — the alarm feed: `AlarmsHub` and the `/alarms`
+  page. Same two schemes as `HubClients`, but built from
+  `AuthenticatedDashboardRoleRequirement` instead of
+  `DashboardAuthorizationRequirement` (SEC-40). Because `DashboardAuthorizationHandler`
+  handles only the latter type, the read-only environment bypasses below cannot
+  satisfy this policy — see "Alarm-feed visibility".
+
+The first three requirement types are satisfiable by the environment bypasses;
+`MxGateway.Dashboard.Alarms` and the mounted Secrets UI's `secrets:manage` are not,
+both for the same structural reason — the bypass handler is typed to a requirement
+they do not use.
 
 The in-process page feeds carry no authentication of their own, and need none:
 `MapRazorComponents<App>()` applies `RequireAuthorization(ViewerPolicy)` to the
@@ -733,12 +752,30 @@ caller's granted tags, ordinal-ignore-case. A session's tags are inherited from
 owning API key's `--dashboard-tags` constraint and are immutable for the session's
 life, so a subscribe-time decision cannot go stale while the subscription lives and
 no per-event re-check is needed. A Viewer's grant comes from
-`Dashboard:GroupToTag` applied to their LDAP groups, stamped as
-`zb:dashboardtag` claims at cookie login and re-resolved (not copied) at hub-token
-mint, so the token's 5-minute lifetime bounds how long a revoked grant survives. A
-principal carrying no tag claims — anonymous localhost included — is an
-empty-grant Viewer. The mirror's value redaction is an independent layer: it bounds
-what a permitted subscriber sees, not who may subscribe.
+`Dashboard:GroupToTag` applied to their LDAP groups. Since SEC-41 the ACL **re-resolves**
+that grant on every subscribe, from the caller's `mxgateway:ldap_group` claims against the
+currently bound `GroupToTag` map — the same one `DashboardGroupTagMapping.MapGroupsToTags`
+call the hub-token mint makes — rather than trusting the `zb:dashboardtag` claims stamped
+into the cookie at login. Those stamped claims were resolved under whatever map was bound
+when the user signed in, and the auth cookie outlives the gateway restart that applies a
+`GroupToTag` edit, so trusting them let a revoked grant survive the restart meant to remove
+it. The stamped claims remain the **fallback** for a principal carrying no group claims,
+which in practice means the hub-token principal: the token payload carries roles and tags
+but no LDAP groups, and the mint already re-resolved them. That fallback cannot re-open the
+cookie hole, because `DashboardAuthenticator` stamps group and tag claims from one group
+list — a cookie principal holding a tag claim always holds the groups it came from, and a
+login yielding no groups yields no tags. A principal carrying neither kind of claim —
+anonymous localhost included — is an empty-grant Viewer. The mirror's value redaction is an
+independent layer: it bounds what a permitted subscriber sees, not who may subscribe.
+
+**Revocation bounds.** Three different revocations propagate on three different clocks, and
+the difference is intrinsic to where each fact lives:
+
+| Revocation | Takes effect |
+|---|---|
+| A `GroupToTag` entry removed from config | At the next subscribe after the gateway restart that rebinds options — identically on both seams, since both re-resolve against current options. `GatewayOptions` binds once at startup, so the restart is what applies the edit; nothing further is needed. |
+| An LDAP group-membership revocation | When the principal is next rebuilt: at re-login for the cookie seam, bounded by the cookie's sliding 8-hour idle life (renewable by activity); within one 5-minute token lifetime for the hub-token seam. Neither seam re-queries LDAP per subscribe. |
+| Either, for an **already-open** subscription | Never — the subscription lives until it drops. The ACL is a subscribe-time gate by design (session tags are immutable, so no per-event re-check is warranted); closing an in-flight stream on a grant change would need a revocation channel the dashboard does not have. Force it by closing the session, or by restarting the gateway, which tears down every circuit and hub connection. |
 
 Two environmental bypasses still apply, both scoped to **read-only** access:
 `MxGateway:Authentication:Mode = Disabled` and `MxGateway:Dashboard:AllowAnonymousLocalhost`
@@ -746,11 +783,50 @@ Two environmental bypasses still apply, both scoped to **read-only** access:
 role (`AnyDashboardRole`) but **never** the `AdminOnly` requirement. Destructive/admin
 surfaces (API-key CRUD, session Close, worker Kill) still demand a real `Administrator`
 role claim, so the "anonymous localhost is read-only" contract holds at the policy layer
-rather than only in downstream service re-checks. Remote requests (outside the `Disabled`
+rather than only in downstream service re-checks. Since SEC-40 the bypasses also do not
+reach the **alarm feed** (`MxGateway.Dashboard.Alarms`) — read-only is not the same as
+"may see the whole plant's alarm metadata"; see "Alarm-feed visibility" below. Remote requests (outside the `Disabled`
 bypass) always require an authenticated principal carrying at least the Viewer role. The
 loopback test trusts `Connection.RemoteIpAddress`; if forwarded-headers middleware is ever
 added upstream, `DashboardAuthorizationHandler.IsLoopbackRequest()` must be revisited.
 
+### Alarm-feed visibility
+
+The alarm feed is **not** tag-scoped, and that is a deliberate, bounded decision rather than
+an oversight in the SEC-25 ACL.
+
+The gateway's alarm monitor is central and session-less: one subscription expression, one
+`IGatewayAlarmService` feed, consumed by `AlarmsHubPublisher` (which re-broadcasts every
+message to the `__alarms__` group) and by the `/alarms` page in process. An `AlarmFeedMessage`
+carries no session id and no owning API key, so there is nothing for the per-session tag
+intersection to intersect — a tag ACL cannot be applied to it without inventing provenance the
+feed does not have. Deriving a filter from the caller's tags would also mean equating a
+visibility tag with an alarm-reference prefix, which `GroupToTag` deliberately does not do
+(tags are visibility labels, never data-access constraints).
+
+So **alarm metadata stays galaxy-wide for every authenticated dashboard Viewer**: alarm
+reference (a full tag path), state, severity, priority, category, area, and acknowledging
+operator are all visible to any real dashboard role, regardless of which sessions their tag
+grant covers. Alarm *values* (`current_value` / `limit_value`) are still stripped when
+`Dashboard:ShowTagValues` is false (the default), on the hub seam as on the events seam.
+
+What SEC-40 tightened is the entry gate rather than the scope. Both readers of the monitor —
+`AlarmsHub` and the `/alarms` page — carry `MxGateway.Dashboard.Alarms`, whose requirement type
+the environment-bypass handler does not handle. Consequences:
+
+- `MxGateway:Authentication:Mode = Disabled` and anonymous localhost (`AllowAnonymousLocalhost`,
+  default `true`) **no longer receive the alarm feed at all**. They keep read-only access to every
+  other dashboard page; `/alarms` and `/hubs/alarms` deny, and the side rail hides the Alarms link
+  rather than offering a dead end.
+- `Dashboard:DisableLogin` auto-login is unaffected: it mints a genuinely authenticated principal
+  holding both roles, so it satisfies the policy like any signed-in user.
+- Gating only the hub was rejected: the page reads the same monitor in process, so the disclosure
+  would have been one navigation away.
+
+Operators who *want* the alarm feed on an unauthenticated local console must sign in (or, in a dev
+environment, set `Dashboard:DisableLogin=true`); there is deliberately no config flag that re-opens
+the feed to the bypasses.
+
 ### DisableLogin dev bypass
 
 `MxGateway:Dashboard:DisableLogin` (default `false`) is a third bypass for
@@ -824,13 +900,16 @@ the deliberate mitigation: it bounds that exposure window without the cost of a
 revocation store. It now bounds a stale *tag* grant the same way: the token carries
 the tags resolved from the caller's LDAP groups at mint time, so removing a
 `GroupToTag` entry takes effect for token-authenticated hub connections within one
-lifetime. That 5-minute staleness bound covers token-authenticated connections only:
-a cookie principal carries the `zb:dashboardtag` claims stamped at login for the
-cookie's whole life, so for cookie-authenticated (in-process page) subscriptions a
-revoked `GroupToTag` grant takes effect at the user's next login, not within five
-minutes. That is where the per-session ACL's revocation need landed — a jti
-denylist stays deferred, since the short lifetime already bounds every grant the
-token carries.
+lifetime. Since SEC-41 the cookie seam is no longer the weaker one: the ACL
+re-resolves a cookie principal's grant from its group claims against current
+options on every subscribe, so a `GroupToTag` edit takes effect on both seams at
+the next subscribe after the restart that rebinds options — the stamped
+`zb:dashboardtag` claims are consulted only for a principal with no group claims
+to re-resolve from, i.e. the hub-token principal itself. What the token's lifetime
+still bounds uniquely is a stale **role** set and a stale LDAP **group** list, since
+both are copied into the payload at mint. See the revocation-bounds table under
+"Authentication And Authorization". A jti denylist stays deferred — the short
+lifetime already bounds every claim the token carries.
 
 ## Configuration
 

docs/GatewayProcessDesign.md

@@ -593,9 +593,19 @@ Pending command handling:
 Timeouts should not assume the COM call stopped. A timed-out command may still
 finish inside the worker.
 
-On timeout the client also forwards a `WorkerCancel` carrying the abandoned
-correlation id, best-effort: the gateway has stopped waiting, but the worker has
-not stopped working, and the worker owns a single STA. `WorkerPipeSession` routes
+On timeout **and on caller cancellation** the client also forwards a
+`WorkerCancel` carrying the abandoned correlation id, best-effort: the gateway
+has stopped waiting, but the worker has not stopped working, and the worker owns
+a single STA. Caller cancellation — a per-call deadline shorter than the
+gateway's command timeout, or a client disconnect cancelling the RPC's token — is
+the more common of the two paths, and under a retry storm it is exactly the
+backlog the cancel exists to shorten, so both arms send it; the pending command
+is failed as `CallerCancelled` rather than `GatewayShutdown` so metrics and logs
+name the real cause (both still map to gRPC `Cancelled`). The send is gated on
+the same ownership check as the timeout arm — only the arm that removed the
+pending entry sends, so a reply that won the race is never chased — and is
+skipped when the client's own stop token has fired, since the outbound channel is
+being completed and every pending command is failed anyway. `WorkerPipeSession` routes
 the cancel to `CancelCommand`, which drops the correlation from the STA queue if
 it has not started and replies `Canceled` for it. A cancel that arrives after the
 command reached MXAccess is a no-op — there is no way to abort an in-flight COM
@@ -606,9 +616,10 @@ the worker reads the command and then its cancel and drops it before execution.
 
 Cancels ride the same outbound channel as commands, whose capacity is
 `MaxPendingCommands + 4`: the reserve above the pending-command limit is what
-absorbs them, so a burst of timeouts stays bounded and cannot deadlock the
-enqueue path. Failing to send the cancel is logged at debug and never replaces
-the `CommandTimeout` the caller is owed.
+absorbs them, so a burst of timeouts or cancellations stays bounded and cannot
+deadlock the enqueue path. Failing to send the cancel is logged at debug and
+never replaces the `CommandTimeout` — or the `OperationCanceledException` — the
+caller is owed.
 
 Cancellation outranks the deadline. When a caller's token is canceled around the
 same time the timeout fires, the command is reported as canceled

docs/GatewayTesting.md

@@ -116,7 +116,7 @@ Optional live smoke variables:
 | `MXGATEWAY_LIVE_MXACCESS_CLIENT_NAME` | `ZB.MOM.WW.MxGateway.IntegrationTests` | Client name passed to `Register`. |
 | `MXGATEWAY_LIVE_MXACCESS_EVENT_TIMEOUT_SECONDS` | `15` | Maximum wait for the first `OnDataChange` (also used for the `OnWriteComplete` round-trip and the abnormal-exit fault transition). |
 | `MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_USER` | `admin` | ArchestrA user name passed to `AuthenticateUser` before the `WriteSecured` parity step. |
-| `MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_PASSWORD` | `admin123` | Password paired with the user above. Never logged; the test asserts the value does not appear in the WriteSecured diagnostic message. |
+| `MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_PASSWORD` | `password` | Password paired with the user above (matches the shared GLAuth `admin` user's dev password — see `glauth.md`). Never logged; the test asserts the value does not appear in the WriteSecured diagnostic message. |
 
 The test output includes session id, worker process id, command status,
 HRESULT/status diagnostics, event sequence and handles, close status, and worker
@@ -650,11 +650,13 @@ runtime because the x86 Worker cannot build on Linux:
   the tier is down, not the change**: an unreachable windev fails the job (never skips), so
   if it goes red without a related code change, check the tier — `ssh windev`, read
   `C:\build\mxaccessgw-ci\ci.log` — before assuming a real test failure.
-- **`nightly-windev`** (Linux runner, scheduled `0 6 * * *`) — re-runs the full x86 build +
-  Worker.Tests on windev, then the live-MXAccess smoke (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`)
-  and a full `slnx` build (which surfaces Windows-only analyzer diagnostics such as
-  `xUnit1030`). Gated `if: github.event_name == 'schedule'`, so it never gates a push. On
-  failure it opens a Gitea issue via the Actions token, since nobody watches the Actions page.
+- **`nightly-windev`** (Linux runner, scheduled `0 6 * * *`) — runs, in order, the x86 Worker
+  build, `Worker.Tests`, a full `slnx` build (which surfaces Windows-only analyzer diagnostics
+  such as `xUnit1030`), the net10 gateway suite, and the live-MXAccess smoke
+  (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`). The checkout and all five tiers share the windev
+  host lock, and the first nonzero native exit stops the sequence and propagates to the CI job.
+  Gated `if: github.event_name == 'schedule'`, so it never gates a push. On failure it opens a
+  Gitea issue via the Actions token, since nobody watches the Actions page.
 
 ### Runner capacity is shared and finite
 

docs/Grpc.md

@@ -84,6 +84,12 @@ Carrying the enqueue timestamp into the worker layer is what lets queue-wait tim
 
 An accepted gRPC command payload can still be too large for the worker pipe: the envelope built around it must fit `MxGateway:Worker:MaxMessageBytes`, which is validated at startup to sit at least a fixed envelope-overhead reserve above `MaxGrpcMessageBytes` (see the headroom rule in [Gateway Configuration](./GatewayConfiguration.md)) so this should not occur for a conformant payload, but if it does, `WorkerClient` raises `WorkerClientException(CommandTooLarge)` and `Invoke` reports `ResourceExhausted` for that command — the session is not faulted, so a client can retry with a smaller payload without reopening the session.
 
+Selected control commands have additional public behavior beyond their protobuf shape:
+
+| Command | Public behavior |
+|---|---|
+| `DrainEvents` | Returns a destructive diagnostic snapshot of the worker's outbound event queue. `max_events = 0` selects the default cap; positive values may not exceed `GatewayContractInfo.MaxDrainEventsPerCommand` (10,000). The worker also applies a serialized-byte budget derived from the negotiated frame limit, so a reply may contain fewer events than the requested count. When either cap leaves queued events, `MxCommandReply.diagnostic_message` reports the truncation and callers repeat `DrainEvents` until an empty reply. Events included in a drain are removed from the worker queue and therefore do not later appear on the normal session `StreamEvents` path; the background stream drain may concurrently consume other events first. |
+
 ### `StreamEvents`
 
 `StreamEvents` is a server-streaming RPC. The handler delegates the full pipeline to `IEventStreamService` and just forwards each `MxEvent` onto the response stream. Keeping the channel and producer/consumer machinery out of the handler means cancellation, exception mapping, and metric bookkeeping live in one place.
@@ -100,7 +106,7 @@ An `OK` response means the alarm provider accepted the acknowledgement, not that
 
 ### `QueryActiveAlarms`
 
-`QueryActiveAlarms` is a server-streaming, **session-less** RPC that returns a point-in-time snapshot of the currently-active alarm set. Unlike `StreamAlarms`, it does not stay attached for live transitions — it writes the snapshot and completes, which clients use after a reconnect to reseed alarm state or to reconcile alarms that may have been missed during a transport blip. It is served from the always-on `GatewayAlarmMonitor` cache (`IGatewayAlarmService.CurrentAlarms`), so no worker session is opened. The handler does not run through `MxAccessGrpcRequestValidator`; it only null-checks the request inline, then streams one `ActiveAlarmSnapshot` per cached alarm, honouring cancellation between writes. When `alarm_filter_prefix` is non-empty, only alarms whose `alarm_full_reference` starts with that prefix (ordinal `StartsWith`) are emitted; an empty prefix returns the full set. Exceptions are translated by the same `MapException` path as the other handlers. The RPC requires the `event` scope (`GatewayScopes.EventsRead`), the same scope as `StreamEvents` and `StreamAlarms`.
+`QueryActiveAlarms` is a server-streaming, **session-less** RPC that returns a point-in-time snapshot of the currently-active alarm set. Unlike `StreamAlarms`, it does not stay attached for live transitions — it writes the snapshot and completes, which clients use after a reconnect to reseed alarm state or to reconcile alarms that may have been missed during a transport blip. It is served from the always-on `GatewayAlarmMonitor` cache (`IGatewayAlarmService.CurrentAlarms`), so no worker session is opened. The handler does not run through `MxAccessGrpcRequestValidator`; it only null-checks the request inline, then streams one `ActiveAlarmSnapshot` per cached alarm, honouring cancellation between writes. When `alarm_filter_prefix` is non-empty, only alarms whose `alarm_full_reference` starts with that prefix (ordinal `StartsWith`) are emitted; an empty prefix returns the full set. Exceptions are translated by the same `MapException` path as the other handlers. The RPC requires the `events:read` scope (`GatewayScopes.EventsRead`), the same scope as `StreamEvents` and `StreamAlarms`.
 
 #### Provider status on the alarm feed
 
@@ -282,7 +288,7 @@ StatusCode statusCode = exception.ErrorCode switch
 };
 ```
 
-`WorkerClientException` follows the same pattern: `CommandTimeout` becomes `DeadlineExceeded`, `GatewayShutdown` becomes `Cancelled`, `InvalidState` becomes `FailedPrecondition`, `ProtocolViolation` becomes `Internal`, `CommandTooLarge` becomes `ResourceExhausted`, and unmapped codes fall through to `Unavailable`.
+`WorkerClientException` follows the same pattern: `CommandTimeout` becomes `DeadlineExceeded`, `GatewayShutdown` and `CallerCancelled` both become `Cancelled`, `InvalidState` becomes `FailedPrecondition`, `ProtocolViolation` becomes `Internal`, `CommandTooLarge` becomes `ResourceExhausted`, and unmapped codes fall through to `Unavailable`. `CallerCancelled` is the caller's own token firing — a per-call deadline shorter than the gateway command timeout, or a disconnect — and is separate from `GatewayShutdown` only so metrics and logs stop attributing those calls to a shutdown that did not happen; the status the client observes is the same.
 
 ## Event Streaming Model
 

docs/Metrics.md

@@ -72,7 +72,7 @@ Observable gauges are pull-based; the `Meter` invokes the supplied callback when
 |------------|--------------|-------------|
 | `mxgateway.sessions.open` | `_openSessions` | Currently open sessions tracked by `SessionManager`. |
 | `mxgateway.workers.running` | `_workersRunning` | Worker clients in a running state. |
-| `mxgateway.events.worker_queue.depth` | `_workerEventQueueDepthSources` (summed on demand) | Undelivered worker events held by `WorkerClient` — staged *and* queued (GWC-24) — summed across every live client at collection time (GWC-30). Each client owns an interlocked counter incremented when the read loop stages an event and decremented when the consumer reads it, and registers it as a gauge source for its lifetime, so a backlog stuck in a staging channel is visible and concurrent sessions add up instead of overwriting one another. |
+| `mxgateway.events.worker_queue.depth` | `_workerEventQueueDepthSources` (summed on demand) | Undelivered worker events held by `WorkerClient` — staged *and* queued (GWC-24) — summed across every live client at collection time (PERF-02). Each client owns an interlocked counter incremented when the read loop stages an event and decremented when the consumer reads it, and registers it as a gauge source for its lifetime, so a backlog stuck in a staging channel is visible and concurrent sessions add up instead of overwriting one another. |
 | `mxgateway.events.grpc_stream_queue.depth` | `_eventStreamBacklogSources` (summed on demand) | Live backlog buffered across every active `EventStreamService` subscriber, summed from the subscribers' channel `Count` at collection time. |
 
 ## Snapshot Shape
@@ -111,7 +111,7 @@ The scalar fields mirror the counters and gauges. The four dictionaries provide
 - `EventsBySession` keys by `sessionId`; entries are removed via `RemoveSessionEvents` when a session closes so the map does not grow without bound.
 - `RetryAttemptsByArea` keys by the resilience `area` tag, e.g. `worker_startup`.
 
-`EventsReceived` is read with `Interlocked.Read(ref _eventsReceived)` because `EventReceived` increments it via `Interlocked.Increment` outside the lock to keep the event-ingestion path non-blocking. `CommandsStarted`, `CommandsSucceeded`, `CommandsFailed`, and `CommandFailuresByMethod` are read the same way: the command counters run two-to-three times per gRPC call, so they are recorded with `Interlocked` and a `ConcurrentDictionary` rather than under `_syncRoot` (GWC-30). The two queue depths are pulled from their registered sources before the lock is taken, since those delegates reach into subscriber channels and worker clients.
+`EventsReceived` is read with `Interlocked.Read(ref _eventsReceived)` because `EventReceived` increments it via `Interlocked.Increment` outside the lock to keep the event-ingestion path non-blocking. `CommandsStarted`, `CommandsSucceeded`, `CommandsFailed`, and `CommandFailuresByMethod` are read the same way: the command counters run two-to-three times per gRPC call, so they are recorded with `Interlocked` and a `ConcurrentDictionary` rather than under `_syncRoot` (PERF-02). The two queue depths are pulled from their registered sources before the lock is taken, since those delegates reach into subscriber channels and worker clients.
 
 ## Recording Sites
 

docs/MxAccessWorkerInstanceDesign.md

@@ -90,13 +90,22 @@ Expected command-line arguments:
 --protocol-version <version>
 ```
 
-Expected protected environment values:
+Expected launch environment values (the shared names are defined by
+`WorkerLaunchEnvironment` in Contracts):
 
 ```text
 MXGATEWAY_WORKER_NONCE=<random nonce>
-MXGATEWAY_WORKER_LOG_CONTEXT=<optional context>
+MXGATEWAY_WORKER_PIPE_CONNECT_ATTEMPT_TIMEOUT_MS=<milliseconds>
+MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS=<milliseconds>
+MXGATEWAY_EVENT_QUEUE_CAPACITY=<events>
+MXGATEWAY_ALARM_POLL_INTERVAL_MS=<milliseconds>
+MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH=<alarms>
 ```
 
+The nonce is protected bootstrap material. The remaining values are derived
+from the public `MxGateway:Worker:*` and `MxGateway:Alarms:*` configuration
+keys documented in [Worker Process Launcher](./WorkerProcessLauncher.md).
+
 Startup sequence:
 
 1. Parse command-line arguments.
@@ -312,11 +321,48 @@ write wait still yields the empty-`statuses` unconfirmed reply, and an expired
 per-tag `ReadBulk` wait still reports its own timeout.
 
 The write wait's budget is `MxGateway:Worker:WriteCompletionWaitMilliseconds`
-(default 1500). It is a bounded hold on the STA per unary write, so deployments
+(default 1500). It applies to `Write`, `Write2`, `WriteSecured`, and
+`WriteSecured2` and is a bounded hold on the STA per single-item write, so deployments
 whose write workload is effectively fire-and-forget — no consumer reads the
 reply's `statuses` — can lower it, or set `0` to skip the wait entirely and
 reply on acceptance alone.
 
+**Write-completion correlation is recency-based, not per-call.** MXAccess's
+`OnWriteComplete` callback carries no correlation token — only the server/item
+handle pair — so `MxAccessCommandExecutor` correlates a completion to a write
+by *version*: it snapshots `MxAccessWriteCompletionCache.CurrentVersion` for
+the handle as a baseline before the COM call, then reports the first
+completion whose version exceeds that baseline as the write's outcome
+(`AwaitWriteCompletion`). This is exact for the common case, but if an earlier
+write to the same handle times out unconfirmed — its `OnWriteComplete` still
+undelivered when the wait gives up — and the caller immediately issues another
+write to the same tag, the stale callback can dispatch during the second
+write's pump-wait and be reported as *its* outcome. The executor mitigates the
+most common instance of this (`CaptureCompletionBaseline`) by running one
+`pumpStep()` immediately before capturing the baseline, so a completion already
+queued for the handle folds into the baseline instead of being available to
+ride the next write's reply; this closes the gap for a callback that arrived
+before the new write started, but a callback that MXAccess queues after that
+pump step and before the COM call returns (or during the wait itself) is still
+indistinguishable from the new write's own completion. Full closure is not
+possible without an MXAccess-side correlation token, which does not exist —
+this is a property of the COM surface, not a gap this worker introduced (a
+native client correlating by handle has the identical ambiguity). The exposure
+is bounded: `statuses` is an enrichment field, and `Hresult`/`ProtocolStatus`
+stay acceptance-only regardless of which completion (if any) was attributed.
+
+## Live alarm watch-list replacement
+
+An auto-mode `SubscribeAlarms` with `fallback_enabled = true` always builds a
+`FailoverAlarmConsumer`, even when initial discovery supplied no targets. The
+handler retains the subscription expression so `UpdateAlarmWatchList` can build
+and subscribe a new subtag consumer entirely on the session STA. The failover
+consumer attaches the replacement's transition callback before swapping the
+standby reference, then detaches and disposes the old standby. If construction,
+subscription, or attachment fails, it disposes the replacement and preserves
+the old standby. The active-provider selector is never reset, so primary mode
+stays primary and subtag mode immediately delegates to the new standby.
+
 ## COM Creation
 
 The MXAccess analysis source at `C:\Users\dohertj2\Desktop\mxaccess` identifies

docs/Sessions.md

@@ -213,6 +213,8 @@ The repair transitions the monitor's reconcile broadcasts on the alarm feed (Rai
 
 `AttachInternalEventSubscriber` enforces the same readiness gate as `AttachEventSubscriber` — a session (or worker) that is not `Ready` throws `SessionNotReady` *before* the distributor is constructed. A premature attach would otherwise start the pump against a source that throws, completing every subscriber with that error and latching the distributor for the session's whole lifetime.
 
+The same one-distributor-per-session rule is enforced at the other end of the lifecycle. Session disposal disposes the distributor and latches the fact, so an attach that passed its readiness gate and then lost the CPU until the session was torn down throws `SessionNotReady` rather than constructing a replacement distributor. A replacement can never be pumped — the pump-start flag is a one-way latch — so its subscriber would block on an empty channel that is never completed until the client's own deadline expired, with no error, log or metric to explain it. Every attach entry point (`AttachEventSubscriber`, `AttachEventSubscriberWithReplay`, `AttachInternalEventSubscriber`) fails this way, and each rolls back the subscriber-count slot it took, so a caller that loses the race to teardown sees the same failure it would have seen a moment later from the readiness gate.
+
 Sessions open with `MxGateway:Sessions:DefaultLeaseSeconds` (default 1800) added to the open timestamp. Unary client activity refreshes the lease by the same duration. `ExtendLease` and `IsLeaseExpired` cooperate with `SessionManager.CloseExpiredLeasesAsync`, which iterates a registry snapshot and closes any session whose lease has expired with `LeaseExpiredReason`. `SessionLeaseMonitorHostedService` runs that sweep every `MxGateway:Sessions:LeaseSweepIntervalSeconds` seconds (default 30).
 
 #### Teardown parallelism
@@ -245,7 +247,7 @@ A session that faults (for example, a slow single-subscriber client that overflo
 
 A client that drops mid-stream reconnects by re-issuing `StreamEvents` with `StreamEventsRequest.after_worker_sequence` set to the last `worker_sequence` it observed. A non-zero `after_worker_sequence` means *resume*; `0` means *fresh stream* and behaves exactly as a first-time subscribe — no replay, no sentinel.
 
-**Owner-scoped attach (security control).** `OpenSession` records the caller's API key id on the session as `GatewaySession.OwnerKeyId`. Every `StreamEvents` attach and reattach is owner-checked: `EventStreamService.StreamEventsAsync` compares the caller's key id (threaded from `GatewayGrpcAuthorizationInterceptor` via `MxAccessGatewayService.StreamEvents`) to the session owner and throws `SessionManagerException(PermissionDenied)` — surfaced as gRPC `PermissionDenied` — when they differ, before any subscriber is attached and before any replayed or live event is delivered. Possessing the `event` scope and knowing a session id is not enough. This is what makes the default-on detach-grace and replay-retention windows safe: without the check, any `event`-scoped key that learned a session id could attach to another key's retained session and receive its replayed and live data. A `null` owner (session opened with authentication disabled) matches only a `null` caller key.
+**Owner-scoped attach (security control).** `OpenSession` records the caller's API key id on the session as `GatewaySession.OwnerKeyId`. Every `StreamEvents` attach and reattach is owner-checked: `EventStreamService.StreamEventsAsync` compares the caller's key id (threaded from `GatewayGrpcAuthorizationInterceptor` via `MxAccessGatewayService.StreamEvents`) to the session owner and throws `SessionManagerException(PermissionDenied)` — surfaced as gRPC `PermissionDenied` — when they differ, before any subscriber is attached and before any replayed or live event is delivered. Possessing the `events:read` scope and knowing a session id is not enough. This is what makes the default-on detach-grace and replay-retention windows safe: without the check, any `events:read`-scoped key that learned a session id could attach to another key's retained session and receive its replayed and live data. A `null` owner (session opened with authentication disabled) matches only a `null` caller key.
 
 On a resume, `EventStreamService.StreamEventsAsync` attaches through `GatewaySession.AttachEventSubscriberWithReplay`, which calls `SessionEventDistributor.RegisterWithReplay`. That method snapshots the session's replay ring for events newer than `after_worker_sequence` **and** registers the live subscriber inside a single `_replayLock` critical section. This atomicity is what makes the replay→live handoff free of gaps and duplicates: the pump appends each event to the replay ring (under `_replayLock`) before fanning it to subscriber channels, so relative to that one critical section every event is either in the replay snapshot or fanned into the freshly-registered live channel — never both observably, never neither.
 

docs/WorkerProcessLauncher.md

@@ -26,6 +26,23 @@ The launcher sets the nonce through the `MXGATEWAY_WORKER_NONCE` environment
 variable. The nonce is not included in `WorkerProcessCommandLine` so logs and
 diagnostics can report the launch command without exposing the secret.
 
+All launch-variable names live in the shared Contracts
+`WorkerLaunchEnvironment` class and are consumed by both the launcher and the
+worker. The launcher always exports all six values:
+
+| Environment variable | Gateway source | Worker default when missing/invalid |
+|---|---|---|
+| `MXGATEWAY_WORKER_NONCE` | `WorkerProcessLaunchRequest.Nonce` | None; bootstrap fails because the nonce is required |
+| `MXGATEWAY_WORKER_PIPE_CONNECT_ATTEMPT_TIMEOUT_MS` | `MxGateway:Worker:PipeConnectAttemptTimeoutMilliseconds` | `2000` ms |
+| `MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS` | `MxGateway:Worker:WriteCompletionWaitMilliseconds` | `1500` ms |
+| `MXGATEWAY_EVENT_QUEUE_CAPACITY` | `MxGateway:Worker:EventQueueCapacity` | `10000` events |
+| `MXGATEWAY_ALARM_POLL_INTERVAL_MS` | `MxGateway:Alarms:PollIntervalMilliseconds` | `500` ms |
+| `MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH` | `MxGateway:Alarms:MaxAlarmsPerFetch` | `1024` alarms |
+
+The write-completion wait applies to the four single-item write variants:
+`Write`, `Write2`, `WriteSecured`, and `WriteSecured2`. Bulk writes report COM
+acceptance per entry and do not wait for `OnWriteComplete` rows.
+
 ## Validation And Cleanup
 
 Before starting the process, the launcher validates that the configured worker
@@ -44,11 +61,8 @@ process remains alive. The policy is configured by
 `WorkerOptions.StartupProbeRetryDelayMilliseconds`; the retry counter is
 recorded as `mxgateway.retries.attempted` with `area=worker_startup`.
 
-The launcher also passes
-`MXGATEWAY_WORKER_PIPE_CONNECT_ATTEMPT_TIMEOUT_MS` to the worker process from
-`WorkerOptions.PipeConnectAttemptTimeoutMilliseconds`. The worker uses that
-value as the per-attempt named-pipe connect timeout inside its own bounded
-Polly retry loop.
+The worker uses the exported pipe-attempt value inside its own bounded Polly
+retry loop.
 
 If startup fails or exceeds `WorkerOptions.StartupTimeoutSeconds`, the launcher
 kills the worker process tree, disposes the process handle, disposes the

docs/plans/2026-08-15-deferred-remediation.md

@@ -241,7 +241,7 @@ Run `dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx` (expect 0 warnings) a
 - Modify: `src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerPipeSessionTests.cs`
 - Modify: `src/ZB.MOM.WW.MxGateway.Worker/Ipc/WorkerFrameReader.cs` (comment only)
 
-**Why:** On net48, `NamedPipeClientStream.ReadAsync` ignores its `CancellationToken` (`WorkerFrameReader.cs:109-111`). Fault-path exits (event-drain fault, oversized event, watchdog, heartbeat write failure) leave `readTask` pending; it is unblocked only when `WorkerPipeClient`'s `using` disposes the pipe, at which point it faults with `ObjectDisposedException`/`IOException` on a Task nobody observes (the finally at `:303-309` awaits only heartbeat and drain). The frame-pooling change (GWC-30) makes this sharper: the abandoned read owns the per-instance `_lengthPrefix` buffer and possibly a rented ArrayPool payload — the reader's single-consumer invariant holds today only because nothing ever reads again after abandonment.
+**Why:** On net48, `NamedPipeClientStream.ReadAsync` ignores its `CancellationToken` (`WorkerFrameReader.cs:109-111`). Fault-path exits (event-drain fault, oversized event, watchdog, heartbeat write failure) leave `readTask` pending; it is unblocked only when `WorkerPipeClient`'s `using` disposes the pipe, at which point it faults with `ObjectDisposedException`/`IOException` on a Task nobody observes (the finally at `:303-309` awaits only heartbeat and drain). The frame-pooling change (PERF-22) makes this sharper: the abandoned read owns the per-instance `_lengthPrefix` buffer and possibly a rented ArrayPool payload — the reader's single-consumer invariant holds today only because nothing ever reads again after abandonment.
 
 **Spec — constraints, implementer designs within them:**
 1. **No unobserved faulted Task.** After the stream is disposed, `readTask`'s fault must be awaited/observed (reuse `ObserveBackgroundTaskStopAsync`'s timeout-and-log shape, `:312-348`) before `WorkerPipeClient.RunAsync` returns.

docs/plans/2026-08-15-perf-review-remediation.md

@@ -608,6 +608,24 @@ Commit anything found: `docs: remediation plan doc sweep`
 
 ---
 
+## PERF-ID register
+
+This plan's tasks were cited in code comments and test names as `GWC-30`/`GWC-31` before
+those labels were recognized as colliding with the `archreview` finding register — see
+cycle-3 finding `GWC-31` (`archreview/2026-08-19/10-gateway-core.md`). The comments were
+swept to the `PERF-nn` prefix below (`nn` = this doc's task number); `GWC-30`/`GWC-31` no
+longer appear in perf-pass comments. Citations of the *genuine* archreview `GWC-30`
+("Frame reader still allocates a fresh 4-byte prefix array per frame",
+`archreview/2026-07-12/10-gateway-core.md`) — the gateway-side
+`Server/Workers/WorkerFrameReader.cs` fix and its test — were left untouched; they refer
+to a real register entry, not this plan.
+
+| PERF-ID | Task | Files |
+|---|---|---|
+| PERF-02 | Task 2 — Metrics: pull-gauge for worker queue depth, lock-free command counters | `Server/Workers/WorkerClient.cs` (`:44`, `:355`), `Server/Metrics/GatewayMetrics.cs` (`:46`, `:213`, `:284`, `:463`, `:524`), `Tests/Metrics/GatewayMetricsTests.cs` (`:22`, `:61`), `docs/Metrics.md` |
+| PERF-07 | Task 7 — WorkerClient: pooled-timer timeout, single sizing pass, `WorkerCancel` on timeout | `Server/Workers/WorkerClient.cs` (`:236`, `:253`), `Tests/Gateway/Workers/WorkerClientTests.cs` (`:163`, `:179`) |
+| PERF-22 | Task 22 — Worker frame writer/reader: pooled buffers | `Worker/Ipc/WorkerFrameReader.cs` (`:23`), `Worker/Ipc/WorkerFrameWriter.cs` (`:671`), `docs/plans/2026-08-15-deferred-remediation.md` (Task cross-reference) |
+
 ## Explicitly deferred (decided, not forgotten)
 
 | Finding | Why deferred |

docs/plans/2026-08-25-cycle-3-p2-followups-design.md

@@ -0,0 +1,119 @@
+# Cycle 3 P2 And Follow-Up Design
+
+**Date:** 2026-08-25
+
+**Source:** `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Scope:** The 17 findings recorded as deferred P2 plus the three follow-ups recorded by the cycle-3 integration gate. `SEC-37` and `TST-32` remain external actions and are not part of this repository change.
+
+## Current-State Reconciliation
+
+The 2026-08-25 audit refreshed `origin/main` and checked every finding against the current tree. Sixteen P2 findings remain open. `WRK-34` is already complete in commit `3679e59` and needs a tracker correction rather than another code change. All three integration-gate follow-ups remain open:
+
+- a live worker command and gateway path for refreshing an alarm subscription's subtag watch-list;
+- the full WRK-32 recency limitation in the public reply-field comment;
+- publication of the already-bumped client release train.
+
+## Design Principles
+
+1. Preserve the existing worker STA and COM-affinity rules. Worker alarm-consumer construction, subscription changes, and disposal remain on the STA.
+2. Preserve the primary alarm-manager subscription during watch-list repair. A refresh must never unsubscribe and recreate the whole alarm feed.
+3. Make behavioral changes test-first and keep documentation in the same commit as the behavior it describes.
+4. Perform one protobuf regeneration wave for the watch-list command, the WRK-32 reply-field clarification, and the IPC-36 operator-facing comment correction.
+5. Publish clients only after every client-affecting change is integrated, all five client suites pass, the release commit is on `main`, and registry collision checks pass.
+6. Keep the canonical archreview tracker current at every batch boundary, including commit IDs and verification counts.
+
+## Workstreams
+
+### 1. Tracker And Low-Risk Currency
+
+Correct WRK-34 to Done, repair the stale replay-watermark documentation (GWC-36), document the public `DrainEvents` command (IPC-38), reconcile `stillpending.md` (TST-33), wire the code-review README check into portable CI (TST-34), and replace the nonexistent `event` scope spelling with `events:read` (TST-36).
+
+These edits form the first batch because they have a small conflict surface and establish an accurate tracker before code changes begin.
+
+### 2. Gateway Correctness And Security
+
+- **GWC-33:** stop faulted or closed worker clients from contributing frozen queue depth while retaining fault records for the configured grace period.
+- **GWC-35:** make snapshot reconciliation emit a Raise when a cached acknowledged alarm is replaced by an active unacknowledged instance.
+- **SEC-38:** consult and feed the cross-peer aggregate for every validly-shaped key ID, even when the per-peer key-partition cap routes the request through the fallback bucket. Aggregate cardinality remains bounded by the aggregate cache's existing eviction policy.
+- **SEC-39:** never let a null effective key ID clear the shared fallback partition.
+
+Each change gets a focused regression test that first reproduces the filed failure mode.
+
+### 3. Secondary Contracts
+
+- **IPC-36:** move all six worker-launch environment-variable names into one net48-safe Contracts class, consume those constants on both sides, enumerate the launch contract in the launcher and worker design documentation, and test that the launcher sets every declared variable.
+- **IPC-37:** compare the retained gateway Galaxy descriptor with the descriptor served by the shared `ZB.MOM.WW.GalaxyRepository` package after normalizing source-only metadata.
+
+This work makes the two non-protobuf peer contracts executable invariants rather than comments.
+
+### 4. Client Alarm-Feed Parity
+
+- **CLI-47:** explicitly render false-valued provider and snapshot status fields in .NET text output; document the deliberate protobuf-JSON omission behavior and Rust's explicit JSON shape.
+- **CLI-48:** add provider-status and clearing snapshot-status coverage in .NET, Go, and Java, including Go's missing `stream-alarms` test scaffold.
+- **CLI-49:** expose the two Go status payload aliases and update the alarm-feed alias documentation.
+- **CLI-50:** change Python `stream-alarms` from a one-message buffered sample to incremental streaming with an unbounded-by-default limit, while retaining timeout and explicit finite-limit behavior.
+
+The Python change uses the same arrival-order streaming model as the other four CLIs. Documentation examples will request a finite bound when a bounded demonstration is desirable.
+
+### 5. Live Alarm Watch-List Refresh
+
+The complete periodic hot-swap design is selected over failover-edge-only refresh and unsubscribe/resubscribe.
+
+#### Contract
+
+Add an explicit worker command for updating an active alarm subscription's watch-list. Add an explicit subscription flag that distinguishes these cases when the initial list is empty:
+
+- alarm-manager-only deployment with no fallback requested;
+- auto fallback configured, but discovery currently produced no targets.
+
+The command is gateway-owned even though it travels through the shared `MxCommand` envelope. It returns a normal `MxCommandReply`; invalid mode/state or replacement-subscription failure returns a structured failure without destroying the existing subscription.
+
+#### Worker
+
+In auto mode, retain a failover composite even when fallback is enabled with an initially empty list. The composite retains its subscription expression and supports replacing its standby consumer on the STA:
+
+1. construct the replacement standby;
+2. subscribe and warm it before altering the current child;
+3. attach transition forwarding;
+4. atomically replace the standby reference;
+5. dispose the previous standby;
+6. if standby is currently active, keep the mode on subtag and expose the replacement snapshot immediately.
+
+If any pre-swap step fails, dispose the replacement and keep the old standby untouched. Forced alarm-manager mode rejects refresh as inapplicable. Forced subtag mode may replace its sole consumer through the same build-first/swap-second rule.
+
+#### Gateway
+
+Reuse the existing alarm reconciliation cadence; do not add another timer or configuration option. Resolve only when fallback can use subtags. Compare a canonical target fingerprint with the list last acknowledged by the worker, and send an update only after material change or recovery from an empty/failed resolution.
+
+The failover edge still performs an immediate refresh attempt before publishing its coverage verdict. A successful update changes the recorded sent fingerprint, clears stale-coverage status, and triggers reconciliation. A failed update retains the previous fingerprint and publishes/logs the degraded reason.
+
+This design repairs the original startup-outage case before failover whenever Galaxy Repository recovers during normal monitor operation, while preserving the warm primary and current provider mode.
+
+### 6. Windows Gateway Coverage
+
+**TST-35** extends windev `live` mode to run the net10 gateway suite after the serialized Worker tier and full solution build. The existing host lock remains the load-sensitivity control. Logs record the observed count rather than hard-coding the historical 879 or 1183 count as an invariant.
+
+### 7. Protobuf Regeneration And Release
+
+The watch-list command lands in the same regeneration wave as:
+
+- WRK-32's explicit sequential stale-callback/recency limitation;
+- IPC-36's replacement of the internal environment-variable name with the public configuration key.
+
+Regenerate Contracts and all five client trees according to `docs/Contracts.md` and `docs/ClientPackaging.md`, then run the codegen cleanliness checks and every affected suite.
+
+After integration to `main`, publish .NET/Contracts, Python, Rust, and Go as `0.2.1`, and Java as `0.2.2`. Query each exact coordinate before publishing, never overwrite, create and push the Go module tag at the exact release commit, then query every registry coordinate again and update the packaging record and tracker with immutable release evidence.
+
+## Verification Strategy
+
+- macOS: clean `NonWindows.slnx` build and full gateway suite.
+- Focused gateway tests after each behavioral batch.
+- All five client build/test commands from `docs/ClientPackaging.md`.
+- `scripts/check-codegen.ps1`, client-version guard, and code-review README check.
+- windev: x86 Worker build plus Worker.Tests for worker/proto changes; `live` mode for TST-35 and the final integration gate.
+- Release: exact registry-coordinate checks and Go module resolution from the pushed tag.
+
+## Completion Criteria
+
+The continuation is complete only when all 16 open P2 findings and all three follow-ups are Done or explicitly blocked with evidence, WRK-34 is corrected in the tracker, every required verification is green, client releases are confirmed at their registries, and `archreview/2026-08-19/remediation/00-tracking.md` contains the commit and test evidence for every batch.

docs/plans/2026-08-25-cycle-3-p2-followups.md

@@ -0,0 +1,405 @@
+# Cycle 3 P2 And Follow-Up Implementation Plan
+
+> **For Codex:** REQUIRED SUB-SKILL: Use `executeplan` to implement this plan task-by-task.
+
+**Goal:** Close the 16 still-open cycle-3 P2 findings, correct WRK-34's tracker status, implement the three integration-gate follow-ups, and publish the completed client release train.
+
+**Architecture:** Work proceeds in seven reviewable batches. Small tracker and documentation corrections land first; focused gateway, security, and secondary-contract fixes follow; client parity is completed before a single protobuf regeneration wave adds live alarm watch-list refresh and the remaining public comments; Windows CI is extended before the final windev gate; packages are published only from the integrated `main` release commit.
+
+**Tech Stack:** .NET 10/C#, .NET Framework 4.8 x86, protobuf/Grpc.Tools, PowerShell 5.1/7, Go, Python/pytest, Rust/Cargo, Java/Gradle, Gitea Actions and package registries.
+
+---
+
+## Preconditions
+
+- Work only in `.worktrees/c3-p2-followups` on `codex/c3-p2-followups`.
+- Preserve the clean baseline recorded on 2026-08-20/25: `NonWindows.slnx` builds with zero warnings and the gateway suite passes 1183/1183.
+- Follow red-green-refactor for every behavior change. Documentation-only changes use an explicit failing grep/check as their red gate.
+- After every batch, update `archreview/2026-08-19/remediation/00-tracking.md` with status, commits, and exact verification output before committing.
+- Worker/protobuf changes require windev x86 verification before Done.
+
+### Task 1: Batch H — Tracker And Documentation Currency
+
+**Findings:** WRK-34 tracker correction, GWC-36, IPC-38, TST-33, TST-34, TST-36
+
+**Files:**
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Sessions/EventSubscriberReplayAttachment.cs`
+- Modify: `docs/Grpc.md`
+- Modify: `stillpending.md`
+- Modify: `.gitea/workflows/ci.yml`
+- Modify: `REVIEW-PROCESS.md`
+- Modify: `CLAUDE.md`
+- Modify: `docs/Sessions.md`
+- Modify: `docs/DesignDecisions.md`
+
+**Step 1: Capture the failing currency checks**
+
+Run:
+
+```bash
+git grep -n '`event` scope' -- CLAUDE.md docs/
+rg -n 'not safe to rely|Phase 5, not started|6 \[LiveMxAccessFact\]|wire behavior is unverified|still scheduled.*Phase 4' stillpending.md
+rg -n 'regen-readme.py|check-code-reviews-readme' .gitea/workflows/ci.yml
+rg -n 'DrainEvents' docs/Grpc.md
+```
+
+Expected: stale scope and pending claims are found; CI and `DrainEvents` checks find no intended entry.
+
+**Step 2: Correct GWC-36 and TST-36**
+
+Change `OldestAvailableSequence` to document retained-oldest or `highest observed + 1` when an empty ring has a gap, with `0` only when `Gap` is false. Replace prose references to the nonexistent ``event`` scope with ``events:read`` without renaming identifiers such as `GatewayScopes.EventsRead`.
+
+**Step 3: Correct IPC-38 and TST-33**
+
+Add a `DrainEvents` command row to `docs/Grpc.md` covering the 10,000-event count cap, byte cap, truncation diagnostic, drain-until-empty contract, and removal from the normal session event stream. Reconcile the five stale `stillpending.md` claims and stamp the file as a historical inventory whose live status comes from archreview trackers.
+
+**Step 4: Wire TST-34**
+
+Add this portable-job step next to the existing repository consistency checks:
+
+```yaml
+- name: Code-reviews README consistency
+  run: python code-reviews/regen-readme.py --check
+```
+
+Qualify the interpreter note in `REVIEW-PROCESS.md`: Windows may require `python`; macOS/Linux normally use `python3`, while CI uses its configured `python`.
+
+**Step 5: Re-run the checks**
+
+Run:
+
+```bash
+python3 code-reviews/regen-readme.py --check
+git grep -n '`event` scope' -- CLAUDE.md docs/ || true
+rg -n 'not safe to rely|Phase 5, not started|6 \[LiveMxAccessFact\]|wire behavior is unverified|still scheduled.*Phase 4' stillpending.md || true
+rg -n 'DrainEvents' docs/Grpc.md
+dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx
+```
+
+Expected: README check passes; stale greps return nothing; DrainEvents is documented; build has zero warnings/errors.
+
+**Step 6: Update tracker and commit**
+
+Mark the five P2 findings Done and WRK-34 Done (`3679e59`), record verification, then commit:
+
+```bash
+git add .gitea/workflows/ci.yml REVIEW-PROCESS.md CLAUDE.md stillpending.md docs/Grpc.md docs/Sessions.md docs/DesignDecisions.md src/ZB.MOM.WW.MxGateway.Server/Sessions/EventSubscriberReplayAttachment.cs archreview/2026-08-19/remediation/00-tracking.md
+git commit -m "chore(GWC-36,IPC-38,TST-33,TST-34,TST-36): close cycle-3 currency gaps"
+```
+
+### Task 2: Batch I — Gateway Correctness And Security
+
+**Findings:** GWC-33, GWC-35, SEC-38, SEC-39
+
+**Files:**
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerClient.cs`
+- Test: `src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/WorkerClientTests.cs`
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs`
+- Test: `src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorAttachOrderTests.cs`
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/ApiKeyFailureLimiter.cs`
+- Test: `src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/ApiKeyFailureLimiterTests.cs`
+- Modify: `docs/Authentication.md`
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: RED for GWC-33**
+
+Add a worker-client test that stages an event, faults the client without disposing it, and asserts the aggregate queue-depth observable stops counting that client while the faulted object remains alive. Run:
+
+```bash
+dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter FullyQualifiedName~WorkerClientTests
+```
+
+Expected: the new assertion fails because the registration is disposed only by `DisposeAsync`.
+
+**Step 2: GREEN for GWC-33**
+
+Make queue-depth registration disposal idempotent and call it on both terminal transitions and disposal. Do not clear the faulted client's diagnostic state or shorten `FaultedGraceSeconds` retention. Re-run the WorkerClient filter and commit the focused change.
+
+**Step 3: RED/GREEN for GWC-35**
+
+Add a monitor test whose first reconcile contains `ActiveAcked` and whose next reconcile carries a newer `Active` instance. Assert one `Raise` repair carrying the incoming instance identity. Verify red, then generalize the both-present state delta:
+
+```csharp
+AlarmTransitionKind kind = incoming.Value.CurrentState == AlarmConditionState.ActiveAcked
+    ? AlarmTransitionKind.Acknowledge
+    : AlarmTransitionKind.Raise;
+```
+
+Keep the existing duplicate suppression keyed by original raise timestamp. Re-run `GatewayAlarmMonitorAttachOrderTests`.
+
+**Step 4: RED/GREEN for SEC-38**
+
+Add a limiter test that fills all 32 peer key-ID partitions, then attacks one valid victim key ID through the fallback from multiple peers. Assert the victim aggregate trips. Change resolution/recording so every validly-shaped presented key ID consults and feeds its aggregate even if its peer partition fell back; continue using the resolved partition key for the peer layer and the existing capped aggregate eviction for cardinality. Update class remarks and `docs/Authentication.md`.
+
+**Step 5: RED/GREEN for SEC-39**
+
+Add a test that records fallback failures, calls `Reset` with a null effective key ID, and asserts the fallback remains tracked. Tighten ownership:
+
+```csharp
+if (effectiveKeyId is not null
+    && string.Equals(effectiveKeyId, partition.KeyId, StringComparison.Ordinal))
+{
+    RemovePartition(partitionKey);
+}
+```
+
+**Step 6: Verify, track, and commit**
+
+Run:
+
+```bash
+dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter "FullyQualifiedName~WorkerClientTests|FullyQualifiedName~GatewayAlarmMonitorAttachOrderTests|FullyQualifiedName~ApiKeyFailureLimiterTests"
+dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx
+```
+
+Expected: all filtered tests pass; zero warnings/errors. Update tracker with per-finding commits and counts.
+
+### Task 3: Batch J — Secondary Contract Guards
+
+**Findings:** IPC-36, IPC-37
+
+**Files:**
+- Create: `src/ZB.MOM.WW.MxGateway.Contracts/WorkerLaunchEnvironment.cs`
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerProcessLauncher.cs`
+- Modify: worker consumers under `src/ZB.MOM.WW.MxGateway.Worker/Bootstrap`, `Ipc`, and `MxAccess`
+- Test: `src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/WorkerProcessLauncherTests.cs`
+- Create: `src/ZB.MOM.WW.MxGateway.Tests/Contracts/GalaxyContractParityTests.cs`
+- Modify: `src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj`
+- Modify: `docs/WorkerProcessLauncher.md`
+- Modify: `docs/MxAccessWorkerInstanceDesign.md`
+- Modify: `docs/Contracts.md`
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: RED for IPC-36**
+
+Change the launcher test to enumerate the six constants expected on `WorkerLaunchEnvironment` and assert each is present in `ProcessStartInfo.Environment`. Run the test and confirm compilation fails because the shared class does not exist.
+
+**Step 2: GREEN for IPC-36**
+
+Create a net48-safe static class containing six `public const string` names. Replace both gateway and worker literals with these constants; remove the duplicate public constants from `WorkerProcessLauncher` unless compatibility requires obsolete aliases. Add a launch-environment table with variable, source configuration key, and worker default. Refresh Write/Write2 wording.
+
+**Step 3: RED for IPC-37**
+
+Add `GalaxyContractParityTests` that converts both loaded descriptors with `ToProto()`, clears `SourceCodeInfo`, normalizes `Options.CsharpNamespace` and file `Name`, then compares deterministic bytes. Before the assertion, mutate a clone in a local test helper to prove the comparison reports the differing symbol/message clearly; the real descriptor assertion must pass at HEAD.
+
+**Step 4: Document and verify**
+
+Record the parity guard in the Contracts project comment and `docs/Contracts.md`. Run:
+
+```bash
+dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter "FullyQualifiedName~WorkerProcessLauncherTests|FullyQualifiedName~GalaxyContractParityTests"
+dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx
+```
+
+Then update tracker and commit IPC-36/37.
+
+### Task 4: Batch K — Client Alarm-Feed Parity
+
+**Findings:** CLI-47, CLI-48, CLI-49, CLI-50
+
+**Files:**
+- Modify: `clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs`
+- Test: `clients/dotnet/ZB.MOM.WW.MxGateway.Client.Tests/MxGatewayClientCliTests.cs`
+- Test/modify: `clients/go/cmd/mxgw-go/main.go`, `main_test.go`
+- Modify: `clients/go/mxgateway/types.go`
+- Test/modify: Java CLI and `MxGatewayCliTests.java`
+- Modify/test: `clients/python/src/zb_mom_ww_mxgateway_cli/commands.py`, `clients/python/tests/`
+- Modify: all affected client READMEs and `docs/CrossLanguageSmokeMatrix.md`
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: RED/GREEN for CLI-47 and CLI-48**
+
+In .NET, Go, and Java tests, feed `provider_status { degraded: false }` and `snapshot_status { truncated: false }`; assert exact text rows and protobuf-JSON behavior. Confirm .NET text fails as `{}` and Go lacks a stream-alarm harness. Hand-format .NET text to match the explicit rows; add the missing Go and Java coverage without changing their correct output.
+
+**Step 2: RED/GREEN for CLI-49**
+
+Add a Go compile-time consumer test that declares variables of `mxgateway.AlarmProviderStatus` and `mxgateway.AlarmSnapshotStatus`. Confirm red, then add aliases and update the five-arm `AlarmFeedMessage` comment.
+
+**Step 3: RED/GREEN for CLI-50**
+
+Add Python CLI tests proving default `stream-alarms` emits provider status, snapshot status, cached alarms, and later live messages incrementally until timeout/cancellation; add a finite `--max-messages` test. Change the default to `0` (unbounded) and print rows as consumed instead of collecting first. Keep the maximum bound for positive finite values and ensure iterator cleanup occurs in `finally`.
+
+**Step 4: Verify all clients**
+
+Run the authoritative commands from `docs/ClientPackaging.md`:
+
+```bash
+dotnet test clients/dotnet/ZB.MOM.WW.MxGateway.Client.slnx
+(cd clients/go && go test ./...)
+(cd clients/python && python -m pytest)
+(cd clients/rust && cargo test --workspace)
+(cd clients/java && JAVA_HOME=/opt/homebrew/opt/openjdk@17 gradle test)
+```
+
+Revert only proven generator churn; do not revert source changes. Update tracker and commit CLI-47–50.
+
+### Task 5: Batch L — Live Watch-List Refresh And Protobuf Wave
+
+**Follow-ups:** complete GWC-37 application path, WRK-32 public comment
+
+**Files:**
+- Modify: `src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto`
+- Regenerate: Contracts and every client generated tree required by `docs/Contracts.md`
+- Modify/test: worker alarm command executor, handler, failover/subtag consumers, and Worker.Tests
+- Modify/test: `src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs` and alarm monitor tests
+- Modify: alarm, worker protocol, configuration, and client contract documentation
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: RED — contract round trip**
+
+Add a protobuf round-trip test for:
+
+```proto
+message UpdateAlarmWatchListCommand {
+  repeated AlarmSubtagTarget watch_list = 1;
+}
+```
+
+Add a new non-conflicting `MxCommand` oneof field and `MxCommandKind`, plus an explicit `fallback_enabled` field on `SubscribeAlarmsCommand`. Confirm the test cannot compile before editing the proto.
+
+**Step 2: RED — worker routing and failure preservation**
+
+Add Worker.Tests covering command routing, rejection without an active/fallback-capable subscription, replacement setup failure preserving the previous standby, primary-mode replacement keeping primary active, and standby-mode replacement keeping subtag active.
+
+**Step 3: GREEN — worker hot-swap**
+
+Implement `IAlarmCommandHandler.UpdateWatchList`. Retain the subscription expression. Refactor `FailoverAlarmConsumer` so standby replacement performs build/subscribe/attach before swap and disposes the old standby after swap. No COM operation may leave the STA. In auto mode, build the composite with an empty standby when `fallback_enabled` is true; leave an intentionally alarm-manager-only subscription unchanged.
+
+**Step 4: RED — gateway periodic update**
+
+Extend `GatewayAlarmMonitorProviderModeTests`/`AlarmFailoverEndToEndTests` with these scenarios:
+
+- startup discovery fails/empty, later reconcile resolves targets, exactly one update command is sent;
+- unchanged targets send no update;
+- changed targets update the sent fingerprint only after an OK reply;
+- worker rejection retains the prior fingerprint and degraded coverage reason;
+- failover edge performs an immediate refresh before publishing status.
+
+**Step 5: GREEN — gateway refresh path**
+
+Reuse `ReconcileIntervalSeconds`. Resolve only when mode can use subtags, compare canonical full-target fingerprints, invoke the new command on material change/recovery, and reconcile after success. Do not add a timer or option.
+
+**Step 6: Complete the shared proto comments**
+
+In the same proto edit:
+
+- replace the IPC-36 internal environment-variable name with `MxGateway:Worker:WriteCompletionWaitMilliseconds`;
+- describe WRK-32 correlation as recency-based per handle and name the sequential timed-out-predecessor stale-callback case, not only concurrent writes.
+
+**Step 7: Regenerate once and run portable checks**
+
+Follow `docs/Contracts.md` exactly, then run:
+
+```bash
+pwsh scripts/check-codegen.ps1
+dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx
+dotnet test src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj --filter "FullyQualifiedName~ProtobufContractRoundTripTests|FullyQualifiedName~AlarmFailoverEndToEndTests|FullyQualifiedName~GatewayAlarmMonitorProviderModeTests|FullyQualifiedName~ClientProtoInputTests"
+```
+
+Run all five client suites again because generated trees changed.
+
+**Step 8: Verify worker on windev**
+
+Commit the candidate, then run the repository's windev test mode at that SHA. Required evidence: x86 Worker build success and Worker.Tests with zero failures. Only then mark the watch-list/WRK-32 follow-ups Done in the tracker and commit any evidence-only tracker update.
+
+### Task 6: Batch M — Windows Gateway Suite In Nightly CI
+
+**Finding:** TST-35
+
+**Files:**
+- Modify: `scripts/ci/windev-worker-ci.ps1`
+- Modify: `.gitea/workflows/ci.yml` comments if needed
+- Modify: `docs/GatewayTesting.md`
+- Modify: `scripts/ci/README.md`
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: Add an acceptance check before behavior**
+
+Document the expected `live` order and add a script-level/static assertion or dry-run seam showing gateway tests are absent before the change.
+
+**Step 2: Extend live mode**
+
+After Worker.Tests and full-slnx build, run:
+
+```powershell
+Invoke-Native 'gateway tests on Windows' {
+    dotnet test 'src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj' -c Release --no-build
+}
+```
+
+Keep it before the opt-in live-MXAccess smoke, under the existing host lock. Log the actual result; do not enforce a historical count.
+
+**Step 3: Verify on windev**
+
+Run `live` mode at the committed SHA. Require Worker.Tests, gateway tests, full solution build, and live smoke to complete successfully. Update docs/tracker with date, SHA, counts, and duration; commit TST-35.
+
+### Task 7: Batch N — Full Integration And Release
+
+**Follow-up:** publish the five clients and Contracts
+
+**Files:**
+- Modify after publication: `docs/ClientPackaging.md`
+- Modify: `archreview/2026-08-19/remediation/00-tracking.md`
+
+**Step 1: Full local integration gate**
+
+Run:
+
+```bash
+git diff --check
+pwsh scripts/check-codegen.ps1
+pwsh scripts/check-client-versions.ps1
+python3 code-reviews/regen-readme.py --check
+dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx
+dotnet test src/ZB.MOM.WW.MxGateway.NonWindows.slnx --no-build --no-restore
+```
+
+Run all five client suites. Require zero unexpected working-tree changes.
+
+**Step 2: Final windev gate**
+
+Run `windev-worker-ci.ps1 -Mode live` at the exact candidate SHA. Record Worker.Tests, gateway tests, live smoke, and full solution build evidence.
+
+**Step 3: Integrate before release**
+
+Use `superpowers:finishing-a-development-branch`. Merge/push the verified branch to `main`, confirm CI green, and resolve the exact release commit SHA. Do not publish artifacts from an unmerged feature commit.
+
+**Step 4: Preflight exact coordinates**
+
+Confirm these are absent (HTTP 404) immediately before publishing:
+
+- NuGet `ZB.MOM.WW.MxGateway.Client` 0.2.1
+- NuGet `ZB.MOM.WW.MxGateway.Contracts` 0.2.1
+- PyPI `zb-mom-ww-mxaccess-gateway-client` 0.2.1
+- Cargo `zb-mom-ww-mxgateway-client` 0.2.1
+- Maven `com.zb.mom.ww.mxgateway:zb-mom-ww-mxgateway-client` 0.2.2
+- Git tag `clients/go/v0.2.1`
+
+Abort rather than overwrite if any coordinate exists unexpectedly.
+
+**Step 5: Publish from clean `main`**
+
+Run the documented `scripts/pack-clients.ps1 -Publish` commands for .NET, Python, Rust, and Java with required credentials, then:
+
+```powershell
+pwsh scripts/tag-go-module.ps1 -Version v0.2.1 -Push
+```
+
+The Go tag must point to the exact integrated release commit.
+
+**Step 6: Verify release and close tracker**
+
+Query every exact registry coordinate for HTTP 200 and resolve the Go module/tag remotely. Update `docs/ClientPackaging.md` and the tracker with release SHA, coordinates, and verification date. Run the doc checks, commit the release record, and push it.
+
+## Final Tasklist Exit Gate
+
+- [ ] All 16 open P2 findings are Done with commit/test evidence.
+- [ ] WRK-34 is corrected to Done (`3679e59`).
+- [ ] Live watch-list refresh passes portable and windev tests.
+- [ ] WRK-32 public proto comment is regenerated through every client surface.
+- [ ] TST-35 nightly Windows gateway suite is proven on windev.
+- [ ] Full NonWindows gateway suite and all five client suites pass.
+- [ ] Worker.Tests and Windows gateway suite pass at the integrated release SHA.
+- [ ] Five client releases plus Contracts are confirmed in registries; Go tag resolves.
+- [ ] `archreview/2026-08-19/remediation/00-tracking.md` contains no stale Deferred row for completed work.

gateway.md

@@ -249,6 +249,22 @@ monitoring (forced)") when subtag mode is the configured `Fallback:Mode=ForceSub
 as a fault. Metrics: `mxgateway.alarms.provider_mode` gauge (1 = alarmmgr,
 2 = subtag) and `mxgateway.alarms.provider_switches` counter.
 
+**Standby-coverage visibility:** `degraded` also covers the case where the alarm
+manager is serving normally but the subtag standby behind it could not cover
+anything — a watch-list that resolved to zero targets, or Galaxy Repository
+discovery that was enabled and failed. That condition used to be a single startup
+log line, invisible until the failover that needed the standby found it empty; it
+is now a standing `AlarmProviderStatus` reason
+(`AlarmProviderReasons.SubtagWatchListEmpty` / `SubtagDiscoveryFailed`) carried on
+the feed and rendered as the amber `Alarm Manager (no subtag standby)` badge, which
+keeps the failover label from naming the wrong live provider. The watch-list the
+worker holds is fixed for the life of the subscription, so on the failover edge the
+monitor re-resolves and reports a difference
+(`AlarmProviderReasons.SubtagWatchListStale`, with both counts) rather than
+re-sending it — re-sending would rebuild the failover consumer on the primary that
+just failed. A monitor restart re-resolves and re-sends. See
+`docs/AlarmClientDiscovery.md`.
+
 **Truncated-snapshot visibility:** `GetXmlCurrentAlarms2` caps its reply at
 `MxGateway:Alarms:MaxAlarmsPerFetch` and offers no confirmed "more available"
 flag, so a reply holding exactly the cap is treated as truncated. On such a
@@ -917,10 +933,19 @@ Timeouts:
 
 Cancellation:
 
-- canceling the gRPC call should stop waiting in the gateway,
+- canceling the gRPC call stops the gateway waiting **and** forwards a
+  `WorkerCancel` for the abandoned correlation, the same best-effort frame the
+  command timeout sends — a client deadline or a disconnect is the common
+  abandonment path, and leaving the correlation on the worker's single STA queue
+  makes live callers queue behind work nobody is waiting for,
+- the cancel is sent only by the caller that owned the pending-entry removal (so
+  a reply that won the race is never chased) and is skipped once the client is
+  stopping, where every pending command fails anyway,
 - it cannot safely abort an in-flight COM call on the STA,
 - the worker should finish the COM call and discard or log the late reply if
   the correlation was canceled,
+- caller cancellation is reported as `CallerCancelled` (mapped to gRPC
+  `Cancelled`), distinct from a gateway shutdown, so metrics name the real cause,
 - hard cancellation means killing the worker process.
 
 ## Event Delivery And Backpressure

glauth.md

@@ -52,31 +52,46 @@ LmxOpcUa write rights doesn't need a second account for the gw.
 
 | Group | GID | DN | LmxOpcUa meaning | Suggested mxgw mapping |
 |---|---|---|---|---|
-| ReadOnly | 5501 | `ou=ReadOnly,ou=groups,dc=zb,dc=local` | Browse + read OPC UA nodes | `Browse` + `Subscribe` (read paths only) |
-| WriteOperate | 5502 | `ou=WriteOperate,ou=groups,dc=zb,dc=local` | Write FreeAccess / Operate attrs | `Write` (plain) |
-| WriteTune | 5504 | `ou=WriteTune,ou=groups,dc=zb,dc=local` | Write Tune attrs | `WriteSecured` (Tune only) |
-| WriteConfigure | 5505 | `ou=WriteConfigure,ou=groups,dc=zb,dc=local` | Write Configure attrs | `WriteSecured` (Configure) |
-| AlarmAck | 5503 | `ou=AlarmAck,ou=groups,dc=zb,dc=local` | Acknowledge alarms | gw alarm-ack RPC, when added |
+| ReadOnly | 5601 | `ou=ReadOnly,ou=groups,dc=zb,dc=local` | Browse + read OPC UA nodes | `Browse` + `Subscribe` (read paths only) |
+| WriteOperate | 5602 | `ou=WriteOperate,ou=groups,dc=zb,dc=local` | Write FreeAccess / Operate attrs | `Write` (plain) |
+| WriteTune | 5603 | `ou=WriteTune,ou=groups,dc=zb,dc=local` | Write Tune attrs | `WriteSecured` (Tune only) |
+| WriteConfigure | 5604 | `ou=WriteConfigure,ou=groups,dc=zb,dc=local` | Write Configure attrs | `WriteSecured` (Configure) |
+| AlarmAck | 5605 | `ou=AlarmAck,ou=groups,dc=zb,dc=local` | Acknowledge alarms | gw alarm-ack RPC, when added |
+
+These are the shared config's OPC-perm (`560x`) family — see
+`scadaproj/infra/glauth/README.md`'s directory-layout table, which
+partitions groups into non-overlapping gid ranges per sister app
+(`SCADA-*` 55xx, OPC-perm 560x, `Gw*` 561x, `OtOpcUa-*` 57xx) so the
+three apps coexist in one directory.
 
 **A user can be in multiple groups** — `othergroups = [...]` in the
-config is a list. `admin` is the canonical example (in every role
-group below).
+config is a list. `multi-role` is the canonical example (in every
+group in the file, not just the ones below).
 
 ## Pre-provisioned users
 
+Per-role OPC-perm testers are named `opc-*` rather than the bare role name
+(`readonly`, `writeop`, …) because a tester username must not
+case-collide with a group name — see the naming rule in
+`scadaproj/infra/glauth/README.md`.
+
 | Username | Password | UID | Primary group | Other groups | Capabilities |
 |---|---|---|---|---|---|
-| `readonly` | `readonly123` | 5001 | ReadOnly | — | Browse, read |
-| `writeop` | `writeop123` | 5002 | WriteOperate | — | + plain Write |
-| `writetune` | `writetune123` | 5005 | WriteTune | — | + WriteSecured (Tune) |
-| `writeconfig` | `writeconfig123` | 5006 | WriteConfigure | — | + WriteSecured (Configure) |
-| `alarmack` | `alarmack123` | 5003 | AlarmAck | — | Alarm acknowledgment |
-| `admin` | `admin123` | 5004 | ReadOnly | WriteOperate, AlarmAck, WriteTune, WriteConfigure | All roles |
+| `opc-readonly` | `password` | 5101 | ReadOnly | — | Browse, read |
+| `opc-writeop` | `password` | 5102 | WriteOperate | — | + plain Write |
+| `opc-writetune` | `password` | 5103 | WriteTune | — | + WriteSecured (Tune) |
+| `opc-writeconfig` | `password` | 5104 | WriteConfigure | — | + WriteSecured (Configure) |
+| `opc-alarmack` | `password` | 5105 | AlarmAck | — | Alarm acknowledgment |
+| `multi-role` | `password` | 5005 | SCADA-Admins | every other group in the file, incl. all five OPC-perm groups + `GwAdmin`/`GwReader` | All roles, all apps (cross-app canonical login) |
+| `admin` | `password` | 5001 | SCADA-Admins | `GwAdmin`, `OtOpcUa-Admins` | Dashboard Administrator + ScadaBridge/OtOpcUa admin — **not** a member of any OPC-perm group, so it has no gw-side Write/WriteSecured/AlarmAck capability |
 | `serviceaccount` | `<service-account-password>` | 5999 | ReadOnly | — | LDAP search capability (for bind-then-search) |
 
-For mxaccessgw dev, `admin` covers every gw-side capability test;
-`readonly` is the right "negative" case for proving Browse-OK /
-Write-denied.
+For mxaccessgw dev, `multi-role` covers every gw-side capability test
+(it is a member of all five OPC-perm groups as well as `GwAdmin`);
+`opc-readonly` is the right "negative" case for proving Browse-OK /
+Write-denied. `admin` is useful for dashboard-Administrator and
+ScadaBridge/OtOpcUa-admin testing but, per the table above, carries no
+OPC-perm group membership of its own.
 
 The gateway dashboard uses two gateway-specific groups beyond the LmxOpcUa taxonomy:
 `GwAdmin` (gid 5610 → role `Administrator`) and `GwReader` (gid 5611 → role `Viewer`).
@@ -121,7 +136,7 @@ principal cannot show that.
 
 ```
 DN:       cn=admin,dc=zb,dc=local
-Password: admin123
+Password: password
 ```
 
 Construct the DN from the username; bind. Works on GLAuth because

scripts/check-client-versions.ps1

@@ -0,0 +1,210 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Fails a PR that changes a client's source without bumping its version
+    past the last thing actually published (CLI-46).
+
+.DESCRIPTION
+    CLI-39 (2026-07-12 cycle) added publish-time guards that refuse to
+    re-publish an already-published name+version
+    (scripts/pack-clients.ps1's Assert-GiteaPackageNotPublished,
+    scripts/tag-go-module.ps1's ClientVersion-vs-tag check). Those guards
+    only fire when someone actually runs a publish. CLI-46 (2026-08-19
+    cycle) found the same hazard recurring silently in between publishes:
+    library source (including a real bug fix, commit a8f86b5) shipped
+    while the version constant still equalled the already-published
+    number, so nothing in the tree recorded that the published artifact
+    and the in-repo source had diverged. This script is the PR-time half
+    of that guard: catch the drift as soon as it happens, not at the next
+    publish.
+
+    For each client this repo ships, the script:
+      1. Finds the latest "publish tag" for that client, per the tag
+         naming convention its own publish tooling actually uses.
+      2. If no such tag exists, says so and passes (nothing to compare
+         against yet — this is expected for every client except Go; see
+         below).
+      3. If a tag exists, reads the version recorded in-source at that tag
+         and the version recorded in-source now. If `clients/<lang>` has
+         changed since the tag AND the version constant is unchanged, that
+         is exactly the CLI-46 pattern: source moved, the published
+         coordinate did not, and nothing says so. Fail.
+
+    Tag conventions, as implemented today (verified against
+    scripts/pack-clients.ps1, scripts/tag-go-module.ps1, and `git tag -l`):
+      - Go is the only client with a git tag at all: `tag-go-module.ps1`
+        creates `clients/go/vX.Y.Z` (CLI-21/CLI-39 already keep this tag's
+        version in lockstep with clients/go/mxgateway/version.go's
+        ClientVersion at *tag time*; this script is what keeps it in
+        lockstep *between* tags).
+      - .NET, Python, Rust, and Java publish straight to a package
+        registry via `pack-clients.ps1 -Publish` (NuGet/PyPI/cargo/Maven
+        API pushes) with no corresponding git tag of any kind — there is
+        nothing in this repo's history to diff against for those four.
+        The script looks for a same-shaped tag anyway
+        (`clients/<lang>/v*`) so it stays correct if that ever changes,
+        but today it will report "no tags found" and pass for all four.
+
+    A client with no tag is not a violation of anything — it means no
+    release train has ever tagged that client, so there is no "since the
+    last publish" window to check. The check exists to catch drift once a
+    baseline exists, not to demand one.
+
+.EXAMPLE
+    pwsh scripts/check-client-versions.ps1
+#>
+
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+Push-Location $repoRoot
+try {
+    # One entry per official client. `TagGlob` is the tag naming pattern that
+    # client's own publish tooling uses (see doc comment above); `VersionFile`
+    # + `VersionPattern` locate the single version-of-record constant
+    # docs/ClientPackaging.md's "Versioning" section names as authoritative
+    # for that client; `SourceDir` is the diff scope (matches the literal
+    # `clients/<lang>` scope described in the CLI-46 remediation task).
+    $clients = @(
+        [ordered]@{
+            Name           = 'dotnet'
+            SourceDir      = 'clients/dotnet'
+            TagGlob        = 'clients/dotnet/v*'
+            VersionFile    = 'clients/dotnet/ZB.MOM.WW.MxGateway.Client/ZB.MOM.WW.MxGateway.Client.csproj'
+            VersionPattern = '<Version>([^<]+)</Version>'
+        },
+        [ordered]@{
+            Name           = 'go'
+            SourceDir      = 'clients/go'
+            TagGlob        = 'clients/go/v*'
+            VersionFile    = 'clients/go/mxgateway/version.go'
+            VersionPattern = 'ClientVersion\s*=\s*"([^"]+)"'
+        },
+        [ordered]@{
+            Name           = 'python'
+            SourceDir      = 'clients/python'
+            TagGlob        = 'clients/python/v*'
+            VersionFile    = 'clients/python/src/zb_mom_ww_mxgateway/version.py'
+            VersionPattern = '__version__\s*=\s*"([^"]+)"'
+        },
+        [ordered]@{
+            Name           = 'rust'
+            SourceDir      = 'clients/rust'
+            TagGlob        = 'clients/rust/v*'
+            VersionFile    = 'clients/rust/Cargo.toml'
+            VersionPattern = 'version\s*=\s*"([^"]+)"'
+        },
+        [ordered]@{
+            Name           = 'java'
+            SourceDir      = 'clients/java'
+            TagGlob        = 'clients/java/v*'
+            VersionFile    = 'clients/java/build.gradle'
+            VersionPattern = "version\s*=\s*'([^']+)'"
+        }
+    )
+
+    function Get-LatestTag {
+        param([string]$Glob)
+
+        # --sort=-v:refname orders by version-aware descending semver, so the
+        # first line is the newest tag matching the glob. Empty result means
+        # no tag of this shape has ever been created for this client.
+        $tags = git tag -l --sort='-v:refname' $Glob
+        if (-not $tags) {
+            return $null
+        }
+        return @($tags -split "`n")[0].Trim()
+    }
+
+    function Get-VersionFromFile {
+        param([string]$Path, [string]$Pattern)
+
+        if (-not (Test-Path $Path)) {
+            throw "Version file not found: $Path"
+        }
+        $content = Get-Content -Path $Path -Raw
+        $match = [regex]::Match($content, $Pattern)
+        if (-not $match.Success) {
+            throw "Could not find a version matching /$Pattern/ in $Path"
+        }
+        return $match.Groups[1].Value
+    }
+
+    function Get-VersionFromFileAtRevision {
+        param([string]$Revision, [string]$Path, [string]$Pattern)
+
+        $content = git show "${Revision}:${Path}" 2>$null
+        if ($LASTEXITCODE -ne 0 -or -not $content) {
+            # The version file did not exist (or was at a different path) at
+            # that tag. Treat as "unknown" rather than failing the whole
+            # check — the drift comparison below only needs "does the
+            # current version still equal the tag's version", and an
+            # unresolvable historical version can never equal the current
+            # one, so this degrades to "assume it changed" (safe: it will
+            # not mask a real drift).
+            return $null
+        }
+        $match = [regex]::Match(($content -join "`n"), $Pattern)
+        if (-not $match.Success) {
+            return $null
+        }
+        return $match.Groups[1].Value
+    }
+
+    $failures = New-Object System.Collections.Generic.List[string]
+
+    foreach ($client in $clients) {
+        Write-Host ''
+        Write-Host "== $($client.Name) ==" -ForegroundColor Cyan
+
+        $tag = Get-LatestTag -Glob $client.TagGlob
+        if (-not $tag) {
+            Write-Host "  No publish tags matching '$($client.TagGlob)' — nothing to compare against yet. Pass." -ForegroundColor Yellow
+            continue
+        }
+
+        Write-Host "  Latest publish tag: $tag"
+
+        $currentVersion = Get-VersionFromFile -Path $client.VersionFile -Pattern $client.VersionPattern
+        Write-Host "  Current version constant ($($client.VersionFile)): $currentVersion"
+
+        # Any diff at all in the client's source tree since its last publish
+        # tag — matches the CLI-46 remediation task's literal check.
+        git diff --quiet $tag -- $client.SourceDir
+        $sourceChanged = ($LASTEXITCODE -ne 0)
+
+        if (-not $sourceChanged) {
+            Write-Host "  No changes under $($client.SourceDir) since $tag. Pass." -ForegroundColor Green
+            continue
+        }
+
+        $tagVersion = Get-VersionFromFileAtRevision -Revision $tag -Path $client.VersionFile -Pattern $client.VersionPattern
+        Write-Host "  Source under $($client.SourceDir) changed since $tag (tag's version constant: $(if ($tagVersion) { $tagVersion } else { '<unresolvable>' }))."
+
+        if ($currentVersion -eq $tagVersion) {
+            $failures.Add("$($client.Name): source changed since publish tag '$tag' but $($client.VersionFile) still reads '$currentVersion' (the version at '$tag'). Bump the version before another publish (CLI-46).")
+            Write-Host "  FAIL: version constant unchanged since the publish tag." -ForegroundColor Red
+        }
+        else {
+            Write-Host "  Version constant already bumped ('$tagVersion' -> '$currentVersion') since $tag. Pass." -ForegroundColor Green
+        }
+    }
+
+    Write-Host ''
+    if ($failures.Count -gt 0) {
+        Write-Host 'Client version freshness check FAILED:' -ForegroundColor Red
+        foreach ($failure in $failures) {
+            Write-Host "  - $failure" -ForegroundColor Red
+        }
+        exit 1
+    }
+
+    Write-Host 'Client version freshness check passed.' -ForegroundColor Green
+}
+finally {
+    Pop-Location
+}

scripts/ci/README.md

@@ -11,11 +11,15 @@ code back so a regression turns the job red.
 | File | Runs on | Role |
 |---|---|---|
 | `run-windev-ci.sh <build\|test\|live>` | Linux CI job | Writes the SSH key/known-hosts, base64-encodes a bootstrap, SSHes to windev, returns the remote exit code. |
-| `windev-worker-ci.ps1 -Sha -Mode` | windev | Locks the CI clone, checks out the SHA, runs the x86 build / `Worker.Tests` / live smoke. |
+| `windev-worker-ci.ps1 -Sha -Mode` | windev | Locks the CI clone, checks out the SHA, and runs the requested cumulative Windows tiers. |
 | `windev.known_hosts` | committed | Pinned windev host keys so `StrictHostKeyChecking=yes` has no TOFU prompt. Host keys are public; committing is intentional. |
 
 Modes are cumulative: `build` = x86 Worker build; `test` = build + `Worker.Tests`;
-`live` = test + full-`slnx` build + live-MXAccess smoke (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`).
+`live` = test + full-`slnx` build + the net10 gateway suite + live-MXAccess smoke
+(`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`). The `live` order is x86 Worker build,
+`Worker.Tests`, full solution build, gateway tests, then live smoke. One host lock covers
+checkout and every tier, so concurrent runs cannot overlap; each native command is checked
+immediately and the first nonzero exit aborts the remaining tiers and propagates to CI.
 
 CI jobs (`.gitea/workflows/ci.yml`): `windows-x86` runs `test` per push/PR; `nightly-windev`
 runs `live` on the `0 6 * * *` schedule and opens a Gitea issue on failure.

scripts/ci/windev-worker-ci.ps1

@@ -16,8 +16,8 @@
     Modes (cumulative):
       build  x86 Worker build only (net48/CS0246/x86 compile guard — always fast).
       test   build + Worker.Tests (x86). The per-push default.
-      live   test + the live-MXAccess smoke (MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1) and a full
-             slnx build (surfaces Windows-only analyzer diagnostics, e.g. xUnit1030). Nightly.
+      live   test + full slnx build + the net10 gateway suite + the live-MXAccess smoke
+             (MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1). Nightly.
 
     Runs under Windows PowerShell 5.1 (`powershell.exe`), so it avoids PS7-only syntax and
     checks $LASTEXITCODE after every native command rather than relying on stderr-as-error
@@ -112,6 +112,7 @@ try {
 
         $workerProj = 'src/ZB.MOM.WW.MxGateway.Worker/ZB.MOM.WW.MxGateway.Worker.csproj'
         $workerTests = 'src/ZB.MOM.WW.MxGateway.Worker.Tests/ZB.MOM.WW.MxGateway.Worker.Tests.csproj'
+        $gatewayTests = 'src/ZB.MOM.WW.MxGateway.Tests/ZB.MOM.WW.MxGateway.Tests.csproj'
         $integrationTests = 'src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj'
 
         # build: always. The x86/net48 compile is the floor guard (catches CS0246 on
@@ -127,6 +128,10 @@ try {
             # that never fire on the macOS/Linux NonWindows build.
             Invoke-Native 'full slnx build' { dotnet build src/ZB.MOM.WW.MxGateway.slnx -c Release }
 
+            Invoke-Native 'gateway tests on Windows' {
+                dotnet test $gatewayTests -c Release --no-build
+            }
+
             $env:MXGATEWAY_RUN_LIVE_MXACCESS_TESTS = '1'
             try {
                 Invoke-Native 'live-MXAccess smoke' {

src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto

@@ -130,6 +130,7 @@ message MxCommand {
     WriteSecuredBulkCommand write_secured_bulk = 41;
     WriteSecured2BulkCommand write_secured2_bulk = 42;
     ReadBulkCommand read_bulk = 43;
+    UpdateAlarmWatchListCommand update_alarm_watch_list = 44;
     PingCommand ping = 100;
     GetSessionStateCommand get_session_state = 101;
     GetWorkerInfoCommand get_worker_info = 102;
@@ -174,6 +175,7 @@ enum MxCommandKind {
   MX_COMMAND_KIND_WRITE_SECURED_BULK = 32;
   MX_COMMAND_KIND_WRITE_SECURED2_BULK = 33;
   MX_COMMAND_KIND_READ_BULK = 34;
+  MX_COMMAND_KIND_UPDATE_ALARM_WATCH_LIST = 35;
   MX_COMMAND_KIND_PING = 100;
   MX_COMMAND_KIND_GET_SESSION_STATE = 101;
   MX_COMMAND_KIND_GET_WORKER_INFO = 102;
@@ -344,8 +346,8 @@ enum AlarmProviderMode {
 // Subscription expression follows the canonical
 // `\\<machine>\Galaxy!<area>` format (literal "Galaxy" provider). The
 // worker spins up a wnwrapConsumer-backed subscription on its STA on
-// first call; subsequent calls are an error (use UnsubscribeAlarms then
-// SubscribeAlarms to reconfigure).
+// first call; subsequent calls are an error. Use UpdateAlarmWatchList to
+// replace the standby targets without restarting the primary subscription.
 message SubscribeAlarmsCommand {
   string subscription_expression = 1;
   // UNSPECIFIED = auto-failover/failback. ALARMMGR/SUBTAG force one provider.
@@ -354,6 +356,17 @@ message SubscribeAlarmsCommand {
   // alarmmgr mode; in subtag mode it bounds what the consumer can observe.
   repeated AlarmSubtagTarget watch_list = 3;
   AlarmFailoverConfig failover = 4;
+  // True when auto mode should retain subtag-fallback capability even if the
+  // gateway's initial discovery produced an empty watch list. False leaves an
+  // empty list as an intentional alarm-manager-only subscription.
+  bool fallback_enabled = 5;
+}
+
+// Replace the live alarm subscription's subtag standby targets. The worker
+// constructs and attaches the replacement before swapping it into service, so
+// a setup failure leaves the existing standby and active provider unchanged.
+message UpdateAlarmWatchListCommand {
+  repeated AlarmSubtagTarget watch_list = 1;
 }
 
 // Tear down the worker's alarm consumer. No-op if no subscription is
@@ -537,11 +550,14 @@ message MxCommandReply {
   MxValue return_value = 6;
   // Correlated per-item outcome rows. For WRITE / WRITE2 / WRITE_SECURED /
   // WRITE_SECURED2 replies the worker holds the reply for a bounded window
-  // (default 1.5 s, MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS) waiting for
+  // (default 1.5 s, MxGateway:Worker:WriteCompletionWaitMilliseconds) waiting for
   // the matching MXAccess OnWriteComplete callback and copies its status rows
   // here, so statuses[0] carries the real MXAccess commit outcome (success OR
   // failure) while protocol_status/hresult still describe command acceptance
-  // only. Empty statuses on a write reply means the completion did not arrive
+  // only. Callback correlation is recency-based per item handle: after the
+  // bounded wait, a sequential write's callback supersedes a timed-out
+  // predecessor, and a later stale callback for that predecessor is ignored.
+  // Empty statuses on a write reply means the completion did not arrive
   // within the window — the write is unconfirmed, not failed. Correlation is
   // best-effort per (server_handle, item_handle): MXAccess's callback carries
   // no transaction id, so concurrent writes to the same item within the

src/ZB.MOM.WW.MxGateway.Contracts/WorkerLaunchEnvironment.cs

@@ -0,0 +1,25 @@
+namespace ZB.MOM.WW.MxGateway.Contracts;
+
+/// <summary>Names of environment variables shared by the gateway worker launcher and worker process.</summary>
+public static class WorkerLaunchEnvironment
+{
+    /// <summary>Bootstrap nonce used to authenticate the worker handshake.</summary>
+    public const string WorkerNonce = "MXGATEWAY_WORKER_NONCE";
+
+    /// <summary>Per-attempt named-pipe connection timeout in milliseconds.</summary>
+    public const string PipeConnectAttemptTimeoutMilliseconds =
+        "MXGATEWAY_WORKER_PIPE_CONNECT_ATTEMPT_TIMEOUT_MS";
+
+    /// <summary>Bounded wait for a Write/Write2/WriteSecured/WriteSecured2 completion callback in milliseconds.</summary>
+    public const string WriteCompletionWaitMilliseconds =
+        "MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS";
+
+    /// <summary>Capacity of the worker's outbound MXAccess event queue.</summary>
+    public const string EventQueueCapacity = "MXGATEWAY_EVENT_QUEUE_CAPACITY";
+
+    /// <summary>Worker alarm polling cadence in milliseconds.</summary>
+    public const string AlarmPollIntervalMilliseconds = "MXGATEWAY_ALARM_POLL_INTERVAL_MS";
+
+    /// <summary>Maximum alarm records requested in one current-alarm fetch.</summary>
+    public const string MaxAlarmsPerFetch = "MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH";
+}

src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj

@@ -7,7 +7,7 @@
   <PropertyGroup>
     <IsPackable>true</IsPackable>
     <PackageId>ZB.MOM.WW.MxGateway.Contracts</PackageId>
-    <Version>0.2.0</Version>
+    <Version>0.2.1</Version>
     <Authors>Joseph Doherty</Authors>
     <Company>ZB MOM WW</Company>
     <Copyright>Copyright (c) ZB MOM WW. All rights reserved.</Copyright>
@@ -37,7 +37,9 @@
          the wire-identical Galaxy types from the ZB.MOM.WW.GalaxyRepository package. This proto is
          still the generation source of truth for the language clients (Go/Rust/Java/Python compile it
          by path; the .NET client consumes Contracts.Proto.Galaxy.* via this project reference) and for
-         clients/proto/proto-inputs.json. Removing it breaks all five clients — do not delete. -->
+         clients/proto/proto-inputs.json. GalaxyContractParityTests normalizes its descriptor against
+         the descriptor served by the package and fails on wire drift. Removing it breaks all five
+         clients — do not delete. -->
     <Protobuf Include="Protos\galaxy_repository.proto" ProtoRoot="Protos" OutputDir="Generated" GrpcOutputDir="Generated" GrpcServices="Both" />
   </ItemGroup>
 

src/ZB.MOM.WW.MxGateway.IntegrationTests/TestSupport/EmptyAlarmWatchListResolver.cs

@@ -1,4 +1,3 @@
-using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.MxGateway.Server.Alarms;
 using ZB.MOM.WW.MxGateway.Server.Configuration;
 
@@ -19,14 +18,18 @@ public sealed class EmptyAlarmWatchListResolver : IAlarmWatchListResolver
     /// <summary>Shared no-op instance.</summary>
     public static readonly EmptyAlarmWatchListResolver Instance = new();
 
-    private static readonly IReadOnlyList<AlarmSubtagTarget> Empty = [];
+    private static readonly AlarmWatchListResolution Empty = new(
+        [],
+        DiscoveryAttempted: false,
+        DiscoveryFailed: false,
+        DiscoveryFailureMessage: null);
 
     private EmptyAlarmWatchListResolver()
     {
     }
 
     /// <inheritdoc />
-    public Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+    public Task<AlarmWatchListResolution> ResolveAsync(
         AlarmsOptions options,
         CancellationToken cancellationToken = default)
     {

src/ZB.MOM.WW.MxGateway.IntegrationTests/WorkerLiveMxAccessSmokeTests.cs

@@ -514,21 +514,37 @@ public sealed class WorkerLiveMxAccessSmokeTests(ITestOutputHelper output)
             // AuthenticateUser resolves an ArchestrA user id for the WriteSecured call.
             // Credentials are env-overridable so the test honors the gateway's "do not
             // log secrets" rule and works against either MXAccess's own user store or
-            // the LmxOpcUa-baseline GLAuth-bridged ArchestrA identity (admin/admin123).
+            // the LmxOpcUa-baseline GLAuth-bridged ArchestrA identity (admin/password —
+            // see glauth.md; the shared GLAuth's dev-user password is "password", not
+            // the old per-box "admin123").
             MxCommandReply authReply = await fixture.Service.Invoke(
                 CreateAuthenticateUserRequest(sessionId, serverHandle, verifyUser, verifyPassword),
                 new TestServerCallContext()).ConfigureAwait(false);
-            recordedOutput.WriteLine(
-                $"AuthenticateUser status={authReply.ProtocolStatus.Code} hresult={authReply.Hresult} user_id={authReply.AuthenticateUser?.UserId}");
 
-            // AuthenticateUser is allowed to fail (the underlying provider may reject
-            // the credential pair); we use the returned user id if non-zero and fall
-            // back to 0 ("operator only" / no verifier) so the parity assertion holds.
-            int currentUserId = authReply.ProtocolStatus.Code == ProtocolStatusCode.Ok
+            // AuthenticateUser is allowed to fail — MXAccess parity means a rejected
+            // credential is a legitimate reply, not a bug, so this must never be an
+            // Assert. But a silent fall-through to "operator only" (currentUserId 0)
+            // quietly demotes the rest of this test from an authenticated round-trip
+            // to a bare failure-reply-shape check, which a stale rig credential (e.g.
+            // TST-31) would otherwise hide indefinitely in nightly runs. Log the
+            // outcome loudly — never the password (verifyUser only) — so that
+            // degradation is visible in the test output even though it never fails
+            // the test by itself.
+            bool authenticateUserSucceeded = authReply.ProtocolStatus.Code == ProtocolStatusCode.Ok
                 && authReply.AuthenticateUser is not null
-                && authReply.AuthenticateUser.UserId != 0
-                    ? authReply.AuthenticateUser.UserId
-                    : 0;
+                && authReply.AuthenticateUser.UserId != 0;
+            recordedOutput.WriteLine(
+                authenticateUserSucceeded
+                    ? $"AuthenticateUser SUCCEEDED for user={verifyUser} user_id={authReply.AuthenticateUser!.UserId}"
+                    : $"AuthenticateUser FAILED (credential rejected or not recognized by the provider) "
+                        + $"for user={verifyUser} status={authReply.ProtocolStatus.Code} hresult={authReply.Hresult} "
+                        + $"diagnostic={authReply.DiagnosticMessage} -- WriteSecured below will run as an "
+                        + $"unauthenticated (currentUserId=0) failure-reply-shape check only, not an "
+                        + $"authenticated round-trip. If this is unexpected, verify "
+                        + $"MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_USER/_PASSWORD against the rig's ArchestrA "
+                        + $"identity (see glauth.md).");
+
+            int currentUserId = authenticateUserSucceeded ? authReply.AuthenticateUser!.UserId : 0;
 
             MxCommandReply writeSecuredReply = await fixture.Service.Invoke(
                 CreateWriteSecuredRequest(
@@ -1429,7 +1445,7 @@ public sealed class WorkerLiveMxAccessSmokeTests(ITestOutputHelper output)
         string verifyUser = Environment.GetEnvironmentVariable("MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_USER")
             ?? "admin";
         string verifyPassword = Environment.GetEnvironmentVariable("MXGATEWAY_LIVE_MXACCESS_WRITE_SECURED_PASSWORD")
-            ?? "admin123";
+            ?? "password";
         return (verifyUser, verifyPassword);
     }
 

src/ZB.MOM.WW.MxGateway.Server/Alarms/AlarmProviderReasons.cs

@@ -15,4 +15,32 @@ public static class AlarmProviderReasons
     ///     distinguish a forced subtag mode from an unexpected degraded failover.
     /// </summary>
     public const string ForcedSubtag = "Forced subtag mode (configuration)";
+
+    /// <summary>
+    ///     Reason prefix set when the effective mode can need the subtag watch-list
+    ///     (<c>Auto</c> or <c>ForceSubtag</c>) but the list resolved to zero targets, so the
+    ///     subtag provider covers no alarms (GWC-37). In <c>Auto</c> this is a warning about the
+    ///     standby, not about the currently-serving alarm manager, which is why the dashboard
+    ///     renders it against the <c>ALARMMGR</c> mode as a coverage badge rather than a failover.
+    /// </summary>
+    public const string SubtagWatchListEmpty =
+        "Subtag watch-list is empty: the subtag provider covers no alarms";
+
+    /// <summary>
+    ///     Reason prefix set when Galaxy Repository alarm discovery was enabled but failed, so
+    ///     the watch-list carries only what configuration contributed and may be incomplete
+    ///     (GWC-37). Distinct from <see cref="SubtagWatchListEmpty"/>: discovery failing with a
+    ///     usable config-only list is a completeness warning, not a total loss of coverage.
+    /// </summary>
+    public const string SubtagDiscoveryFailed =
+        "Galaxy Repository alarm discovery failed: the subtag watch-list may be incomplete";
+
+    /// <summary>
+    ///     Reason prefix set when a re-resolution at the failover edge produced a different
+    ///     watch-list than the one sent at <c>SubscribeAlarms</c> (GWC-37). The worker keeps the
+    ///     list it was given for the life of the subscription, so the difference is reported
+    ///     rather than applied; a monitor restart re-resolves and re-sends.
+    /// </summary>
+    public const string SubtagWatchListStale =
+        "Subtag watch-list differs from the one the worker is using";
 }

src/ZB.MOM.WW.MxGateway.Server/Alarms/AlarmWatchListResolution.cs

@@ -0,0 +1,29 @@
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+
+namespace ZB.MOM.WW.MxGateway.Server.Alarms;
+
+/// <summary>
+///     The outcome of one subtag watch-list resolution: the composed targets plus enough
+///     provenance for the caller to tell an empty list that means "nothing was configured"
+///     from one that means "discovery was configured and silently produced nothing"
+///     (GWC-37). <see cref="IAlarmWatchListResolver.ResolveAsync"/> deliberately never throws
+///     on a discovery failure, so without this the two are indistinguishable at the call site
+///     and a Galaxy Repository outage at startup can only be found in a log line.
+/// </summary>
+/// <param name="Targets">The resolved watch-list, in order; possibly empty.</param>
+/// <param name="DiscoveryAttempted">
+///     Galaxy Repository discovery was enabled for this resolution
+///     (<c>Fallback:Discovery:UseGalaxyRepository</c>).
+/// </param>
+/// <param name="DiscoveryFailed">
+///     Discovery was attempted and failed, so <paramref name="Targets"/> holds only what
+///     configuration contributed.
+/// </param>
+/// <param name="DiscoveryFailureMessage">
+///     The discovery failure's message, or <c>null</c> when discovery did not fail.
+/// </param>
+public sealed record AlarmWatchListResolution(
+    IReadOnlyList<AlarmSubtagTarget> Targets,
+    bool DiscoveryAttempted,
+    bool DiscoveryFailed,
+    string? DiscoveryFailureMessage);

src/ZB.MOM.WW.MxGateway.Server/Alarms/AlarmWatchListResolver.cs

@@ -31,7 +31,7 @@ public sealed class AlarmWatchListResolver : IAlarmWatchListResolver
     }
 
     /// <inheritdoc />
-    public async Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+    public async Task<AlarmWatchListResolution> ResolveAsync(
         AlarmsOptions options,
         CancellationToken cancellationToken = default)
     {
@@ -39,6 +39,11 @@ public sealed class AlarmWatchListResolver : IAlarmWatchListResolver
 
         AlarmDiscoveryOptions discovery = options.Fallback.Discovery;
 
+        // GWC-37: the caller cannot grade an empty watch-list without knowing whether discovery
+        // was asked to contribute and whether it failed while doing so, because the failure is
+        // deliberately swallowed below.
+        string? discoveryFailureMessage = null;
+
         // Config fallback area used only for explicit IncludeAttributes entries (which
         // carry no discovered area): discovery area, else the default area (may be empty).
         string configFallbackArea = string.IsNullOrEmpty(discovery.Area) ? options.DefaultArea : discovery.Area;
@@ -68,6 +73,7 @@ public sealed class AlarmWatchListResolver : IAlarmWatchListResolver
                 _logger.LogWarning(
                     ex,
                     "Galaxy Repository alarm-attribute discovery failed; continuing with configuration-only watch-list.");
+                discoveryFailureMessage = ex.Message;
                 rows = [];
             }
 
@@ -148,7 +154,11 @@ public sealed class AlarmWatchListResolver : IAlarmWatchListResolver
             _logger.LogDebug("Resolved alarm subtag watch-list with {TargetCount} target(s).", targets.Count);
         }
 
-        return targets;
+        return new AlarmWatchListResolution(
+            targets,
+            DiscoveryAttempted: discovery.UseGalaxyRepository,
+            DiscoveryFailed: discoveryFailureMessage is not null,
+            discoveryFailureMessage);
     }
 
     /// <summary>

src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs

@@ -57,6 +57,21 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
     private string _providerReason = string.Empty;
     private DateTimeOffset _providerSince = DateTimeOffset.UtcNow;
 
+    // GWC-37 subtag-coverage verdict, guarded by _sync: whether the watch-list the worker is
+    // using can actually cover anything, and why not. Independent of _providerDegraded (which
+    // means "the subtag provider is the one serving"): in Auto mode the alarm manager can be
+    // serving perfectly while the standby behind it covers zero alarms, and that is invisible
+    // until the failover that needs it. Folded into BuildProviderStatus so it reaches the feed,
+    // the dashboard badge and every late-joining subscriber rather than only a startup log line.
+    private bool _subtagCoverageMissing;
+    private string _subtagCoverageReason = string.Empty;
+
+    // The full canonical watch-list fingerprint acknowledged by the worker and its alarm
+    // references, guarded by _sync. The fingerprint advances only after an OK subscribe/update
+    // reply, so a rejected replacement remains material and is retried on the next refresh edge.
+    private string _acknowledgedWatchListFingerprint = string.Empty;
+    private IReadOnlyCollection<string> _sentWatchListReferences = [];
+
     // Whether the worker's most recent reconcile fetch was capped, guarded by _sync.
     // Written only by ApplyReconcile (and cleared with the cache), so it describes the last full
     // reconcile — not necessarily the current _alarms contents, which live transitions keep moving
@@ -329,12 +344,22 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
 
     private async Task SubscribeAlarmsAsync(string sessionId, string subscription, CancellationToken cancellationToken)
     {
-        IReadOnlyList<AlarmSubtagTarget> watchList = await _watchListResolver
+        AlarmWatchListResolution resolution = await _watchListResolver
             .ResolveAsync(_options, cancellationToken)
             .ConfigureAwait(false);
+        IReadOnlyList<AlarmSubtagTarget> watchList = resolution.Targets;
 
         AlarmProviderMode forcedMode = MapForcedMode(_options.Fallback.Mode);
 
+        // GWC-37: grade the coverage before the command goes out, so a Galaxy Repository outage at
+        // startup is a standing status on the feed instead of one log line an operator reads weeks
+        // later — when the failover that needed the watch-list finds it empty. Broadcast because
+        // feed subscribers outlive the monitor's worker session and may already be attached.
+        lock (_sync)
+        {
+            SetSubtagCoverage(GradeSubtagCoverage(forcedMode, resolution, staleAgainstSent: false), broadcast: true);
+        }
+
         _logger.LogInformation(
             "Alarm subscribe: forcedMode={ForcedMode} configMode={ConfigMode} watchList={WatchListCount}.",
             forcedMode, _options.Fallback.Mode, watchList.Count);
@@ -347,6 +372,7 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         {
             SubscriptionExpression = subscription,
             ForcedMode = forcedMode,
+            FallbackEnabled = CanUseSubtagFallback(forcedMode),
             Failover = new AlarmFailoverConfig
             {
                 ConsecutiveFailureThreshold = _options.Fallback.ConsecutiveFailureThreshold,
@@ -377,6 +403,11 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
                 ?? $"status {code}";
             throw new InvalidOperationException($"Worker rejected SubscribeAlarms: {diagnostic}");
         }
+
+        lock (_sync)
+        {
+            AcknowledgeWatchList(watchList);
+        }
     }
 
     private async Task ReconcileLoopAsync(string sessionId, CancellationToken cancellationToken)
@@ -389,6 +420,8 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
             {
                 try
                 {
+                    await RefreshAlarmWatchListAsync(sessionId, broadcast: true, cancellationToken)
+                        .ConfigureAwait(false);
                     await ReconcileAsync(sessionId, cancellationToken).ConfigureAwait(false);
                 }
                 catch (OperationCanceledException)
@@ -518,6 +551,16 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         AlarmProviderMode toMode = change.Mode;
         string reason = change.Reason ?? string.Empty;
 
+        // The failover edge is the moment the subtag watch-list stops being theoretical. Refresh
+        // it before publishing the status frame so recovered discovery is applied to the already
+        // active standby and the operator sees the acknowledged coverage verdict atomically with
+        // the provider switch.
+        if (toMode == AlarmProviderMode.Subtag)
+        {
+            await RefreshAlarmWatchListAsync(sessionId, broadcast: false, cancellationToken)
+                .ConfigureAwait(false);
+        }
+
         AlarmProviderStatus status;
         int fromModeInt;
         lock (_sync)
@@ -565,14 +608,221 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         }
     }
 
+    private async Task RefreshAlarmWatchListAsync(
+        string sessionId,
+        bool broadcast,
+        CancellationToken cancellationToken)
+    {
+        AlarmProviderMode forcedMode = MapForcedMode(_options.Fallback.Mode);
+        if (!CanUseSubtagFallback(forcedMode))
+        {
+            return;
+        }
+
+        AlarmWatchListResolution resolution;
+        try
+        {
+            resolution = await _watchListResolver.ResolveAsync(_options, cancellationToken).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception exception)
+        {
+            _logger.LogWarning(
+                exception,
+                "Re-resolving the alarm subtag watch-list failed; keeping the last acknowledged watch list.");
+            return;
+        }
+
+        string resolvedFingerprint = CanonicalWatchListFingerprint(resolution.Targets);
+        string acknowledgedFingerprint;
+        lock (_sync)
+        {
+            acknowledgedFingerprint = _acknowledgedWatchListFingerprint;
+        }
+
+        if (string.Equals(resolvedFingerprint, acknowledgedFingerprint, StringComparison.Ordinal))
+        {
+            lock (_sync)
+            {
+                SetSubtagCoverage(
+                    GradeSubtagCoverage(forcedMode, resolution, staleAgainstSent: false),
+                    broadcast);
+            }
+            return;
+        }
+
+        UpdateAlarmWatchListCommand update = new();
+        update.WatchList.AddRange(resolution.Targets);
+        WorkerCommandReply reply = await _sessionManager.InvokeAsync(
+                sessionId,
+                new WorkerCommand
+                {
+                    Command = new MxCommand
+                    {
+                        Kind = MxCommandKind.UpdateAlarmWatchList,
+                        UpdateAlarmWatchList = update,
+                    },
+                },
+                cancellationToken)
+            .ConfigureAwait(false);
+
+        ProtocolStatusCode? code = reply.Reply?.ProtocolStatus?.Code;
+        lock (_sync)
+        {
+            if (code == ProtocolStatusCode.Ok)
+            {
+                AcknowledgeWatchList(resolution.Targets);
+                SetSubtagCoverage(
+                    GradeSubtagCoverage(forcedMode, resolution, staleAgainstSent: false),
+                    broadcast);
+                return;
+            }
+
+            string diagnostic = reply.Reply?.DiagnosticMessage
+                ?? reply.Reply?.ProtocolStatus?.Message
+                ?? $"status {code}";
+            string reason = GradeSubtagCoverage(forcedMode, resolution, staleAgainstSent: true);
+            SetSubtagCoverage($"{reason}; worker rejected watch-list update ({diagnostic})", broadcast);
+        }
+    }
+
+    private bool CanUseSubtagFallback(AlarmProviderMode forcedMode) =>
+        forcedMode != AlarmProviderMode.Alarmmgr
+        && (forcedMode == AlarmProviderMode.Subtag
+            || _options.Fallback.Discovery.UseGalaxyRepository
+            || _options.Fallback.Discovery.IncludeAttributes.Length > 0);
+
+    // Caller holds _sync.
+    private void AcknowledgeWatchList(IReadOnlyList<AlarmSubtagTarget> watchList)
+    {
+        _acknowledgedWatchListFingerprint = CanonicalWatchListFingerprint(watchList);
+        _sentWatchListReferences = watchList
+            .Select(target => target.AlarmFullReference)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+    }
+
+    private static string CanonicalWatchListFingerprint(IEnumerable<AlarmSubtagTarget> watchList) =>
+        string.Join(
+            "\n",
+            watchList
+                .Select(target => string.Join(
+                    "|",
+                    FingerprintPart(target.AlarmFullReference),
+                    FingerprintPart(target.SourceObjectReference),
+                    FingerprintPart(target.ActiveSubtag),
+                    FingerprintPart(target.AckedSubtag),
+                    FingerprintPart(target.AckCommentSubtag),
+                    FingerprintPart(target.PrioritySubtag)))
+                .Order(StringComparer.Ordinal));
+
+    private static string FingerprintPart(string? value)
+    {
+        string normalized = value ?? string.Empty;
+        return $"{normalized.Length}:{normalized}";
+    }
+
+    // Grades one resolution against the effective mode. Returns the reason the subtag coverage is
+    // unsound, or an empty string when it is sound (or irrelevant, as under ForceAlarmManager).
+    // Empty targets are the total-loss case; a failed discovery with a usable config-only list is
+    // a completeness warning; drift is reported separately because the worker cannot be updated.
+    private string GradeSubtagCoverage(
+        AlarmProviderMode forcedMode,
+        AlarmWatchListResolution resolution,
+        bool staleAgainstSent)
+    {
+        // ForceAlarmManager never builds a subtag consumer, so its watch-list is genuinely unused.
+        if (forcedMode == AlarmProviderMode.Alarmmgr)
+        {
+            return string.Empty;
+        }
+
+        // Nothing was asked of discovery and nothing was configured: subtag fallback is simply not
+        // in use in this deployment (Auto with an empty list subscribes alarmmgr-only), so there is
+        // no coverage to warn about.
+        if (resolution.Targets.Count == 0
+            && !resolution.DiscoveryAttempted
+            && _options.Fallback.Discovery.IncludeAttributes.Length == 0
+            && forcedMode != AlarmProviderMode.Subtag)
+        {
+            return string.Empty;
+        }
+
+        List<string> reasons = [];
+        if (resolution.Targets.Count == 0)
+        {
+            reasons.Add(AlarmProviderReasons.SubtagWatchListEmpty);
+        }
+
+        if (resolution.DiscoveryFailed)
+        {
+            reasons.Add(resolution.DiscoveryFailureMessage is { Length: > 0 } message
+                ? $"{AlarmProviderReasons.SubtagDiscoveryFailed} ({message})"
+                : AlarmProviderReasons.SubtagDiscoveryFailed);
+        }
+
+        if (staleAgainstSent)
+        {
+            reasons.Add(
+                $"{AlarmProviderReasons.SubtagWatchListStale} ({resolution.Targets.Count} target(s) now "
+                + $"resolve against {_sentWatchListReferences.Count} acknowledged by the worker)");
+        }
+
+        return string.Join("; ", reasons);
+    }
+
+    // Caller holds _sync. Applies a coverage verdict, logging and (optionally) broadcasting only
+    // when it actually changed so a stable degraded state does not repeat a frame every pass.
+    private void SetSubtagCoverage(string reason, bool broadcast)
+    {
+        bool missing = reason.Length > 0;
+        if (missing == _subtagCoverageMissing && string.Equals(reason, _subtagCoverageReason, StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        _subtagCoverageMissing = missing;
+        _subtagCoverageReason = reason;
+
+        if (missing)
+        {
+            _logger.LogWarning("Alarm subtag coverage is unsound: {Reason}", reason);
+        }
+        else
+        {
+            _logger.LogInformation("Alarm subtag coverage is sound.");
+        }
+
+        if (broadcast)
+        {
+            BroadcastToAll(new AlarmFeedMessage { ProviderStatus = BuildProviderStatus() });
+        }
+    }
+
     // Caller holds _sync. Builds an AlarmProviderStatus snapshot of the current state.
+    //
+    // GWC-37: degraded is the OR of "the subtag provider is the one serving" and "the subtag
+    // watch-list cannot cover anything". The second is what makes an empty watch-list visible in
+    // Auto mode, where the alarm manager is serving happily and the standby behind it is empty.
+    // The reasons are concatenated when both apply, which is the worst case worth naming loudly:
+    // failed over to a provider that covers nothing.
     private AlarmProviderStatus BuildProviderStatus()
     {
+        bool degraded = _providerDegraded || _subtagCoverageMissing;
+        string reason = (_providerReason, _subtagCoverageReason) switch
+        {
+            ("", var coverage) => coverage,
+            (var mode, "") => mode,
+            (var mode, var coverage) => $"{mode} — {coverage}",
+        };
+
         return new AlarmProviderStatus
         {
             Mode = _providerMode,
-            Degraded = _providerDegraded,
-            Reason = _providerReason,
+            Degraded = degraded,
+            Reason = reason,
             Since = Timestamp.FromDateTimeOffset(_providerSince),
         };
     }
@@ -671,15 +921,17 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
                         new AlarmFeedMessage { Transition = TransitionFromSnapshot(incoming.Value, AlarmTransitionKind.Raise) },
                         incoming.Key);
                 }
-                else if (existing.CurrentState != incoming.Value.CurrentState
-                    && incoming.Value.CurrentState == AlarmConditionState.ActiveAcked)
+                else if (existing.CurrentState != incoming.Value.CurrentState)
                 {
-                    // The alarm was already known but the worker now reports it acknowledged: the
-                    // live Acknowledge transition never reached the feed. Without this the acked
-                    // state is absorbed silently by the snapshot replace below and subscribers show
-                    // the alarm unacked until it clears.
+                    // The alarm was already known but the worker now reports a different state. An
+                    // ActiveAcked snapshot repairs a missed Acknowledge. Any other incoming active
+                    // state repairs a missed Raise for the incoming instance (including an
+                    // acknowledged alarm reference that was cleared and re-raised between passes).
+                    AlarmTransitionKind kind = incoming.Value.CurrentState == AlarmConditionState.ActiveAcked
+                        ? AlarmTransitionKind.Acknowledge
+                        : AlarmTransitionKind.Raise;
                     Broadcast(
-                        new AlarmFeedMessage { Transition = TransitionFromSnapshot(incoming.Value, AlarmTransitionKind.Acknowledge) },
+                        new AlarmFeedMessage { Transition = TransitionFromSnapshot(incoming.Value, kind) },
                         incoming.Key);
                 }
             }

src/ZB.MOM.WW.MxGateway.Server/Alarms/IAlarmWatchListResolver.cs

@@ -18,13 +18,15 @@ public interface IAlarmWatchListResolver
     /// <param name="options">Alarm configuration carrying discovery and subtag-name settings.</param>
     /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
     /// <returns>
-    ///     The resolved <see cref="AlarmSubtagTarget"/> watch-list, possibly empty.
+    ///     The resolved <see cref="AlarmSubtagTarget"/> watch-list, possibly empty, together
+    ///     with the discovery provenance the caller needs to grade it.
     ///     Discovery being unavailable never throws — it yields an empty (or
-    ///     config-only) list and the caller decides what to do with it. Cancellation
+    ///     config-only) list with <see cref="AlarmWatchListResolution.DiscoveryFailed"/> set,
+    ///     and the caller decides what to do with it. Cancellation
     ///     is the one exception: a triggered <paramref name="cancellationToken"/>
     ///     still propagates an <see cref="OperationCanceledException"/>.
     /// </returns>
-    Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+    Task<AlarmWatchListResolution> ResolveAsync(
         AlarmsOptions options,
         CancellationToken cancellationToken = default);
 }

src/ZB.MOM.WW.MxGateway.Server/Dashboard/AuthenticatedDashboardRoleHandler.cs

@@ -0,0 +1,34 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
+
+/// <summary>
+/// Handler for <see cref="AuthenticatedDashboardRoleRequirement"/>: succeeds only when the caller
+/// is authenticated AND holds one of the requirement's roles. It reads no options at all, which
+/// is the point — there is no configuration value that can turn this into a bypass (SEC-40).
+/// </summary>
+public sealed class AuthenticatedDashboardRoleHandler
+    : AuthorizationHandler<AuthenticatedDashboardRoleRequirement>
+{
+    /// <inheritdoc />
+    protected override Task HandleRequirementAsync(
+        AuthorizationHandlerContext context,
+        AuthenticatedDashboardRoleRequirement requirement)
+    {
+        if (context.User.Identity?.IsAuthenticated != true)
+        {
+            return Task.CompletedTask;
+        }
+
+        foreach (string role in requirement.RequiredRoles)
+        {
+            if (context.User.IsInRole(role))
+            {
+                context.Succeed(requirement);
+                return Task.CompletedTask;
+            }
+        }
+
+        return Task.CompletedTask;
+    }
+}

src/ZB.MOM.WW.MxGateway.Server/Dashboard/AuthenticatedDashboardRoleRequirement.cs

@@ -0,0 +1,39 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
+
+/// <summary>
+/// Requirement satisfied ONLY by an authenticated principal holding one of
+/// <see cref="RequiredRoles"/> as a real role claim. Unlike
+/// <see cref="DashboardAuthorizationRequirement"/> there is no environment bypass: it is a
+/// distinct requirement type, so <see cref="DashboardAuthorizationHandler"/> —
+/// an <c>AuthorizationHandler&lt;DashboardAuthorizationRequirement&gt;</c> — is never invoked for
+/// it and its <c>Authentication:Mode=Disabled</c> / anonymous-localhost arms cannot reach it.
+/// The type distinction is the enforcement; adding a bypass arm to the other handler cannot leak
+/// into this one by accident.
+/// </summary>
+/// <remarks>
+/// Introduced for SEC-40 to gate the alarm feed (<c>AlarmsHub</c> and the <c>/alarms</c> page),
+/// which is gateway-central and session-less and therefore carries no per-session provenance the
+/// SEC-25 tag ACL could scope it by. Requiring a real dashboard role claim is the narrowing that
+/// is actually available: it keeps galaxy-wide alarm metadata — alarm reference (a full tag path),
+/// state, severity, category, area, acknowledging operator — away from the read-only environment
+/// bypasses, which exist for local development and unauthenticated deployments rather than as a
+/// grant of plant-wide visibility. The same pattern the shared Secrets UI relies on: a policy the
+/// dashboard bypass handler cannot satisfy because the requirement type differs.
+/// </remarks>
+/// <param name="requiredRoles">Roles any one of which satisfies the requirement.</param>
+public sealed class AuthenticatedDashboardRoleRequirement(IReadOnlyList<string> requiredRoles)
+    : IAuthorizationRequirement
+{
+    /// <summary>Gets the roles, any one of which satisfies this requirement.</summary>
+    public IReadOnlyList<string> RequiredRoles { get; } = requiredRoles;
+
+    /// <summary>
+    /// Gets the requirement satisfied by an authenticated caller holding either dashboard role.
+    /// Same role set as <see cref="DashboardAuthorizationRequirement.AnyDashboardRole"/>; the
+    /// difference is entirely that no environment bypass applies.
+    /// </summary>
+    public static AuthenticatedDashboardRoleRequirement AnyDashboardRole { get; } =
+        new([DashboardRoles.Admin, DashboardRoles.Viewer]);
+}

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Components/Layout/MainLayout.razor

@@ -12,7 +12,14 @@
             <NavRailItem Href="/sessions" Text="Sessions" />
             <NavRailItem Href="/workers" Text="Workers" />
             <NavRailItem Href="/events" Text="Events" />
-            <NavRailItem Href="/alarms" Text="Alarms" />
+            @* Gated on the SAME policy the /alarms page and AlarmsHub enforce (SEC-40), for the
+               same reason the Secrets link below is: the page denies an environment-bypass
+               caller outright, so an ungated link would be a dead end. *@
+            <AuthorizeView Policy="@DashboardAuthenticationDefaults.AlarmsPolicy">
+                <Authorized>
+                    <NavRailItem Href="/alarms" Text="Alarms" />
+                </Authorized>
+            </AuthorizeView>
         </NavRailSection>
         <NavRailSection Title="Galaxy" Key="galaxy">
             <NavRailItem Href="/galaxy" Text="Repository" />

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Components/Pages/AlarmsPage.razor

@@ -1,6 +1,15 @@
 @page "/alarms"
 @implements IAsyncDisposable
+@using Microsoft.AspNetCore.Authorization
 @using ZB.MOM.WW.MxGateway.Server.Alarms
+@* SEC-40: the alarm feed needs a real authenticated dashboard role, not the read-only
+   environment bypasses (Authentication:Mode=Disabled, anonymous localhost) that satisfy the
+   ViewerPolicy MapRazorComponents<App>() applies. This page reads the gateway-central alarm
+   monitor in process, exactly the surface AlarmsHub serves to external clients, so it carries the
+   SAME policy as the hub — gating only the hub would leave the disclosure one navigation away.
+   Alarm metadata stays galaxy-wide for an authenticated Viewer: the monitor has no per-session
+   provenance, so the SEC-25 tag ACL has nothing to intersect. *@
+@attribute [Authorize(Policy = DashboardAuthenticationDefaults.AlarmsPolicy)]
 @inject IDashboardLiveDataService LiveData
 @inject IOptions<GatewayOptions> GatewayOptions
 @inject IGatewayAlarmService AlarmService

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAlarmProviderStatus.cs

@@ -30,6 +30,14 @@ public sealed record DashboardAlarmProviderStatus(
     /// </summary>
     public const string ForcedSubtagLabel = "Subtag monitoring (forced)";
 
+    /// <summary>
+    ///     Badge label shown when the alarm manager is serving normally but the subtag standby
+    ///     behind it covers nothing — an empty or undiscoverable watch-list (GWC-37). The feed is
+    ///     healthy today; what is degraded is the fallback that would take over tomorrow, so the
+    ///     badge names the standby rather than claiming the feed has failed over.
+    /// </summary>
+    public const string NoSubtagStandbyLabel = "Alarm Manager (no subtag standby)";
+
     private const string HealthyBadge = "bg-success";
     private const string DegradedBadge = "bg-warning text-dark";
 
@@ -69,8 +77,18 @@ public sealed record DashboardAlarmProviderStatus(
             && status.Mode == AlarmProviderMode.Subtag
             && string.Equals(reason, AlarmProviderReasons.ForcedSubtag, StringComparison.Ordinal);
 
-        string label = !degraded ? AlarmManagerLabel : forced ? ForcedSubtagLabel : DegradedLabel;
-        string badge = !degraded ? HealthyBadge : forced ? ForcedSubtagBadge : DegradedBadge;
+        // GWC-37: degraded WITHOUT subtag mode means the alarm manager is still serving and the
+        // standby is the unsound half. "Subtag monitoring (degraded)" would misreport which
+        // provider is live, so this state gets its own label; the amber badge is shared because
+        // the operator action — fix discovery — is equally overdue in both.
+        bool standbyOnlyWarning = degraded && status.Mode != AlarmProviderMode.Subtag;
+
+        string label = !degraded
+            ? AlarmManagerLabel
+            : standbyOnlyWarning ? NoSubtagStandbyLabel : forced ? ForcedSubtagLabel : DegradedLabel;
+        string badge = !degraded
+            ? HealthyBadge
+            : standbyOnlyWarning ? DegradedBadge : forced ? ForcedSubtagBadge : DegradedBadge;
 
         return new DashboardAlarmProviderStatus(
             Mode: status.Mode,

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs

@@ -33,6 +33,18 @@ public static class DashboardAuthenticationDefaults
     /// </summary>
     public const string HubClientsPolicy = "MxGateway.Dashboard.HubClients";
 
+    /// <summary>
+    /// Policy guarding the alarm feed — the <c>AlarmsHub</c> SignalR surface and the
+    /// <c>/alarms</c> page that reads the same central monitor in process (SEC-40). Accepts the
+    /// same two schemes as <see cref="HubClientsPolicy"/> but carries
+    /// <see cref="AuthenticatedDashboardRoleRequirement"/>, a requirement type
+    /// <see cref="DashboardAuthorizationHandler"/> does not handle, so the environment bypasses
+    /// (<c>Authentication:Mode=Disabled</c> and anonymous localhost) cannot satisfy it. The alarm
+    /// feed is galaxy-wide and session-less, so unlike a session event stream there is no tag
+    /// intersection to narrow it with — requiring a real role claim is the available narrowing.
+    /// </summary>
+    public const string AlarmsPolicy = "MxGateway.Dashboard.Alarms";
+
     public const string LdapGroupClaimType = "mxgateway:ldap_group";
     public const string KeyPrefixClaimType = "mxgateway:key_prefix";
 
@@ -40,9 +52,13 @@ public static class DashboardAuthenticationDefaults
     /// Claim carrying one dashboard event-visibility tag the caller is granted (SEC-25). Stamped
     /// at cookie login by <see cref="DashboardAuthenticator"/> and at hub-token mint by
     /// <see cref="HubTokenService"/>, both resolving the caller's LDAP groups through
-    /// <c>MxGateway:Dashboard:GroupToTag</c>; read by <see cref="IDashboardSessionAcl"/>. A
-    /// principal carrying none of these claims is an empty-grant Viewer, which is the fail-closed
-    /// default. Visibility only — it never grants data access.
+    /// <c>MxGateway:Dashboard:GroupToTag</c>. Since SEC-41 <see cref="IDashboardSessionAcl"/> reads
+    /// this claim only as a FALLBACK, for a principal that carries no
+    /// <see cref="LdapGroupClaimType"/> claims to re-resolve from (the hub-token principal, whose
+    /// payload carries tags but not groups); a cookie principal is re-resolved against current
+    /// options instead, so a stamped tag cannot outlive a config-revoked grant. A principal
+    /// carrying neither kind of claim is an empty-grant Viewer, which is the fail-closed default.
+    /// Visibility only — it never grants data access.
     /// </summary>
     public const string DashboardTagClaimType = "zb:dashboardtag";
 

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs

@@ -104,9 +104,11 @@ public static class DashboardEndpointRouteBuilderExtensions
             .AllowAnonymous()
             .WithName("DashboardAccessDenied");
 
-        // SignalR hubs. Authorization is enforced on the hub class via
-        // [Authorize(Policy = HubClientsPolicy)] so the policy accepts either
-        // the dashboard cookie or a HubToken bearer.
+        // SignalR hubs. Authorization is enforced on the hub class via [Authorize], so both
+        // policies below accept either the dashboard cookie or a HubToken bearer. Snapshot and
+        // events use HubClientsPolicy; AlarmsHub uses AlarmsPolicy, which additionally requires a
+        // real authenticated dashboard role (SEC-40) — see AlarmsHub for why the alarm feed is
+        // gated harder than the session-scoped ones.
         endpoints.MapHub<DashboardSnapshotHub>("/hubs/snapshot");
         endpoints.MapHub<AlarmsHub>("/hubs/alarms");
         endpoints.MapHub<EventsHub>("/hubs/events");

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs

@@ -177,8 +177,20 @@ public static class DashboardServiceCollectionExtensions
                         DashboardAuthenticationDefaults.AuthenticationScheme,
                         DashboardAuthenticationDefaults.HubAuthenticationScheme)
                     .AddRequirements(DashboardAuthorizationRequirement.AnyDashboardRole));
+            // SEC-40. Same two schemes as HubClientsPolicy (the alarm feed has an in-page reader
+            // and an external hub reader), but a requirement type DashboardAuthorizationHandler
+            // does not handle, so neither Authentication:Mode=Disabled nor anonymous localhost
+            // can satisfy it. Galaxy-wide alarm metadata therefore needs a real dashboard role.
+            authorization.AddPolicy(
+                DashboardAuthenticationDefaults.AlarmsPolicy,
+                policy => policy
+                    .AddAuthenticationSchemes(
+                        DashboardAuthenticationDefaults.AuthenticationScheme,
+                        DashboardAuthenticationDefaults.HubAuthenticationScheme)
+                    .AddRequirements(AuthenticatedDashboardRoleRequirement.AnyDashboardRole));
         });
         services.AddSingleton<IAuthorizationHandler, DashboardAuthorizationHandler>();
+        services.AddSingleton<IAuthorizationHandler, AuthenticatedDashboardRoleHandler>();
 
         return services;
     }

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSessionAcl.cs

@@ -26,22 +26,53 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
 /// (ordinal-ignore-case).</description></item>
 /// </list>
 /// <para>
-/// Granted tags are read from the caller's <see cref="DashboardAuthenticationDefaults.DashboardTagClaimType"/>
-/// claims, stamped at login (<see cref="DashboardAuthenticator"/>) or at hub-token mint
-/// (<see cref="HubTokenService"/>). A principal with no such claims — anonymous localhost included —
-/// is an empty-grant Viewer.
+/// <strong>Where the grant comes from (SEC-41).</strong> The grant is re-resolved on every call
+/// from the caller's <see cref="DashboardAuthenticationDefaults.LdapGroupClaimType"/> claims
+/// through <c>MxGateway:Dashboard:GroupToTag</c> as it stands in the currently bound options —
+/// the same single <see cref="DashboardGroupTagMapping.MapGroupsToTags"/> call
+/// <see cref="HubTokenService.Issue(ClaimsPrincipal)"/> makes at token mint. It deliberately does
+/// NOT trust the <see cref="DashboardAuthenticationDefaults.DashboardTagClaimType"/> claims
+/// stamped into the cookie at login: those were resolved under whatever map was bound when the
+/// user signed in, and the auth cookie survives the gateway restart that applies a
+/// <c>GroupToTag</c> edit (options bind once at startup; data-protection keys persist). Trusting
+/// them let a revoked grant live on for the sliding 8-hour cookie life, renewable indefinitely by
+/// activity, on the one seam — cookie-authenticated — that the 5-minute hub-token bound did not
+/// cover.
+/// </para>
+/// <para>
+/// <strong>Fallback.</strong> A principal carrying no group claims at all falls back to its
+/// stamped tag claims. That arm exists for the hub-token principal: <see cref="HubTokenService"/>
+/// re-resolves the grant at mint and rehydrates it as tag claims only — the token payload carries
+/// no LDAP groups — so re-resolution has already happened for that caller, one token lifetime ago
+/// at worst. The fallback cannot re-open the cookie hole it replaces, because a cookie principal
+/// with a tag claim always also carries the group claims it was derived from
+/// (<see cref="DashboardAuthenticator"/> stamps both from one group list), and a login that
+/// yielded no groups yields no tags either. A principal with neither kind of claim — anonymous
+/// localhost included — is an empty-grant Viewer.
+/// </para>
+/// <para>
+/// <strong>Revocation bounds this produces</strong> (mirrored in
+/// <c>docs/GatewayDashboardDesign.md</c>): a <c>GroupToTag</c> entry removed from config takes
+/// effect on the next subscribe after the restart that rebinds options, on both seams; an LDAP
+/// group-membership revocation takes effect when the principal is rebuilt — at re-login (bounded
+/// by the cookie's sliding 8-hour idle life) for the cookie seam, and within one 5-minute token
+/// lifetime for the hub-token seam; an already-open subscription is never re-checked and lives
+/// until it drops.
 /// </para>
 /// <para>
 /// This sits on the <em>subscribe</em> path, not the per-event path, and must stay cheap enough to
-/// keep it there: the only per-call work is the claim scan plus a session-registry lookup, with no
-/// intermediate collection built. A per-event re-check is deliberately not needed — a joined SignalR
+/// keep it there: the only per-call work is a claim scan, the group→tag map lookup, and a
+/// session-registry lookup. A per-event re-check is deliberately not needed — a joined SignalR
 /// group and an in-process subscription are both per-session, and <see cref="GatewaySession.Tags"/>
 /// is immutable for the session's life, so the decision taken at subscribe time cannot go stale
 /// while the subscription lives.
 /// </para>
 /// </remarks>
 /// <param name="sessionManager">Registry the session id is resolved against.</param>
-/// <param name="options">Gateway options supplying <c>Dashboard:UntaggedSessionVisibility</c>.</param>
+/// <param name="options">
+/// Gateway options supplying <c>Dashboard:UntaggedSessionVisibility</c> and the
+/// <c>Dashboard:GroupToTag</c> map the caller's grant is re-resolved through.
+/// </param>
 public sealed class DashboardSessionAcl(
     ISessionManager sessionManager,
     IOptions<GatewayOptions> options) : IDashboardSessionAcl
@@ -64,14 +95,53 @@ public sealed class DashboardSessionAcl(
             return false;
         }
 
+        DashboardOptions dashboard = options.Value.Dashboard;
+
         if (session.Tags.Count == 0)
         {
-            return options.Value.Dashboard.UntaggedSessionVisibility == UntaggedSessionVisibility.AllViewers;
+            return dashboard.UntaggedSessionVisibility == UntaggedSessionVisibility.AllViewers;
         }
 
-        // Session.Tags is an ordinal-ignore-case set, so the containment test carries the
-        // comparison; scanning the claims (rather than materializing the grant) keeps this
-        // allocation-free beyond the claim enumerator.
+        return GrantIntersectsSessionTags(principal, session, dashboard);
+    }
+
+    private static bool GrantIntersectsSessionTags(
+        ClaimsPrincipal principal,
+        GatewaySession session,
+        DashboardOptions dashboard)
+    {
+        // Collected rather than streamed because MapGroupsToTags takes the whole group list;
+        // the list stays null (no allocation) for the hub-token principal, which carries none.
+        List<string>? groups = null;
+        foreach (Claim groupClaim in principal.FindAll(DashboardAuthenticationDefaults.LdapGroupClaimType))
+        {
+            (groups ??= []).Add(groupClaim.Value);
+        }
+
+        if (groups is not null)
+        {
+            // SEC-41: current options, not the login-time snapshot. MapGroupsToTags returns an
+            // OrdinalIgnoreCase set, so probing it with the session's tags carries the
+            // case-insensitive comparison in the same direction the claim scan below does.
+            IReadOnlySet<string> granted = DashboardGroupTagMapping.MapGroupsToTags(
+                groups,
+                dashboard.GroupToTag);
+
+            foreach (string sessionTag in session.Tags)
+            {
+                if (granted.Contains(sessionTag))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        // No group claims: the hub-token arm documented on the class. Session.Tags is an
+        // ordinal-ignore-case set, so the containment test carries the comparison; scanning the
+        // claims (rather than materializing the grant) keeps this allocation-free beyond the
+        // claim enumerator.
         foreach (Claim tagClaim in principal.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType))
         {
             if (session.Tags.Contains(tagClaim.Value))

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/AlarmsHub.cs

@@ -9,7 +9,18 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
 /// <see cref="AllAlarmsGroup"/> on connect and receive every
 /// <c>AlarmFeedMessage</c> the monitor emits.
 /// </summary>
-[Authorize(Policy = DashboardAuthenticationDefaults.HubClientsPolicy)]
+/// <remarks>
+/// The feed is galaxy-wide: the alarm monitor is gateway-central and its messages carry no
+/// session provenance, so the SEC-25 per-session tag ACL that scopes <c>EventsHub</c> has nothing
+/// to intersect here and is deliberately not applied — every authenticated Viewer sees the whole
+/// subscription expression's alarm metadata. What SEC-40 tightened instead is the entry gate:
+/// <see cref="DashboardAuthenticationDefaults.AlarmsPolicy"/> rather than the
+/// <see cref="DashboardAuthenticationDefaults.HubClientsPolicy"/> the other hubs use, so the
+/// read-only environment bypasses (<c>Authentication:Mode=Disabled</c>, anonymous localhost) no
+/// longer receive the feed. The <c>/alarms</c> page carries the same policy — the two readers of
+/// one monitor must not disagree about who may see it.
+/// </remarks>
+[Authorize(Policy = DashboardAuthenticationDefaults.AlarmsPolicy)]
 public sealed class AlarmsHub : Hub
 {
     public const string AllAlarmsGroup = "__alarms__";

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/AlarmsHubPublisher.cs

@@ -22,6 +22,15 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
 /// The source message is never mutated: it fans out from one feed to the gRPC
 /// <c>StreamAlarms</c> subscribers and the alarms page as well, and none of
 /// those audiences is subject to this dashboard-display flag.
+/// <para>
+/// The broadcast stays deliberately unfiltered (SEC-40). Audience is decided once, at hub
+/// admission — <see cref="AlarmsHub"/> carries
+/// <see cref="DashboardAuthenticationDefaults.AlarmsPolicy"/>, so only an authenticated caller
+/// with a real dashboard role is ever in <see cref="AlarmsHub.AllAlarmsGroup"/> — and the alarm
+/// monitor is gateway-central with no per-session provenance, so there is no per-connection
+/// narrowing this loop could apply even in principle. Adding a filter here would imply a
+/// per-caller scope the feed does not carry.
+/// </para>
 /// </remarks>
 /// <param name="alarmService">The gateway's central alarm feed.</param>
 /// <param name="hubContext">Hub context used to broadcast to the alarms group.</param>

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -150,6 +150,12 @@ public static class GatewayApplication
         builder.Services.Configure<AuthorizationOptions>(o => o.AddSecretsAuthorization());
         // Register the gateway's browse-scope provider before AddZbGalaxyRepository so the
         // library's TryAddSingleton default (NullGalaxyBrowseScopeProvider) does not win.
+        // The provider depends on GatewayGrpcAuthorizationInterceptor (registered globally above)
+        // having pushed the ambient identity before the library's galaxy service runs. That
+        // ordering is still required, but it is no longer trusted silently: with
+        // Authentication:Mode=ApiKey the provider denies with PermissionDenied and logs the broken
+        // invariant when the identity is absent, instead of resolving to the full hierarchy
+        // (GWC-38). Under Mode=Disabled identity-absent is expected and stays unscoped.
         builder.Services.AddSingleton<ZB.MOM.WW.GalaxyRepository.Grpc.IGalaxyBrowseScopeProvider,
             Security.Authorization.GatewayBrowseScopeProvider>();
 

src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs

@@ -1051,6 +1051,7 @@ public sealed class MxAccessGatewayService(
         {
             WorkerClientErrorCode.CommandTimeout => StatusCode.DeadlineExceeded,
             WorkerClientErrorCode.GatewayShutdown => StatusCode.Cancelled,
+            WorkerClientErrorCode.CallerCancelled => StatusCode.Cancelled,
             WorkerClientErrorCode.InvalidState => StatusCode.FailedPrecondition,
             WorkerClientErrorCode.ProtocolViolation => StatusCode.Internal,
             WorkerClientErrorCode.CommandTooLarge => StatusCode.ResourceExhausted,

src/ZB.MOM.WW.MxGateway.Server/Metrics/GatewayMetrics.cs

@@ -43,7 +43,7 @@ public sealed class GatewayMetrics : IDisposable
     private readonly ConcurrentDictionary<long, Func<int>> _eventStreamBacklogSources = new();
     private long _nextEventStreamBacklogSourceId;
 
-    // GWC-30: the same pull model for the worker event queue depth. It replaces a pushed scalar that
+    // PERF-02: the same pull model for the worker event queue depth. It replaces a pushed scalar that
     // every WorkerClient wrote twice per event (staged, consumed) under _syncRoot — a process-wide
     // lock on the hottest path, and last-writer-wins across sessions, so the gauge reported one
     // arbitrary session's backlog instead of the gateway's. Each client registers a source returning
@@ -210,7 +210,7 @@ public sealed class GatewayMetrics : IDisposable
     /// <param name="method">Name of the command method.</param>
     public void CommandStarted(string method)
     {
-        // GWC-30: the three command counters run two-to-three times per gRPC call, so they use
+        // PERF-02: the three command counters run two-to-three times per gRPC call, so they use
         // Interlocked rather than _syncRoot — the same idiom as EventReceived. Nothing here needs a
         // consistent multi-field view; GetSnapshot reads each with Interlocked.Read.
         Interlocked.Increment(ref _commandsStarted);
@@ -281,7 +281,7 @@ public sealed class GatewayMetrics : IDisposable
     ///     Registers a live depth source for the worker event queue-depth gauge and returns a handle
     ///     that removes it when disposed. Each <c>WorkerClient</c> registers once and reports its own
     ///     undelivered (staged + queued) event count, so the gauge is the gateway-wide sum instead of
-    ///     the last value any one session happened to push (GWC-30).
+    ///     the last value any one session happened to push (PERF-02).
     /// </summary>
     /// <param name="depth">
     ///     Returns this worker client's current undelivered event count. Invoked only at collection
@@ -460,7 +460,7 @@ public sealed class GatewayMetrics : IDisposable
     {
         // Compute the live queue depths outside _syncRoot: the sources are the subscriber channels'
         // Count (their own locks) and the worker clients' interlocked counters, neither of which may
-        // run under this lock. GWC-15, GWC-30.
+        // run under this lock. GWC-15, PERF-02.
         int workerEventQueueDepth = GetWorkerEventQueueDepth();
         int grpcEventStreamQueueDepth = GetGrpcEventStreamQueueDepth();
         lock (_syncRoot)
@@ -521,7 +521,7 @@ public sealed class GatewayMetrics : IDisposable
         }
     }
 
-    // Sums the undelivered event backlog across every live worker client (GWC-30).
+    // Sums the undelivered event backlog across every live worker client (PERF-02).
     private int GetWorkerEventQueueDepth() => SumSources(_workerEventQueueDepthSources);
 
     // Sums the live backlog across every registered event-stream subscriber.

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/ApiKeyFailureLimiter.cs

@@ -28,8 +28,11 @@ namespace ZB.MOM.WW.MxGateway.Server.Security.Authorization;
 /// <para>
 /// The tracked partition set is a bounded LRU (<see cref="SecurityOptions.ApiKeyFailureTrackedPeers"/>).
 /// Because only a validly shaped token mints a key-id partition and each transport peer may mint at
-/// most <see cref="MaxKeyIdPartitionsPerPeer"/> of them (the overflow collapses onto that address's
-/// fallback partition), the map bounds memory <em>and</em> resists a junk-token flush (SEC-32):
+/// most <see cref="MaxKeyIdPartitionsPerPeer"/> of them (the peer-layer overflow collapses onto that
+/// address's fallback partition), the map bounds memory <em>and</em> resists a junk-token flush
+/// (SEC-32). A validly shaped presented key id still feeds its cross-peer aggregate when its peer
+/// layer uses the fallback, so exhausting the per-peer cap cannot bypass distributed-spray
+/// protection; the aggregate map remains bounded by the same capped eviction policy:
 /// eviction prefers fully expired windows, never removes an over-limit partition below a transient
 /// overshoot ceiling of twice the cap, and only then falls back to least-recently-active. Successful
 /// peers are removed on reset, so in steady state the map holds only partitions with recent failures
@@ -155,9 +158,9 @@ public sealed class ApiKeyFailureLimiter
 
         WindowState? peerState = _partitions.TryGetValue(partitionKey, out WindowState? tracked) ? tracked : null;
         WindowState? aggregateState = null;
-        if (effectiveKeyId is not null
+        if (partition.KeyId is not null
             && _aggregateLimit > 0
-            && _aggregates.TryGetValue(effectiveKeyId, out WindowState? aggregate))
+            && _aggregates.TryGetValue(partition.KeyId, out WindowState? aggregate))
         {
             aggregateState = aggregate;
         }
@@ -222,11 +225,13 @@ public sealed class ApiKeyFailureLimiter
             (Peer: peer, KeyId: effectiveKeyId));
         RecordInto(state, now, _limit);
 
-        // Only a key id that earned its own partition feeds the aggregate: an id squeezed out by the
-        // per-peer cap is spray, and letting it through would make aggregate cardinality unbounded.
-        if (effectiveKeyId is not null && _aggregateLimit > 0)
+        // The aggregate follows the validly shaped presented key id independently of the peer
+        // layer's storage choice. Otherwise an attacker could exhaust each peer's dedicated-key cap
+        // and route a victim id through the fallback to bypass cross-peer throttling. Aggregate
+        // cardinality is still bounded by EvictIfOverCapacity below.
+        if (partition.KeyId is not null && _aggregateLimit > 0)
         {
-            WindowState aggregate = _aggregates.GetOrAdd(effectiveKeyId, static _ => new WindowState(null, null));
+            WindowState aggregate = _aggregates.GetOrAdd(partition.KeyId, static _ => new WindowState(null, null));
             RecordInto(aggregate, now, _aggregateLimit);
         }
 
@@ -261,7 +266,8 @@ public sealed class ApiKeyFailureLimiter
         // contributed by other key ids — and by junk-shaped tokens — from the same address, so
         // removing it would let one successful authentication wipe an in-progress spray. The shared
         // bucket decays by window expiry instead; the caller still recovers through probe admission.
-        if (string.Equals(effectiveKeyId, partition.KeyId, StringComparison.Ordinal))
+        if (effectiveKeyId is not null
+            && string.Equals(effectiveKeyId, partition.KeyId, StringComparison.Ordinal))
         {
             RemovePartition(partitionKey);
         }

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/GatewayBrowseScopeProvider.cs

@@ -1,26 +1,72 @@
 using Grpc.Core;
+using Microsoft.Extensions.Options;
 using ZB.MOM.WW.GalaxyRepository.Grpc;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
 using ZB.MOM.WW.MxGateway.Server.Security.Authentication;
 
 namespace ZB.MOM.WW.MxGateway.Server.Security.Authorization;
 
 /// <summary>Scopes Galaxy browse results to the calling API key's BrowseSubtrees constraint.</summary>
-public sealed class GatewayBrowseScopeProvider(IGatewayRequestIdentityAccessor identityAccessor)
+/// <remarks>
+/// Distinguishes two states the pre-GWC-38 code collapsed into one: "authenticated, no
+/// BrowseSubtrees constraint" (legitimately unscoped — the common case) and "no ambient identity
+/// at all" (the interceptor-ordering invariant below is broken). The second used to resolve to the
+/// full hierarchy silently, which made a scoping bypass invisible; it now denies loudly.
+/// </remarks>
+/// <param name="identityAccessor">Accessor for the ambient per-call API-key identity.</param>
+/// <param name="options">Gateway options supplying <c>MxGateway:Authentication:Mode</c>.</param>
+/// <param name="logger">Logger used to name the broken invariant when identity is absent.</param>
+public sealed class GatewayBrowseScopeProvider(
+    IGatewayRequestIdentityAccessor identityAccessor,
+    IOptions<GatewayOptions> options,
+    ILogger<GatewayBrowseScopeProvider> logger)
     : IGalaxyBrowseScopeProvider
 {
     /// <summary>Resolves the Galaxy browse subtrees the calling API key is scoped to, from the ambient request identity.</summary>
     /// <param name="context">The gRPC server call context for the in-flight browse request.</param>
     /// <returns>The caller's configured browse subtrees, or <see langword="null"/>/empty when the caller is unscoped (full hierarchy).</returns>
+    /// <exception cref="RpcException">
+    /// <see cref="StatusCode.PermissionDenied"/> when API-key authentication is enabled but no
+    /// ambient identity is present — the invariant described below has been broken and the
+    /// request's scope cannot be established.
+    /// </exception>
     public IReadOnlyList<string>? ResolveBrowseSubtrees(ServerCallContext context)
     {
         // Invariant: the caller identity is the ambient one pushed by
         // GatewayGrpcAuthorizationInterceptor earlier in this same call. That interceptor is
         // registered globally and therefore runs before the library's galaxy service, so
-        // Current is populated for any authenticated galaxy RPC. If it is somehow absent we
-        // return empty BrowseSubtrees, which the library treats as "no scoping" (full
-        // hierarchy) — safe only because the global interceptor has already authenticated and
-        // authorized the request first. Do not reorder the interceptor without revisiting this.
-        ApiKeyConstraints constraints = identityAccessor.Current?.EffectiveConstraints ?? ApiKeyConstraints.Empty;
-        return constraints.BrowseSubtrees;
+        // Current is populated for any authenticated galaxy RPC. Do not reorder the interceptor
+        // without revisiting this.
+        ApiKeyIdentity? identity = identityAccessor.Current;
+        if (identity is not null)
+        {
+            return identity.EffectiveConstraints.BrowseSubtrees;
+        }
+
+        // Mode=Disabled is the one configuration in which identity-absent is expected rather than
+        // broken: nothing authenticates, so no key and no constraints exist to scope by, and the
+        // deployment has already accepted an unauthenticated gRPC surface. Empty BrowseSubtrees is
+        // what the library reads as "no scoping".
+        if (options.Value.Authentication.Mode == AuthenticationMode.Disabled)
+        {
+            return ApiKeyConstraints.Empty.BrowseSubtrees;
+        }
+
+        // Authentication is on, so an identity MUST have been pushed before the galaxy service ran.
+        // Failing open here would hand a browse-scoped key the full hierarchy with nothing logged
+        // and nothing failing — a constraint-narrowing control's absence is invisible in normal
+        // operation. Deny instead, and name the invariant so the misconfiguration is diagnosable
+        // from one log line rather than from a scoping audit nobody thought to run.
+        logger.LogWarning(
+            "Galaxy browse scope could not be resolved for {Method}: no ambient API-key identity "
+            + "while Authentication:Mode is {Mode}. GatewayGrpcAuthorizationInterceptor must run "
+            + "before the Galaxy service on every call; the request is denied rather than served "
+            + "unscoped.",
+            context.Method,
+            options.Value.Authentication.Mode);
+
+        throw new RpcException(new Status(
+            StatusCode.PermissionDenied,
+            "Browse scope could not be established for this request."));
     }
 }

src/ZB.MOM.WW.MxGateway.Server/Sessions/EventSubscriberReplayAttachment.cs

@@ -24,9 +24,11 @@ namespace ZB.MOM.WW.MxGateway.Server.Sessions;
 ///     replay batch.
 /// </param>
 /// <param name="OldestAvailableSequence">
-///     The oldest worker sequence still retained and replayable; <c>0</c> when nothing is
-///     retained. Populates the <c>ReplayGap.oldest_available_sequence</c> field. Meaningful
-///     only when <paramref name="Gap"/> is <see langword="true"/>.
+///     Populates the <c>ReplayGap.oldest_available_sequence</c> field. When
+///     <paramref name="Gap"/> is <see langword="true"/>, this is the oldest worker sequence
+///     still retained and replayable, or the highest observed sequence plus one when the ring
+///     is empty. It is <c>0</c> only when <paramref name="Gap"/> is
+///     <see langword="false"/>, where the value is not emitted.
 /// </param>
 /// <param name="LiveResumeSequence">
 ///     The worker sequence the live channel must resume strictly after: the highest replayed

src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs

@@ -39,6 +39,14 @@ public sealed class GatewaySession
     private bool _everHadEventSubscriber;
     private SessionEventDistributor? _eventDistributor;
     private bool _eventDistributorStarted;
+    // GWC-34: set under _syncRoot when DisposeAsync nulls _eventDistributor, making the
+    // "one distributor per session, never reset" lifecycle symmetric at both ends. Without it
+    // EnsureDistributorCreated reads the null as "not created yet" and builds a REPLACEMENT
+    // distributor after teardown — one whose pump can never start (_eventDistributorStarted is a
+    // one-way latch) and whose channel is never completed, so an attach that stalled across the
+    // close+dispose registers on it and blocks in WaitToReadAsync until the client's own deadline,
+    // silently and invisibly to metrics.
+    private bool _eventDistributorDisposed;
     private bool _dashboardMirrorStarted;
     private IEventSubscriberLease? _dashboardMirrorLease;
     private Task? _dashboardMirrorTask;
@@ -532,10 +540,23 @@ public sealed class GatewaySession
     // start). Both the construction and the started-flag flip happen under _syncRoot so two
     // concurrent callers (e.g. MarkReady's dashboard mirror and a racing first
     // AttachEventSubscriber) agree on a single distributor and a single start.
+    //
+    // GWC-34: after DisposeAsync the null distributor means "gone", not "not built yet", so this
+    // throws instead of constructing a replacement nothing will ever pump. The attach paths already
+    // roll back and surface the exception, which is the same SessionNotReady the readiness gates
+    // raise — a caller that loses the race to teardown now fails immediately instead of hanging.
     private SessionEventDistributor EnsureDistributorCreated(out bool startNow)
     {
         lock (_syncRoot)
         {
+            if (_eventDistributorDisposed)
+            {
+                throw new SessionManagerException(
+                    SessionManagerErrorCode.SessionNotReady,
+                    $"Session {SessionId} is not ready for event streaming. Its event distributor was "
+                    + "disposed with the session.");
+            }
+
             if (_eventDistributor is null)
             {
                 EventOptions eventOptions = _eventStreaming.EventOptions;
@@ -672,7 +693,37 @@ public sealed class GatewaySession
         // dashboard mirror only disconnects itself and never faults the session.
         // These three calls are OUTSIDE _syncRoot to avoid holding it across
         // EnsureDistributorCreated's own lock and StartAsync's Task.Run.
-        SessionEventDistributor distributor = EnsureDistributorCreated(out bool startNow);
+        //
+        // GWC-34: the state check above can be overtaken by a close+dispose before we get here, and
+        // EnsureDistributorCreated now says so instead of building an orphan distributor. The
+        // dashboard mirror is a best-effort observability attachment on a session that is already
+        // gone, so it is abandoned here rather than propagated out of MarkReady — the mirror-started
+        // latch stays set (nothing may start one on a disposed session) and the loop's token source
+        // is released so it is not orphaned.
+        SessionEventDistributor distributor;
+        bool startNow;
+        try
+        {
+            distributor = EnsureDistributorCreated(out startNow);
+        }
+        catch (SessionManagerException exception)
+        {
+            CancellationTokenSource? abandonedCts;
+            lock (_syncRoot)
+            {
+                abandonedCts = _dashboardMirrorCts;
+                _dashboardMirrorCts = null;
+            }
+
+            abandonedCts?.Dispose();
+            _eventStreaming.DistributorLogger.LogDebug(
+                exception,
+                "Dashboard event mirror for session {SessionId} was abandoned: the session was disposed "
+                + "before the mirror could attach.",
+                SessionId);
+            return;
+        }
+
         IEventSubscriberLease lease = distributor.Register(isInternal: true);
         StartPumpIfRequested(distributor, startNow);
 
@@ -1867,6 +1918,9 @@ public sealed class GatewaySession
         {
             distributor = _eventDistributor;
             _eventDistributor = null;
+            // GWC-34: latch the null-out so EnsureDistributorCreated cannot read it as
+            // "not created yet" and hand a racing attach a distributor that will never pump.
+            _eventDistributorDisposed = true;
         }
 
         if (distributor is not null)

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerClient.cs

@@ -41,7 +41,7 @@ public sealed class WorkerClient : IWorkerClient
     private readonly SemaphoreSlim _pendingCommandSlots;
     private readonly CancellationTokenSource _stopCts = new();
 
-    // GWC-30: this client's contribution to the gateway-wide worker queue-depth gauge. Registered
+    // PERF-02: this client's contribution to the gateway-wide worker queue-depth gauge. Registered
     // once here and read only when the gauge is scraped, so staging and consuming an event cost an
     // Interlocked on _eventQueueDepth and nothing else — previously each of those two hot-path steps
     // called into GatewayMetrics and took its process-wide lock. Null when metrics are disabled.
@@ -233,24 +233,31 @@ public sealed class WorkerClient : IWorkerClient
             // size the caller controls; checking here keeps a MessageTooLarge in the write loop a
             // genuine desync signal.
             //
-            // PERF(GWC-31): this size cannot be handed to WorkerFrameWriter to spare its own
+            // PERF-07: this size cannot be handed to WorkerFrameWriter to spare its own
             // CalculateSize. WriteLoopAsync stamps envelope.Sequence immediately before the write
             // (GWC-28), and a non-zero varint field grows the encoding — so the number computed here
             // is a lower bound on the frame the writer actually emits, never the frame length. Passing
-            // it as a knownSize would under-length the prefix and desync the worker's framing. The
-            // pre-check stays a pre-check: it is conservative in the right direction.
+            // it as a knownSize would under-length the prefix and desync the worker's framing.
+            //
+            // IPC-39: being a lower bound is conservative for the knownSize question but the wrong
+            // direction for this pre-check, which must not admit an envelope the writer will then
+            // reject with a session-fatal MessageTooLarge. Compare against the frame maximum less the
+            // MaxSequenceEncodingBytes the stamp can add, so every envelope this check accepts still
+            // fits once the sequence is written.
             int envelopeSize = commandEnvelope.CalculateSize();
-            if (envelopeSize > _connection.FrameOptions.MaxMessageBytes)
+            int preCheckLimit = _connection.FrameOptions.MaxMessageBytes - MaxSequenceEncodingBytes;
+            if (envelopeSize > preCheckLimit)
             {
                 throw new WorkerClientException(
                     WorkerClientErrorCode.CommandTooLarge,
                     $"Worker command {method} serializes to {envelopeSize} bytes, exceeding the negotiated "
-                    + $"worker-frame maximum of {_connection.FrameOptions.MaxMessageBytes} bytes.");
+                    + $"worker-frame maximum of {_connection.FrameOptions.MaxMessageBytes} bytes less the "
+                    + $"{MaxSequenceEncodingBytes}-byte sequence-stamp allowance.");
             }
 
             await EnqueueAsync(commandEnvelope, cancellationToken).ConfigureAwait(false);
 
-            // GWC-31: one pooled timer instead of a linked CTS + Task.Delay + WhenAny per command.
+            // PERF-07: one pooled timer instead of a linked CTS + Task.Delay + WhenAny per command.
             // Task.WaitAsync arms a TimerQueueTimer on the shared timer queue and cancels it when the
             // reply lands, so the steady-state cost of a command that replies in time is a single
             // continuation — the old shape allocated a linked CancellationTokenSource, its
@@ -284,7 +291,10 @@ public sealed class WorkerClient : IWorkerClient
                 // throw, so it can never replace the timeout the caller is owed.
                 if (removed)
                 {
-                    TrySendCancelForTimedOutCommand(correlationId, method, timeout);
+                    TrySendCancelForAbandonedCommand(
+                        correlationId,
+                        method,
+                        $"gateway command timeout after {timeout}");
                 }
 
                 throw new WorkerClientException(
@@ -293,11 +303,7 @@ public sealed class WorkerClient : IWorkerClient
             }
             catch (OperationCanceledException)
             {
-                RemovePendingCommandAsFailed(
-                    correlationId,
-                    pendingCommand,
-                    WorkerClientErrorCode.GatewayShutdown,
-                    "Command wait was canceled.");
+                AbandonCommandOnCallerCancellation(correlationId, pendingCommand, method);
 
                 // WaitAsync surfaces TaskCanceledException; throwing through the token keeps the
                 // exception the caller observes exactly what the hand-rolled wait produced.
@@ -309,11 +315,7 @@ public sealed class WorkerClient : IWorkerClient
                 // The deadline and the caller's cancellation raced and WaitAsync picked the timer.
                 // The old wait classified this as cancellation, so this clause — reached only when
                 // the filter above saw a canceled token — reproduces that treatment exactly.
-                RemovePendingCommandAsFailed(
-                    correlationId,
-                    pendingCommand,
-                    WorkerClientErrorCode.GatewayShutdown,
-                    "Command wait was canceled.");
+                AbandonCommandOnCallerCancellation(correlationId, pendingCommand, method);
                 cancellationToken.ThrowIfCancellationRequested();
                 throw;
             }
@@ -352,7 +354,7 @@ public sealed class WorkerClient : IWorkerClient
     {
         await foreach (WorkerEvent workerEvent in _events.Reader.ReadAllAsync(cancellationToken).ConfigureAwait(false))
         {
-            // No metrics call on the hot path: the gauge pulls _eventQueueDepth when scraped (GWC-30).
+            // No metrics call on the hot path: the gauge pulls _eventQueueDepth when scraped (PERF-02).
             Interlocked.Decrement(ref _eventQueueDepth);
             yield return workerEvent;
         }
@@ -418,20 +420,49 @@ public sealed class WorkerClient : IWorkerClient
     /// <returns>A task that represents the asynchronous operation.</returns>
     public async ValueTask DisposeAsync()
     {
-        if (_disposed)
+        // GWC-32: disposal is the third channel-completing path, and it must enter a terminal state
+        // like the other two (MarkClosed, SetFaulted) BEFORE the channels are completed. Otherwise a
+        // client disposed while still Ready keeps reporting IsTerminalState() == false, and a read
+        // loop already inside DispatchEnvelope (the _stopCts.Cancel below only interrupts the NEXT
+        // ReadAsync) takes StageWorkerEvent's overflow arm on the completed staging channel: a
+        // spurious ProtocolViolation fault, a worker-event-staging overflow metric and a redundant
+        // kill, all during an intentional teardown. MarkClosed is deliberately not reused here: it
+        // would overwrite Faulted with Closed and it re-runs the whole teardown sequence this method
+        // performs itself. The transition is skipped when the state is already terminal, so a
+        // dispose-after-fault keeps Faulted and a double dispose changes nothing.
+        bool becameTerminalHere;
+        lock (_syncRoot)
         {
-            return;
+            if (_disposed)
+            {
+                return;
+            }
+
+            _disposed = true;
+            becameTerminalHere = _state is not (WorkerClientState.Closed or WorkerClientState.Faulted);
+            if (becameTerminalHere)
+            {
+                _state = WorkerClientState.Closed;
+            }
+
+            UnregisterEventQueueDepthSource();
         }
 
-        _disposed = true;
-        // Drop out of the worker queue-depth gauge before teardown: whatever this client still holds
-        // is about to be discarded, and the sum must not keep counting a client that is going away.
-        _eventQueueDepthRegistration?.Dispose();
         KillOwnedProcess("Dispose");
         _stopCts.Cancel();
         _outboundEnvelopes.Writer.TryComplete();
         _eventStaging.Writer.TryComplete();
         _events.Writer.TryComplete();
+        if (becameTerminalHere)
+        {
+            // A worker that reached Ready and is now being disposed without a prior Close or fault
+            // (SessionManager.OpenSessionAsync's failure arm does exactly this) stopped, so the
+            // running-worker gauge must come down. RecordWorkerStoppedOnce is latched on
+            // _workerStartRecorded, so a client that already recorded its stop through MarkClosed or
+            // SetFaulted cannot record a second one here.
+            RecordWorkerStoppedOnce("dispose");
+        }
+
         CompletePendingCommands(
             new WorkerClientException(
                 WorkerClientErrorCode.GatewayShutdown,
@@ -455,6 +486,18 @@ public sealed class WorkerClient : IWorkerClient
         _stopCts.Dispose();
     }
 
+    /// <summary>
+    ///     Worst-case number of bytes <see cref="WriteLoopAsync"/>'s sequence stamp adds to an
+    ///     envelope that was sized before it: one tag byte plus a ten-byte varint, the maximum
+    ///     encoding of a 64-bit protobuf field. The <c>CommandTooLarge</c> pre-check subtracts this
+    ///     from the negotiated frame maximum (IPC-39) because it measures the envelope while
+    ///     <c>Sequence</c> is still 0 — an unset field costs nothing to encode, so the measured size
+    ///     is a lower bound on the frame the writer emits, and without the allowance an envelope in
+    ///     the last eleven bytes of the range would pass the pre-check and then fault the session on
+    ///     the write.
+    /// </summary>
+    private const int MaxSequenceEncodingBytes = 11;
+
     /// <summary>Manages writing envelopes to the worker pipe.</summary>
     private async Task WriteLoopAsync()
     {
@@ -633,8 +676,10 @@ public sealed class WorkerClient : IWorkerClient
     ///     Hands a received worker event to the dedicated event writer without blocking the read loop.
     ///     <c>TryWrite</c> is non-blocking, so the read loop keeps dispatching replies, heartbeats and
     ///     faults regardless of how backed up the event path is. It returns <c>false</c> in two cases:
-    ///     the staging channel has been completed during shutdown (the event is safely dropped because
-    ///     the client is already terminal), or the channel is full at its
+    ///     the staging channel has been completed by one of the three completing paths —
+    ///     <see cref="MarkClosed"/>, <see cref="SetFaulted"/> or <see cref="DisposeAsync"/>, each of
+    ///     which enters a terminal state before completing the channels (GWC-32), so the event is
+    ///     safely dropped because the client is already terminal — or the channel is full at its
     ///     2 × <see cref="WorkerClientOptions.EventChannelCapacity"/> bound. The latter means the
     ///     consumer has been draining slower than the worker produces for the whole time it took the
     ///     worker to emit that many further events, so the client is faulted immediately (GWC-24) —
@@ -803,6 +848,45 @@ public sealed class WorkerClient : IWorkerClient
         return true;
     }
 
+    /// <summary>
+    ///     Fails the pending command for a caller whose own token fired — a client deadline shorter
+    ///     than the gateway's command timeout, or a disconnect that cancelled the RPC's token — and
+    ///     forwards a <c>WorkerCancel</c> for the correlation the caller has abandoned (IPC-34).
+    ///     <para>
+    ///     Caller cancellation is the common abandonment path, not the rare one, and it leaves the
+    ///     worker in exactly the state the timeout arm's cancel exists for: the correlation is still
+    ///     on the worker's single STA queue and would execute in its turn, behind live callers, for
+    ///     a caller that is already gone. Under a burst of deadline-cancelled calls that backlog is
+    ///     precisely what the cancel was added to shorten, so both arms send it.
+    ///     </para>
+    ///     <para>
+    ///     Gated the same way as the timeout arm: only the caller that owned the removal sends, so a
+    ///     reply that won the race is never chased. Additionally skipped once <c>_stopCts</c> has
+    ///     fired — the client is closing, the outbound channel is being completed and every pending
+    ///     command failed anyway, so a cancel would be at best pointless and at worst a write racing
+    ///     teardown.
+    ///     </para>
+    /// </summary>
+    /// <param name="correlationId">Correlation id of the abandoned command.</param>
+    /// <param name="pendingCommand">The pending command entry to fail.</param>
+    /// <param name="method">Command method name, for the cancel reason and diagnostics.</param>
+    private void AbandonCommandOnCallerCancellation(
+        string correlationId,
+        PendingCommand pendingCommand,
+        string method)
+    {
+        bool removed = RemovePendingCommandAsFailed(
+            correlationId,
+            pendingCommand,
+            WorkerClientErrorCode.CallerCancelled,
+            "Command wait was canceled.");
+
+        if (removed && !_stopCts.IsCancellationRequested)
+        {
+            TrySendCancelForAbandonedCommand(correlationId, method, "caller cancelled the command");
+        }
+    }
+
     /// <summary>
     ///     Forwards a <c>WorkerCancel</c> for a correlation the gateway has given up waiting for, so the
     ///     worker can drop it from its STA queue (<c>WorkerPipeSession</c> routes the envelope to
@@ -819,9 +903,10 @@ public sealed class WorkerClient : IWorkerClient
     /// <remarks>
     ///     The whole body sits under one catch-all that debug-logs, because the guarantee this method
     ///     owes its caller is structural, not incidental: the caller is on the throw path for the
-    ///     timeout, so anything escaping here — an envelope that failed to build, a <c>TryWrite</c>
-    ///     against a disposed channel, a scheduler refusing the detached task — would replace the
-    ///     <see cref="WorkerClientErrorCode.CommandTimeout"/> the caller is owed with an unrelated
+    ///     timeout or the cancellation, so anything escaping here — an envelope that failed to build,
+    ///     a <c>TryWrite</c> against a disposed channel, a scheduler refusing the detached task —
+    ///     would replace the <see cref="WorkerClientErrorCode.CommandTimeout"/> (or the
+    ///     <see cref="OperationCanceledException"/>) the caller is owed with an unrelated
     ///     exception. Losing the cancel costs the worker one wasted command; losing the timeout
     ///     misreports why the call failed. The detached task carries its own handler for the same
     ///     reason: its failures (including the <see cref="ObjectDisposedException"/> from
@@ -829,13 +914,13 @@ public sealed class WorkerClient : IWorkerClient
     ///     and would otherwise be unobserved. It is deliberately not tracked or awaited — it holds no
     ///     resource the shutdown path needs back, and the outbound channel is completed on close.
     /// </remarks>
-    /// <param name="correlationId">Correlation id of the command that timed out.</param>
-    /// <param name="method">Command method name, for the cancel reason and diagnostics.</param>
-    /// <param name="timeout">The elapsed command timeout, for the cancel reason.</param>
-    private void TrySendCancelForTimedOutCommand(
+    /// <param name="correlationId">Correlation id of the abandoned command.</param>
+    /// <param name="method">Command method name, for diagnostics.</param>
+    /// <param name="reason">Why the gateway abandoned the command, carried on the <c>WorkerCancel</c>.</param>
+    private void TrySendCancelForAbandonedCommand(
         string correlationId,
         string method,
-        TimeSpan timeout)
+        string reason)
     {
         try
         {
@@ -843,7 +928,7 @@ public sealed class WorkerClient : IWorkerClient
                 correlationId,
                 envelope => envelope.WorkerCancel = new WorkerCancel
                 {
-                    Reason = $"gateway command timeout after {timeout}",
+                    Reason = reason,
                 });
 
             if (_outboundEnvelopes.Writer.TryWrite(cancelEnvelope))
@@ -869,10 +954,10 @@ public sealed class WorkerClient : IWorkerClient
         }
     }
 
-    /// <summary>Records a cancel that could not be forwarded for a timed-out command.</summary>
+    /// <summary>Records a cancel that could not be forwarded for an abandoned command.</summary>
     /// <param name="exception">The failure that stopped the cancel from being sent.</param>
-    /// <param name="method">Command method name of the timed-out command.</param>
-    /// <param name="correlationId">Correlation id of the timed-out command.</param>
+    /// <param name="method">Command method name of the abandoned command.</param>
+    /// <param name="correlationId">Correlation id of the abandoned command.</param>
     private void LogCancelNotForwarded(
         Exception exception,
         string method,
@@ -880,7 +965,7 @@ public sealed class WorkerClient : IWorkerClient
     {
         _logger.LogDebug(
             exception,
-            "Could not forward a cancel for timed-out worker command {Method} on session {SessionId} "
+            "Could not forward a cancel for abandoned worker command {Method} on session {SessionId} "
             + "and correlation {CorrelationId}.",
             method,
             SessionId,
@@ -896,6 +981,21 @@ public sealed class WorkerClient : IWorkerClient
         CancellationToken cancellationToken)
     {
         WorkerEnvelope envelope = await _reader.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+        // IPC-35: a fault frame during the handshake is the worker reporting a structured startup
+        // failure — most often MXAccess COM creation (not installed, not registered, access denied)
+        // — not a protocol problem. Flattening it to ProtocolViolation discarded the category and
+        // diagnostic exactly where they matter most: first session open on a freshly deployed host,
+        // where the message reaches the operator log and the client's OpenFailed detail. Use the
+        // same formatter the steady-state fault path uses so both windows read alike.
+        if (envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerFault
+            && expectedBody != WorkerEnvelope.BodyOneofCase.WorkerFault)
+        {
+            throw new WorkerClientException(
+                WorkerClientErrorCode.WorkerFaulted,
+                CreateWorkerFaultMessage(envelope.WorkerFault));
+        }
+
         if (envelope.BodyCase != expectedBody)
         {
             throw new WorkerClientException(
@@ -991,6 +1091,7 @@ public sealed class WorkerClient : IWorkerClient
             }
 
             _state = WorkerClientState.Closed;
+            UnregisterEventQueueDepthSource();
         }
 
         _stopCts.Cancel();
@@ -1025,6 +1126,7 @@ public sealed class WorkerClient : IWorkerClient
             }
 
             _state = WorkerClientState.Faulted;
+            UnregisterEventQueueDepthSource();
         }
 
         _stopCts.Cancel();
@@ -1038,6 +1140,16 @@ public sealed class WorkerClient : IWorkerClient
         _logger.LogWarning(exception, "Worker client faulted for session {SessionId}: {Message}", SessionId, message);
     }
 
+    /// <summary>
+    ///     Removes this terminal client's abandoned backlog from the gateway-wide queue-depth
+    ///     gauge. The registration handle is idempotent, so terminal transitions and later disposal
+    ///     may all call this safely while the faulted client remains retained for diagnostics.
+    /// </summary>
+    private void UnregisterEventQueueDepthSource()
+    {
+        _eventQueueDepthRegistration?.Dispose();
+    }
+
     private void KillOwnedProcess(string reason)
     {
         WorkerProcessHandle? processHandle = _connection.ProcessHandle;

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerClientErrorCode.cs

@@ -10,6 +10,14 @@ public enum WorkerClientErrorCode
     HeartbeatExpired,
     ShutdownTimeout,
     GatewayShutdown,
+
+    // The caller's own cancellation token fired while it waited for the reply — a client deadline
+    // shorter than the gateway's command timeout, or a disconnect that cancelled the RPC's token.
+    // Distinct from GatewayShutdown (which these arms used to report) so metrics and logs stop
+    // recording a shutdown that did not happen; both map to Cancelled at the gRPC boundary, so the
+    // status the client observes is unchanged.
+    CallerCancelled,
+
     WriteFailed,
     PendingCommandLimitExceeded,
 

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerProcessLauncher.cs

@@ -2,6 +2,7 @@ using System.Diagnostics;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Contracts;
 using ZB.MOM.WW.MxGateway.Server.Configuration;
 using ZB.MOM.WW.MxGateway.Server.Metrics;
 using Polly;
@@ -15,41 +16,47 @@ namespace ZB.MOM.WW.MxGateway.Server.Workers;
 public sealed class WorkerProcessLauncher : IWorkerProcessLauncher
 {
     /// <summary>Environment variable for worker nonce.</summary>
-    public const string WorkerNonceEnvironmentVariableName = "MXGATEWAY_WORKER_NONCE";
+    [Obsolete("Use WorkerLaunchEnvironment.WorkerNonce.")]
+    public const string WorkerNonceEnvironmentVariableName = WorkerLaunchEnvironment.WorkerNonce;
 
     /// <summary>Environment variable for worker pipe connect attempt timeout.</summary>
+    [Obsolete("Use WorkerLaunchEnvironment.PipeConnectAttemptTimeoutMilliseconds.")]
     public const string WorkerPipeConnectAttemptTimeoutEnvironmentVariableName =
-        "MXGATEWAY_WORKER_PIPE_CONNECT_ATTEMPT_TIMEOUT_MS";
+        WorkerLaunchEnvironment.PipeConnectAttemptTimeoutMilliseconds;
 
     /// <summary>
     /// Conveys MxGateway:Worker:WriteCompletionWaitMilliseconds to the worker:
-    /// the bounded wait for the OnWriteComplete callback on
-    /// WriteSecured/WriteSecured2 replies. 0 disables the wait.
+    /// the bounded wait for the OnWriteComplete callback on Write, Write2,
+    /// WriteSecured, and WriteSecured2 replies. 0 disables the wait.
     /// </summary>
+    [Obsolete("Use WorkerLaunchEnvironment.WriteCompletionWaitMilliseconds.")]
     public const string WorkerWriteCompletionWaitEnvironmentVariableName =
-        "MXGATEWAY_WORKER_WRITE_COMPLETION_WAIT_MS";
+        WorkerLaunchEnvironment.WriteCompletionWaitMilliseconds;
 
     /// <summary>
     /// Conveys MxGateway:Alarms:PollIntervalMilliseconds to the worker: the
     /// cadence at which the worker's STA polls the AVEVA alarm consumer.
     /// </summary>
+    [Obsolete("Use WorkerLaunchEnvironment.AlarmPollIntervalMilliseconds.")]
     public const string WorkerAlarmPollIntervalEnvironmentVariableName =
-        "MXGATEWAY_ALARM_POLL_INTERVAL_MS";
+        WorkerLaunchEnvironment.AlarmPollIntervalMilliseconds;
 
     /// <summary>
     /// Conveys MxGateway:Alarms:MaxAlarmsPerFetch to the worker: the cap
     /// passed to GetXmlCurrentAlarms2, which is also the record count at
     /// which the worker treats a fetch as truncated.
     /// </summary>
+    [Obsolete("Use WorkerLaunchEnvironment.MaxAlarmsPerFetch.")]
     public const string WorkerMaxAlarmsPerFetchEnvironmentVariableName =
-        "MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH";
+        WorkerLaunchEnvironment.MaxAlarmsPerFetch;
 
     /// <summary>
     /// Conveys MxGateway:Worker:EventQueueCapacity to the worker: the capacity
     /// of the outbound MXAccess event queue, whose overflow faults the session.
     /// </summary>
+    [Obsolete("Use WorkerLaunchEnvironment.EventQueueCapacity.")]
     public const string WorkerEventQueueCapacityEnvironmentVariableName =
-        "MXGATEWAY_EVENT_QUEUE_CAPACITY";
+        WorkerLaunchEnvironment.EventQueueCapacity;
 
     private readonly IWorkerProcessFactory _processFactory;
     private readonly IWorkerStartupProbe _startupProbe;
@@ -204,16 +211,16 @@ public sealed class WorkerProcessLauncher : IWorkerProcessLauncher
             startInfo.ArgumentList.Add(argument);
         }
 
-        startInfo.Environment[WorkerNonceEnvironmentVariableName] = request.Nonce;
-        startInfo.Environment[WorkerPipeConnectAttemptTimeoutEnvironmentVariableName] =
+        startInfo.Environment[WorkerLaunchEnvironment.WorkerNonce] = request.Nonce;
+        startInfo.Environment[WorkerLaunchEnvironment.PipeConnectAttemptTimeoutMilliseconds] =
             _workerOptions.PipeConnectAttemptTimeoutMilliseconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
-        startInfo.Environment[WorkerWriteCompletionWaitEnvironmentVariableName] =
+        startInfo.Environment[WorkerLaunchEnvironment.WriteCompletionWaitMilliseconds] =
             _workerOptions.WriteCompletionWaitMilliseconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
-        startInfo.Environment[WorkerEventQueueCapacityEnvironmentVariableName] =
+        startInfo.Environment[WorkerLaunchEnvironment.EventQueueCapacity] =
             _workerOptions.EventQueueCapacity.ToString(System.Globalization.CultureInfo.InvariantCulture);
-        startInfo.Environment[WorkerAlarmPollIntervalEnvironmentVariableName] =
+        startInfo.Environment[WorkerLaunchEnvironment.AlarmPollIntervalMilliseconds] =
             _alarmsOptions.PollIntervalMilliseconds.ToString(System.Globalization.CultureInfo.InvariantCulture);
-        startInfo.Environment[WorkerMaxAlarmsPerFetchEnvironmentVariableName] =
+        startInfo.Environment[WorkerLaunchEnvironment.MaxAlarmsPerFetch] =
             _alarmsOptions.MaxAlarmsPerFetch.ToString(System.Globalization.CultureInfo.InvariantCulture);
 
         commandLine = new WorkerProcessCommandLine(executablePath, arguments);

src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmFailoverEndToEndTests.cs

@@ -384,9 +384,14 @@ public sealed class AlarmFailoverEndToEndTests
     private sealed class StubWatchListResolver(IReadOnlyList<AlarmSubtagTarget> targets) : IAlarmWatchListResolver
     {
         /// <inheritdoc />
-        public Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+        public Task<AlarmWatchListResolution> ResolveAsync(
             AlarmsOptions options,
-            CancellationToken cancellationToken = default) => Task.FromResult(targets);
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult(new AlarmWatchListResolution(
+                targets,
+                DiscoveryAttempted: false,
+                DiscoveryFailed: false,
+                DiscoveryFailureMessage: null));
     }
 
     /// <summary>

src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmTruncationSignalTests.cs

@@ -507,10 +507,14 @@ public sealed class AlarmTruncationSignalTests
     private sealed class StubWatchListResolver : IAlarmWatchListResolver
     {
         /// <inheritdoc />
-        public Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+        public Task<AlarmWatchListResolution> ResolveAsync(
             AlarmsOptions options,
             CancellationToken cancellationToken = default) =>
-            Task.FromResult<IReadOnlyList<AlarmSubtagTarget>>([]);
+            Task.FromResult(new AlarmWatchListResolution(
+                [],
+                DiscoveryAttempted: false,
+                DiscoveryFailed: false,
+                DiscoveryFailureMessage: null));
     }
 
     /// <summary>

src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmWatchListResolverTests.cs

@@ -16,6 +16,21 @@ public sealed class AlarmWatchListResolverTests
     private static AlarmWatchListResolver CreateResolver(IGalaxyRepository repository) =>
         new(repository, NullLogger<AlarmWatchListResolver>.Instance);
 
+    /// <summary>
+    ///     Resolves and projects to the target list. These cases assert composition rules, which
+    ///     live in <see cref="AlarmWatchListResolution.Targets"/>; the discovery-provenance fields
+    ///     the resolution also carries (GWC-37) are asserted by their own cases below.
+    /// </summary>
+    /// <param name="resolver">The resolver under test.</param>
+    /// <param name="options">Alarm options to resolve against.</param>
+    /// <param name="cancellationToken">Token to cancel the resolution.</param>
+    /// <returns>The resolved targets.</returns>
+    private static async Task<IReadOnlyList<AlarmSubtagTarget>> ResolveTargetsAsync(
+        AlarmWatchListResolver resolver,
+        AlarmsOptions options,
+        CancellationToken cancellationToken = default) =>
+        (await resolver.ResolveAsync(options, cancellationToken)).Targets;
+
     private static AlarmsOptions Options(
         bool useGalaxyRepository = true,
         string area = "",
@@ -58,7 +73,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             include: ["pump01.fault", "Valve03.Position.Lo"],
             exclude: ["Tank02.Level.HiHi"]));
 
@@ -81,7 +96,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             subtags: new AlarmSubtagNameOptions
             {
                 Active = "InAlarm",
@@ -110,7 +125,7 @@ public sealed class AlarmWatchListResolverTests
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
         // Default Priority is "Priority"; force it empty alongside empty AckComment.
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             subtags: new AlarmSubtagNameOptions { Priority = string.Empty, AckComment = string.Empty }));
 
         AlarmSubtagTarget target = Assert.Single(result);
@@ -140,7 +155,7 @@ public sealed class AlarmWatchListResolverTests
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
         // Config area "DEV" must be ignored for a GR row that has a discovered area.
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, 
             Options(area: "DEV", defaultArea: "DEV"));
 
         AlarmSubtagTarget target = Assert.Single(result);
@@ -161,7 +176,7 @@ public sealed class AlarmWatchListResolverTests
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
         // No discovery area and no default area.
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options());
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options());
 
         AlarmSubtagTarget target = Assert.Single(result);
         Assert.Equal("Galaxy!Tank01.Level.HiHi", target.AlarmFullReference);
@@ -178,7 +193,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             area: "Site_A",
             include: ["Tank01.Level.HiHi"]));
 
@@ -196,7 +211,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             area: "",
             defaultArea: "Plant",
             include: ["Tank01.Level.HiHi"]));
@@ -217,7 +232,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             useGalaxyRepository: false,
             include: ["Tank01.Level.HiHi"]));
 
@@ -235,7 +250,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             include: ["Tank01.Level.HiHi"]));
 
         // Did not throw; discovery set empty, include retained.
@@ -243,6 +258,51 @@ public sealed class AlarmWatchListResolverTests
         Assert.Equal("Galaxy!Tank01.Level.HiHi", target.AlarmFullReference);
     }
 
+    /// <summary>
+    ///     GWC-37: swallowing the discovery failure is right for the resolver but leaves the
+    ///     caller unable to tell "discovery produced nothing" from "nothing was configured", which
+    ///     is why the empty watch-list could sit unnoticed for a monitor's whole life. The
+    ///     resolution therefore reports whether discovery was attempted, whether it failed, and
+    ///     the failure message the provider status quotes.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task ResolveAsync_RepositoryThrows_ReportsDiscoveryFailureOnTheResolution()
+    {
+        ThrowingGalaxyRepository repo = new(new InvalidOperationException("SQL unavailable"));
+
+        AlarmWatchListResolver resolver = CreateResolver(repo);
+
+        AlarmWatchListResolution resolution = await resolver.ResolveAsync(Options());
+
+        Assert.Empty(resolution.Targets);
+        Assert.True(resolution.DiscoveryAttempted);
+        Assert.True(resolution.DiscoveryFailed);
+        Assert.Equal("SQL unavailable", resolution.DiscoveryFailureMessage);
+    }
+
+    /// <summary>
+    ///     The complement of the case above: discovery disabled is not discovery failed. An empty
+    ///     watch-list here means the deployment did not ask for subtag coverage, which the monitor
+    ///     must not report as a degraded standby (GWC-37).
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task ResolveAsync_RepositoryDisabled_ReportsDiscoveryNotAttempted()
+    {
+        StubGalaxyRepository repo = new([]);
+
+        AlarmWatchListResolver resolver = CreateResolver(repo);
+
+        AlarmWatchListResolution resolution = await resolver.ResolveAsync(
+            Options(useGalaxyRepository: false));
+
+        Assert.Empty(resolution.Targets);
+        Assert.False(resolution.DiscoveryAttempted);
+        Assert.False(resolution.DiscoveryFailed);
+        Assert.Null(resolution.DiscoveryFailureMessage);
+    }
+
     /// <summary>Verifies the source object reference is derived from a config include entry, using the portion before the first dot when present.</summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -252,7 +312,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             include: ["Tank01.Level.HiHi", "StandaloneTag"]));
 
         Assert.Equal("Tank01", result[0].SourceObjectReference);
@@ -273,7 +333,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             useGalaxyRepository: false,
             include: ["Tank01.Level.HiHi"],
             exclude: ["Tank01.Level.HiHi"]));
@@ -299,7 +359,7 @@ public sealed class AlarmWatchListResolverTests
 
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             useGalaxyRepository: true,
             exclude: ["Tank02.Level.HiHi"]));
 
@@ -324,7 +384,7 @@ public sealed class AlarmWatchListResolverTests
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
         // The exclude array contains a whitespace-only string — should be a no-op.
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             useGalaxyRepository: true,
             exclude: ["   "]));
 
@@ -351,7 +411,7 @@ public sealed class AlarmWatchListResolverTests
         AlarmWatchListResolver resolver = CreateResolver(repo);
 
         await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
-            resolver.ResolveAsync(
+            ResolveTargetsAsync(resolver, 
                 Options(include: ["Tank01.Level.HiHi"]),
                 cts.Token));
     }
@@ -375,7 +435,7 @@ public sealed class AlarmWatchListResolverTests
 
         // Pump01.Fault is an explicit include AND an exclude (case-insensitive). It must
         // be dropped; the GR row Tank01 survives.
-        IReadOnlyList<AlarmSubtagTarget> result = await resolver.ResolveAsync(Options(
+        IReadOnlyList<AlarmSubtagTarget> result = await ResolveTargetsAsync(resolver, Options(
             useGalaxyRepository: true,
             include: ["Pump01.Fault"],
             exclude: ["pump01.fault"]));

src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorAttachOrderTests.cs

@@ -155,6 +155,66 @@ public sealed class GatewayAlarmMonitorAttachOrderTests
         await monitor.StopAsync(CancellationToken.None);
     }
 
+    /// <summary>
+    ///     GWC-35: an acknowledged cached alarm followed by an active snapshot with a newer
+    ///     original-raise timestamp is a new alarm instance, not an acknowledgement reversal. The
+    ///     reconcile repair must broadcast a Raise carrying the incoming instance identity.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task ApplyReconcile_WhenAcknowledgedAlarmHasNewActiveInstance_BroadcastsRaise()
+    {
+        using GatewayMetrics metrics = new();
+        await using FakeSessionManager sessions = new();
+        using GatewayAlarmMonitor monitor = CreateMonitor(sessions, metrics);
+
+        using CancellationTokenSource cts = new();
+        await monitor.StartAsync(cts.Token);
+        await sessions.WaitForSubscribeStartAsync(WaitTimeout);
+
+        Timestamp oldRaise = Timestamp.FromDateTimeOffset(
+            new DateTimeOffset(2026, 8, 10, 13, 0, 0, TimeSpan.Zero));
+        sessions.SetReconcileSnapshot(SnapshotAt(AlarmConditionState.ActiveAcked, oldRaise, oldRaise));
+        sessions.EmitEvent(ProviderModeProbe(1));
+        await WaitUntilAsync(
+            () => monitor.CurrentAlarms.Any(alarm => alarm.AlarmFullReference == AlarmReference
+                && alarm.CurrentState == AlarmConditionState.ActiveAcked),
+            WaitTimeout);
+
+        List<AlarmFeedMessage> received = [];
+        TaskCompletionSource snapshotComplete = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        using CancellationTokenSource streamCts = new();
+        Task reader = ReadFeedAsync(monitor, received, snapshotComplete, streamCts.Token, untilSnapshotComplete: true);
+        await snapshotComplete.Task.WaitAsync(WaitTimeout);
+
+        Timestamp newRaise = Timestamp.FromDateTimeOffset(
+            new DateTimeOffset(2026, 8, 10, 13, 0, 20, TimeSpan.Zero));
+        sessions.SetReconcileSnapshot(SnapshotAt(AlarmConditionState.Active, newRaise, newRaise));
+        sessions.EmitEvent(ProviderModeProbe(2));
+
+        AlarmFeedMessage raise = await WaitForAsync(
+            received,
+            m => m.PayloadCase == AlarmFeedMessage.PayloadOneofCase.Transition
+                && m.Transition.TransitionKind == AlarmTransitionKind.Raise,
+            WaitTimeout);
+        Assert.Equal(AlarmReference, raise.Transition.AlarmFullReference);
+        Assert.Equal(newRaise, raise.Transition.OriginalRaiseTimestamp);
+        Assert.Equal(newRaise, raise.Transition.TransitionTimestamp);
+
+        lock (received)
+        {
+            AlarmFeedMessage[] transitions = received
+                .Where(m => m.PayloadCase == AlarmFeedMessage.PayloadOneofCase.Transition)
+                .ToArray();
+            Assert.Single(transitions);
+        }
+
+        await streamCts.CancelAsync();
+        await reader;
+        await cts.CancelAsync();
+        await monitor.StopAsync(CancellationToken.None);
+    }
+
     /// <summary>
     ///     NEXT-03. A reconcile Raise repair applied while the matching live Raise is still
     ///     buffered must not double-broadcast: the live transition carrying the same worker
@@ -498,10 +558,14 @@ public sealed class GatewayAlarmMonitorAttachOrderTests
     private sealed class StubWatchListResolver : IAlarmWatchListResolver
     {
         /// <inheritdoc />
-        public Task<IReadOnlyList<AlarmSubtagTarget>> ResolveAsync(
+        public Task<AlarmWatchListResolution> ResolveAsync(
             AlarmsOptions options,
             CancellationToken cancellationToken = default) =>
-            Task.FromResult<IReadOnlyList<AlarmSubtagTarget>>([]);
+            Task.FromResult(new AlarmWatchListResolution(
+                [],
+                DiscoveryAttempted: false,
+                DiscoveryFailed: false,
+                DiscoveryFailureMessage: null));
     }
 
     /// <summary>