Mark Client.Rust findings resolved

All eleven Client.Rust findings are fixed in 0d8a28d; their Status is
now Resolved with the fixing commit recorded. Adds Client.Rust-012 —
an additional clippy::clone_on_copy violation in galaxy.rs found while
verifying that `cargo clippy -- -D warnings` passes — already Resolved
in the same commit. Regenerates code-reviews/README.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clients/rust/RustClientDesign.md

@@ -11,28 +11,34 @@ generated contract inputs.
 
 ## Crate Layout
 
-Recommended layout:
+Actual layout — the `mxgateway-client` library crate is the workspace root,
+with the `mxgw` test CLI as a workspace member:
 
 ```text
-clients/rust/
+clients/rust/                 # `mxgateway-client` library crate (workspace root)
   Cargo.toml
   build.rs
+  src/
+    lib.rs
+    client.rs
+    session.rs
+    galaxy.rs
+    options.rs
+    auth.rs
+    value.rs
+    version.rs
+    error.rs
+    generated.rs
   crates/
-    mxgateway-client/
-      src/lib.rs
-      src/client.rs
-      src/session.rs
-      src/options.rs
-      src/auth.rs
-      src/value.rs
-      src/error.rs
-      src/generated/
-    mxgw-cli/
+    mxgw-cli/                 # `mxgw` test CLI (workspace member)
+      Cargo.toml
       src/main.rs
   tests/
+    client_behavior.rs
+    proto_fixtures.rs
 ```
 
-Expected dependencies:
+Dependencies:
 
 - `tonic`
 - `prost`
@@ -43,7 +49,6 @@ Expected dependencies:
 - `clap`
 - `serde`
 - `serde_json`
-- `tracing`
 
 ## Library API
 

clients/rust/crates/mxgw-cli/src/main.rs

@@ -1048,8 +1048,14 @@ mod tests {
     fn version_json_output_has_protocol_versions() {
         let value = super::version_json();
 
-        assert_eq!(value["gatewayProtocolVersion"], 2);
-        assert_eq!(value["workerProtocolVersion"], 1);
+        assert_eq!(
+            value["gatewayProtocolVersion"],
+            super::GATEWAY_PROTOCOL_VERSION
+        );
+        assert_eq!(
+            value["workerProtocolVersion"],
+            super::WORKER_PROTOCOL_VERSION
+        );
     }
 
     #[test]

clients/rust/src/client.rs

@@ -219,7 +219,9 @@ impl GatewayClient {
         request: AcknowledgeAlarmRequest,
     ) -> Result<AcknowledgeAlarmReply, Error> {
         let mut client = self.inner.clone();
-        let response = client.acknowledge_alarm(self.unary_request(request)).await?;
+        let response = client
+            .acknowledge_alarm(self.unary_request(request))
+            .await?;
         let reply = response.into_inner();
         ensure_protocol_success("acknowledge alarm", reply.protocol_status.as_ref())?;
         Ok(reply)

clients/rust/src/error.rs

@@ -1,10 +1,10 @@
 //! Error types surfaced by the Rust client.
 //!
 //! [`Error`] is the umbrella enum returned by every async wrapper. It
-//! classifies `tonic::Status` codes (auth, timeout, cancellation) and folds
-//! gateway protocol failures and command-level rejections into structured
-//! variants. Credentials embedded in status messages are scrubbed before the
-//! message reaches a caller.
+//! classifies `tonic::Status` codes (auth, timeout, cancellation, transient
+//! unavailability) and folds gateway protocol failures and command-level
+//! rejections into structured variants. Credentials embedded in status
+//! messages are scrubbed before the message reaches a caller.
 
 use thiserror::Error as ThisError;
 use tonic::Code;
@@ -85,6 +85,17 @@ pub enum Error {
         status: Box<tonic::Status>,
     },
 
+    /// Server returned `Unavailable` or `ResourceExhausted` — a transient
+    /// failure (gateway restart, overload) that a caller may reasonably retry.
+    #[error("gateway temporarily unavailable: {message}")]
+    Unavailable {
+        /// Redacted server-supplied detail message.
+        message: String,
+        /// Original `tonic::Status`.
+        #[source]
+        status: Box<tonic::Status>,
+    },
+
     /// Any other `tonic::Status` that did not match a more specific variant.
     #[error("gateway status error: {0}")]
     Status(Box<tonic::Status>),
@@ -106,6 +117,15 @@ pub enum Error {
         /// Detail message from the server.
         message: String,
     },
+
+    /// The gateway returned an OK reply whose payload did not carry the data
+    /// the command contract requires (for example, an `AddItem` reply with no
+    /// item handle and no `return_value`).
+    #[error("malformed gateway reply: {detail}")]
+    MalformedReply {
+        /// Human-readable description of what the reply was missing.
+        detail: String,
+    },
 }
 
 /// Wrapper around an [`MxCommandReply`] whose `protocol_status` reported a
@@ -174,6 +194,10 @@ impl From<tonic::Status> for Error {
                 message,
                 status: Box::new(status),
             },
+            Code::Unavailable | Code::ResourceExhausted => Self::Unavailable {
+                message,
+                status: Box::new(status),
+            },
             _ => Self::Status(Box::new(status)),
         }
     }

clients/rust/src/galaxy.rs

@@ -279,7 +279,7 @@ mod tests {
             _request: Request<GetLastDeployTimeRequest>,
         ) -> Result<Response<GetLastDeployTimeReply>, Status> {
             let present = *self.state.present.lock().unwrap();
-            let time = self.state.last_deploy.lock().unwrap().clone();
+            let time = *self.state.last_deploy.lock().unwrap();
             Ok(Response::new(GetLastDeployTimeReply {
                 present,
                 time_of_last_deploy: time,

clients/rust/src/options.rs

@@ -95,6 +95,8 @@ impl ClientOptions {
         self
     }
 
+    /// Maximum encoded/decoded gRPC message size, in bytes, the transport
+    /// will accept. Defaults to 16 MiB.
     pub fn with_max_grpc_message_bytes(mut self, max_grpc_message_bytes: usize) -> Self {
         self.max_grpc_message_bytes = max_grpc_message_bytes;
         self
@@ -140,6 +142,7 @@ impl ClientOptions {
         self.stream_timeout
     }
 
+    /// Configured maximum gRPC message size in bytes.
     pub fn max_grpc_message_bytes(&self) -> usize {
         self.max_grpc_message_bytes
     }

clients/rust/src/session.rs

@@ -8,6 +8,8 @@
 //! Bulk commands enforce a 1000-item cap before contacting the worker, in
 //! line with the gateway's documented `MAX_BULK_ITEMS`.
 
+use std::sync::atomic::{AtomicU64, Ordering};
+
 use crate::client::{EventStream, GatewayClient};
 use crate::error::{ensure_protocol_success, Error};
 use crate::generated::mxaccess_gateway::v1::mx_command::Payload;
@@ -23,6 +25,16 @@ use crate::value::MxValue;
 
 const MAX_BULK_ITEMS: usize = 1_000;
 
+/// Process-wide monotonic counter that keeps client correlation ids unique.
+static CORRELATION_SEQUENCE: AtomicU64 = AtomicU64::new(0);
+
+/// Build a unique `client_correlation_id` for a request so concurrent or
+/// repeated calls of the same command kind can be told apart in gateway logs.
+fn next_correlation_id(label: &str) -> String {
+    let sequence = CORRELATION_SEQUENCE.fetch_add(1, Ordering::Relaxed);
+    format!("rust-client-{label}-{sequence}")
+}
+
 /// Handle to an opened gateway session.
 ///
 /// `Session` carries the gateway-issued session id and a cloned
@@ -76,7 +88,7 @@ impl Session {
             .client
             .close_session_raw(CloseSessionRequest {
                 session_id: self.id.clone(),
-                client_correlation_id: "rust-client-close-session".to_owned(),
+                client_correlation_id: next_correlation_id("close-session"),
             })
             .await?;
         ensure_protocol_success("close session", reply.protocol_status.as_ref())?;
@@ -99,7 +111,7 @@ impl Session {
             )
             .await?;
 
-        Ok(register_server_handle(&reply))
+        register_server_handle(&reply)
     }
 
     /// Run MXAccess `AddItem` against `server_handle` and return the
@@ -120,7 +132,7 @@ impl Session {
             )
             .await?;
 
-        Ok(add_item_handle(&reply))
+        add_item_handle(&reply)
     }
 
     /// Run MXAccess `AddItem2` (item with a caller-supplied context string)
@@ -146,7 +158,7 @@ impl Session {
             )
             .await?;
 
-        Ok(add_item2_handle(&reply))
+        add_item2_handle(&reply)
     }
 
     /// Run MXAccess `RemoveItem` for the given handle pair.
@@ -226,7 +238,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::AddItemBulk))
+        bulk_results(reply, BulkReplyKind::AddItem)
     }
 
     /// Bulk variant of [`Session::advise`].
@@ -250,7 +262,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::AdviseItemBulk))
+        bulk_results(reply, BulkReplyKind::AdviseItem)
     }
 
     /// Bulk variant of [`Session::remove_item`].
@@ -274,7 +286,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::RemoveItemBulk))
+        bulk_results(reply, BulkReplyKind::RemoveItem)
     }
 
     /// Bulk variant of [`Session::un_advise`].
@@ -298,7 +310,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::UnAdviseItemBulk))
+        bulk_results(reply, BulkReplyKind::UnAdviseItem)
     }
 
     /// Bulk `Subscribe` (atomic add-and-advise) for a list of tag addresses.
@@ -322,7 +334,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::SubscribeBulk))
+        bulk_results(reply, BulkReplyKind::Subscribe)
     }
 
     /// Bulk `Unsubscribe` (atomic un-advise-and-remove) for a list of
@@ -347,7 +359,7 @@ impl Session {
             )
             .await?;
 
-        Ok(bulk_results(reply, BulkReplyKind::UnsubscribeBulk))
+        bulk_results(reply, BulkReplyKind::Unsubscribe)
     }
 
     /// Run MXAccess `Write` (single-value, no caller-supplied timestamp).
@@ -466,7 +478,7 @@ impl Session {
     fn command_request(&self, kind: MxCommandKind, payload: Payload) -> MxCommandRequest {
         MxCommandRequest {
             session_id: self.id.clone(),
-            client_correlation_id: format!("rust-client-{}", kind.as_str_name()),
+            client_correlation_id: next_correlation_id(kind.as_str_name()),
             command: Some(MxCommand {
                 kind: kind as i32,
                 payload: Some(payload),
@@ -486,71 +498,83 @@ fn ensure_bulk_size(name: &'static str, len: usize) -> Result<(), Error> {
     }
 }
 
-fn register_server_handle(reply: &MxCommandReply) -> i32 {
+fn register_server_handle(reply: &MxCommandReply) -> Result<i32, Error> {
     match reply.payload.as_ref() {
-        Some(mx_command_reply::Payload::Register(register)) => register.server_handle,
+        Some(mx_command_reply::Payload::Register(register)) => Ok(register.server_handle),
         _ => reply
             .return_value
             .as_ref()
             .and_then(int32_reply_value)
-            .unwrap_or_default(),
+            .ok_or_else(|| Error::MalformedReply {
+                detail: "Register reply carried neither a register payload nor an \
+                         int32 return value"
+                    .to_owned(),
+            }),
     }
 }
 
-fn add_item_handle(reply: &MxCommandReply) -> i32 {
+fn add_item_handle(reply: &MxCommandReply) -> Result<i32, Error> {
     match reply.payload.as_ref() {
-        Some(mx_command_reply::Payload::AddItem(add_item)) => add_item.item_handle,
+        Some(mx_command_reply::Payload::AddItem(add_item)) => Ok(add_item.item_handle),
         _ => reply
             .return_value
             .as_ref()
             .and_then(int32_reply_value)
-            .unwrap_or_default(),
+            .ok_or_else(|| Error::MalformedReply {
+                detail: "AddItem reply carried neither an add_item payload nor an \
+                         int32 return value"
+                    .to_owned(),
+            }),
     }
 }
 
-fn add_item2_handle(reply: &MxCommandReply) -> i32 {
+fn add_item2_handle(reply: &MxCommandReply) -> Result<i32, Error> {
     match reply.payload.as_ref() {
-        Some(mx_command_reply::Payload::AddItem2(add_item)) => add_item.item_handle,
+        Some(mx_command_reply::Payload::AddItem2(add_item)) => Ok(add_item.item_handle),
         _ => reply
             .return_value
             .as_ref()
             .and_then(int32_reply_value)
-            .unwrap_or_default(),
+            .ok_or_else(|| Error::MalformedReply {
+                detail: "AddItem2 reply carried neither an add_item2 payload nor an \
+                         int32 return value"
+                    .to_owned(),
+            }),
     }
 }
 
 enum BulkReplyKind {
-    AddItemBulk,
-    AdviseItemBulk,
-    RemoveItemBulk,
-    UnAdviseItemBulk,
-    SubscribeBulk,
-    UnsubscribeBulk,
+    AddItem,
+    AdviseItem,
+    RemoveItem,
+    UnAdviseItem,
+    Subscribe,
+    Unsubscribe,
 }
 
-fn bulk_results(reply: MxCommandReply, kind: BulkReplyKind) -> Vec<SubscribeResult> {
+fn bulk_results(reply: MxCommandReply, kind: BulkReplyKind) -> Result<Vec<SubscribeResult>, Error> {
     match (reply.payload, kind) {
-        (Some(mx_command_reply::Payload::AddItemBulk(reply)), BulkReplyKind::AddItemBulk) => {
-            reply.results
+        (Some(mx_command_reply::Payload::AddItemBulk(reply)), BulkReplyKind::AddItem) => {
+            Ok(reply.results)
         }
-        (Some(mx_command_reply::Payload::AdviseItemBulk(reply)), BulkReplyKind::AdviseItemBulk) => {
-            reply.results
+        (Some(mx_command_reply::Payload::AdviseItemBulk(reply)), BulkReplyKind::AdviseItem) => {
+            Ok(reply.results)
         }
-        (Some(mx_command_reply::Payload::RemoveItemBulk(reply)), BulkReplyKind::RemoveItemBulk) => {
-            reply.results
+        (Some(mx_command_reply::Payload::RemoveItemBulk(reply)), BulkReplyKind::RemoveItem) => {
+            Ok(reply.results)
         }
-        (
-            Some(mx_command_reply::Payload::UnAdviseItemBulk(reply)),
-            BulkReplyKind::UnAdviseItemBulk,
-        ) => reply.results,
-        (Some(mx_command_reply::Payload::SubscribeBulk(reply)), BulkReplyKind::SubscribeBulk) => {
-            reply.results
+        (Some(mx_command_reply::Payload::UnAdviseItemBulk(reply)), BulkReplyKind::UnAdviseItem) => {
+            Ok(reply.results)
         }
-        (
-            Some(mx_command_reply::Payload::UnsubscribeBulk(reply)),
-            BulkReplyKind::UnsubscribeBulk,
-        ) => reply.results,
-        _ => Vec::new(),
+        (Some(mx_command_reply::Payload::SubscribeBulk(reply)), BulkReplyKind::Subscribe) => {
+            Ok(reply.results)
+        }
+        (Some(mx_command_reply::Payload::UnsubscribeBulk(reply)), BulkReplyKind::Unsubscribe) => {
+            Ok(reply.results)
+        }
+        _ => Err(Error::MalformedReply {
+            detail: "bulk command reply did not carry the expected bulk result payload".to_owned(),
+        }),
     }
 }
 

clients/rust/src/value.rs

@@ -25,15 +25,13 @@ use crate::generated::mxaccess_gateway::v1::{
 #[derive(Clone, Debug, PartialEq)]
 pub struct MxValue {
     raw: ProtoMxValue,
-    projection: MxValueProjection,
 }
 
 impl MxValue {
-    /// Wrap a protobuf [`ProtoMxValue`] and compute its
-    /// [`MxValueProjection`].
+    /// Wrap a protobuf [`ProtoMxValue`]. The typed [`MxValueProjection`] is
+    /// computed on demand by [`MxValue::projection`].
     pub fn from_proto(raw: ProtoMxValue) -> Self {
-        let projection = MxValueProjection::from_proto(&raw);
-        Self { raw, projection }
+        Self { raw }
     }
 
     /// Build a boolean `MxValue` (`MxDataType::Boolean`, `VT_BOOL`).
@@ -102,9 +100,13 @@ impl MxValue {
         &self.raw
     }
 
-    /// Borrow the typed projection.
-    pub fn projection(&self) -> &MxValueProjection {
-        &self.projection
+    /// Compute the typed projection of this value.
+    ///
+    /// The projection is derived from the raw message on each call rather than
+    /// cached, so a value built only to be sent over the wire never pays the
+    /// projection's allocation cost.
+    pub fn projection(&self) -> MxValueProjection {
+        MxValueProjection::from_proto(&self.raw)
     }
 
     /// Consume the wrapper and return the underlying protobuf message.
@@ -183,15 +185,13 @@ impl MxValueProjection {
 #[derive(Clone, Debug, PartialEq)]
 pub struct MxArrayValue {
     raw: MxArray,
-    projection: MxArrayProjection,
 }
 
 impl MxArrayValue {
-    /// Wrap a protobuf [`MxArray`] and compute its
-    /// [`MxArrayProjection`].
+    /// Wrap a protobuf [`MxArray`]. The typed [`MxArrayProjection`] is
+    /// computed on demand by [`MxArrayValue::projection`].
     pub fn from_proto(raw: MxArray) -> Self {
-        let projection = MxArrayProjection::from_proto(&raw);
-        Self { raw, projection }
+        Self { raw }
     }
 
     /// Build a one-dimensional string array (`VT_ARRAY|VT_BSTR`).
@@ -210,9 +210,10 @@ impl MxArrayValue {
         &self.raw
     }
 
-    /// Borrow the typed projection of the array's elements.
-    pub fn projection(&self) -> &MxArrayProjection {
-        &self.projection
+    /// Compute the typed projection of the array's elements, derived from the
+    /// raw message on each call rather than cached.
+    pub fn projection(&self) -> MxArrayProjection {
+        MxArrayProjection::from_proto(&self.raw)
     }
 }
 

clients/rust/src/version.rs

@@ -3,8 +3,9 @@
 //! The protocol versions track the values the gateway and worker negotiate on
 //! `OpenSession` and let test harnesses cross-check the wire contract.
 
-/// Semantic version of this Rust client crate. Mirrors `Cargo.toml`.
-pub const CLIENT_VERSION: &str = "0.1.0-dev";
+/// Semantic version of this Rust client crate, taken from `Cargo.toml` at
+/// compile time so the two cannot drift.
+pub const CLIENT_VERSION: &str = env!("CARGO_PKG_VERSION");
 
 /// Public gateway gRPC protocol version this client targets.
 pub const GATEWAY_PROTOCOL_VERSION: u32 = 3;

clients/rust/tests/client_behavior.rs

@@ -203,7 +203,7 @@ fn value_conversion_fixtures_keep_typed_projection_and_raw_metadata() {
     });
     assert_eq!(
         int64_value.projection(),
-        &MxValueProjection::Int64(9_223_372_036_854_770_000)
+        MxValueProjection::Int64(9_223_372_036_854_770_000)
     );
 
     let raw_case = case_by_id(cases, "raw-fallback.variant");
@@ -220,7 +220,7 @@ fn value_conversion_fixtures_keep_typed_projection_and_raw_metadata() {
     });
     assert_eq!(
         raw_value.projection(),
-        &MxValueProjection::Raw(vec![1, 2, 3, 4, 5])
+        MxValueProjection::Raw(vec![1, 2, 3, 4, 5])
     );
     assert_eq!(raw_value.raw().raw_data_type, 32767);
     assert!(raw_value.raw().raw_diagnostic.contains("No lossless"));
@@ -272,11 +272,76 @@ fn command_error_display_keeps_raw_reply_accessible() {
     assert!(error.to_string().contains("MxaccessFailure"));
 }
 
+#[tokio::test]
+async fn add_item_bulk_rejects_input_above_the_thousand_item_cap() {
+    let state = Arc::new(FakeState::default());
+    let endpoint = spawn_fake_gateway(state.clone()).await;
+    let client = GatewayClient::connect(ClientOptions::new(endpoint))
+        .await
+        .unwrap();
+    let session = client.session("session-fixture");
+
+    let oversized: Vec<String> = (0..1001).map(|index| format!("Tag{index}")).collect();
+    let error = session.add_item_bulk(12, oversized).await.unwrap_err();
+
+    assert!(
+        matches!(&error, Error::InvalidArgument { name, .. } if name.as_str() == "tag_addresses"),
+        "expected InvalidArgument for tag_addresses, got {error:?}"
+    );
+}
+
+#[tokio::test]
+async fn event_stream_surfaces_a_mid_stream_status_fault() {
+    let state = Arc::new(FakeState::default());
+    state.emit_stream_fault.store(true, Ordering::SeqCst);
+    let endpoint = spawn_fake_gateway(state.clone()).await;
+    let client = GatewayClient::connect(ClientOptions::new(endpoint))
+        .await
+        .unwrap();
+
+    let mut stream = client
+        .stream_events(StreamEventsRequest {
+            session_id: "session-fixture".to_owned(),
+            after_worker_sequence: 0,
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(stream.next().await.unwrap().unwrap().worker_sequence, 1);
+    assert_eq!(stream.next().await.unwrap().unwrap().worker_sequence, 2);
+
+    let fault = stream.next().await.unwrap().unwrap_err();
+
+    assert!(
+        matches!(fault, Error::Unavailable { .. }),
+        "expected Error::Unavailable, got {fault:?}"
+    );
+}
+
+#[tokio::test]
+async fn connect_with_unreadable_ca_file_reports_invalid_endpoint() {
+    let options = ClientOptions::new("https://127.0.0.1:65000")
+        .with_plaintext(false)
+        .with_ca_file("definitely-not-a-real-ca-file.pem");
+
+    // GatewayClient is not Debug, so unwrap_err is unavailable here.
+    let error = match GatewayClient::connect(options).await {
+        Ok(_) => panic!("connect should fail when the CA file cannot be read"),
+        Err(error) => error,
+    };
+
+    assert!(
+        matches!(error, Error::InvalidEndpoint { .. }),
+        "expected Error::InvalidEndpoint, got {error:?}"
+    );
+}
+
 #[derive(Default)]
 struct FakeState {
     authorization: Mutex<Option<String>>,
     last_command_kind: Mutex<Option<i32>>,
     stream_dropped: Arc<AtomicBool>,
+    emit_stream_fault: AtomicBool,
 }
 
 #[derive(Clone)]
@@ -376,6 +441,12 @@ impl MxAccessGateway for FakeGateway {
         let (sender, receiver) = mpsc::channel(4);
         sender.send(Ok(event(1))).await.unwrap();
         sender.send(Ok(event(2))).await.unwrap();
+        if self.state.emit_stream_fault.load(Ordering::SeqCst) {
+            sender
+                .send(Err(Status::unavailable("worker dropped the session")))
+                .await
+                .unwrap();
+        }
 
         Ok(Response::new(DropAwareStream {
             inner: ReceiverStream::new(receiver),

code-reviews/Client.Rust/findings.md

@@ -7,14 +7,14 @@
 | Review date | 2026-05-18 |
 | Commit reviewed | `3cc53a8` |
 | Status | Reviewed |
-| Open findings | 11 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
 | # | Category | Result |
 |---|---|---|
 | 1 | Correctness & logic bugs | Issues found: a stale unit test fails the suite (Client.Rust-003); handle extractors silently return 0 on a shapeless OK reply (Client.Rust-005). |
-| 2 | mxaccessgw conventions | `cargo clippy --workspace --all-targets -- -D warnings` fails (Client.Rust-001, Client.Rust-002), violating a CLAUDE.md hard requirement; hard-coded correlation ids (Client.Rust-011). |
+| 2 | mxaccessgw conventions | `cargo clippy --workspace --all-targets -- -D warnings` fails (Client.Rust-001, Client.Rust-002, Client.Rust-012), violating a CLAUDE.md hard requirement; hard-coded correlation ids (Client.Rust-011). |
 | 3 | Concurrency & thread safety | No issues found — clients are cheaply cloneable, streams are `Send`, drop-cancels-call is verified. |
 | 4 | Error handling & resilience | Issues found: empty-vec on shapeless bulk reply (Client.Rust-006); no transient/permanent classification (Client.Rust-010). |
 | 5 | Security | No issues found — API keys redacted in `Debug`/`Display`, status messages scrubbed, TLS handled correctly. |
@@ -33,13 +33,13 @@
 | Severity | High |
 | Category | mxaccessgw conventions |
 | Location | `clients/rust/src/options.rs:98,143` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `with_max_grpc_message_bytes` and `max_grpc_message_bytes` have no `///` doc comments. The crate sets `#![warn(missing_docs)]` and CLAUDE.md mandates that `cargo clippy --workspace --all-targets -- -D warnings` pass. Under `-D warnings` these become hard errors, so clippy fails to compile the crate — breaking the documented build/test workflow for the module.
 
 **Recommendation:** Add doc comments to both methods, e.g. `/// Maximum encoded/decoded gRPC message size in bytes (default 16 MiB).`
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): doc comments added to both methods.
 
 ### Client.Rust-002
 
@@ -48,13 +48,13 @@
 | Severity | High |
 | Category | mxaccessgw conventions |
 | Location | `clients/rust/src/session.rs:522` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `BulkReplyKind` enum's variants (`AddItemBulk`, `AdviseItemBulk`, `RemoveItemBulk`, `UnAdviseItemBulk`, `SubscribeBulk`, `UnsubscribeBulk`) all share the `Bulk` suffix, tripping `clippy::enum_variant_names`. Under `-D warnings` this is a compile error, so `cargo clippy --workspace --all-targets -- -D warnings` fails — a violation of the CLAUDE.md requirement that clippy pass cleanly.
 
 **Recommendation:** Rename the variants to drop the common suffix (e.g. `AddItem`, `AdviseItem`, …) or add a narrowly-scoped `#[allow(clippy::enum_variant_names)]` with a reason comment.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): variants renamed to `AddItem`/`AdviseItem`/`RemoveItem`/`UnAdviseItem`/`Subscribe`/`Unsubscribe`, which no longer share a common suffix.
 
 ### Client.Rust-003
 
@@ -63,13 +63,13 @@
 | Severity | High |
 | Category | Correctness & logic bugs |
 | Location | `clients/rust/crates/mxgw-cli/src/main.rs:1051` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The unit test `version_json_output_has_protocol_versions` asserts `value["gatewayProtocolVersion"] == 2`, but `GATEWAY_PROTOCOL_VERSION` is `3` (version.rs:10), matching the authoritative server constant `GatewayContractInfo.GatewayProtocolVersion = 3`. The test fails, so `cargo test --workspace` (the documented test step) does not pass — the test was not updated when the protocol version was bumped.
 
 **Recommendation:** Update the assertion to `3`, or better, assert against `GATEWAY_PROTOCOL_VERSION` so it cannot drift again.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): the test now asserts against the `GATEWAY_PROTOCOL_VERSION` / `WORKER_PROTOCOL_VERSION` constants, so it cannot drift again.
 
 ### Client.Rust-004
 
@@ -78,13 +78,13 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `clients/rust/src/version.rs:7` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `CLIENT_VERSION` is `"0.1.0-dev"` and its doc comment claims "Mirrors `Cargo.toml`", but `Cargo.toml` declares `version = "0.1.0"` (no `-dev` suffix). The comment is misleading and the value is not actually kept in sync with the manifest.
 
 **Recommendation:** Either set `CLIENT_VERSION` from the build via `env!("CARGO_PKG_VERSION")`, or correct the constant to `"0.1.0"` and drop the "Mirrors Cargo.toml" claim.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): `CLIENT_VERSION` is now `env!("CARGO_PKG_VERSION")`, taken from `Cargo.toml` at compile time so the two cannot drift.
 
 ### Client.Rust-005
 
@@ -93,13 +93,13 @@
 | Severity | Medium |
 | Category | Correctness & logic bugs |
 | Location | `clients/rust/src/session.rs:489-520` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `register_server_handle`, `add_item_handle`, and `add_item2_handle` fall through to `reply.return_value … .unwrap_or_default()`, returning `0` when the reply carries neither the expected typed payload nor an `Int32` `return_value`. Because `Session::invoke` has already confirmed `protocol_status == Ok`, a malformed-but-OK reply silently yields handle `0`, which the caller then uses as a real handle against the worker.
 
 **Recommendation:** Return `Err(Error::ProtocolStatus { … })` (or a dedicated `Error::MalformedReply`) when an OK reply lacks an extractable handle, instead of defaulting to `0`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): the three handle extractors now return `Result<i32, Error>` and yield the new `Error::MalformedReply` when an OK reply carries no usable handle.
 
 ### Client.Rust-006
 
@@ -108,13 +108,13 @@
 | Severity | Medium |
 | Category | Error handling & resilience |
 | Location | `clients/rust/src/session.rs:531-555` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `bulk_results` returns `Vec::new()` for any `(payload, kind)` combination that does not match the expected arm — including an OK reply carrying the wrong or no payload. A caller of `subscribe_bulk`/`add_item_bulk` then sees an empty result vector and cannot distinguish "zero items processed" from "gateway returned a shapeless reply".
 
 **Recommendation:** Treat a missing/mismatched bulk payload on an OK reply as an error rather than an empty vector, or document the empty-vec fallback explicitly and log it.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): `bulk_results` now returns `Result<Vec<SubscribeResult>, Error>` and yields `Error::MalformedReply` on a mismatched or absent bulk payload.
 
 ### Client.Rust-007
 
@@ -123,13 +123,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `clients/rust/RustClientDesign.md:14-55` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `RustClientDesign.md` is stale relative to the implemented code. It documents a nested `crates/mxgateway-client/` layout (the real crate root is `clients/rust/` with a flat `src/`), and lists `tracing` among "Expected dependencies", but `tracing` appears in no `Cargo.toml`. CLAUDE.md requires docs to change with the source.
 
 **Recommendation:** Update `RustClientDesign.md` to the actual flat layout and remove `tracing` from the dependency list (or add `tracing` if structured logging is genuinely intended).
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): the "Crate Layout" section now shows the actual flat layout (`mxgateway-client` as the workspace-root crate, `mxgw-cli` as a member) and the unused `tracing` entry was removed from the dependency list.
 
 ### Client.Rust-008
 
@@ -138,13 +138,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `clients/rust/src/value.rs:161-261` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `MxValueProjection::from_proto` and `MxArrayProjection::from_proto` deep-clone every element out of the wire message while `MxValue`/`MxArrayValue` also retain the original `raw` message. Every `MxValue` therefore holds two copies of its payload, wasteful for large string arrays or raw blobs arriving on the event stream.
 
 **Recommendation:** Compute the projection lazily on demand, or have the projection borrow from `raw`, so array/raw payloads are not duplicated for every wrapped value.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): `MxValue` and `MxArrayValue` no longer cache a `projection` field — `projection()` computes the typed view on demand from `raw`. A value built only to be sent over the wire now holds a single copy of its payload and pays no projection cost.
 
 ### Client.Rust-009
 
@@ -153,13 +153,13 @@
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `clients/rust/tests/client_behavior.rs`, `clients/rust/src/galaxy.rs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several critical paths are untested: TLS channel setup (`with_plaintext(false)` / CA-file loading), mid-stream `tonic::Status` fault propagation through `EventStream`/`DeployEventStream` (tests only send `Ok` items), and the bulk-size cap (`ensure_bulk_size` rejecting >1000 items).
 
 **Recommendation:** Add tests that (a) feed an `Err(Status)` into the event/deploy streams and assert it surfaces as the mapped `Error`, (b) assert `add_item_bulk` with 1001 items returns `Error::InvalidArgument`, and (c) exercise the CA-file/`InvalidEndpoint` error path.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): added `add_item_bulk_rejects_input_above_the_thousand_item_cap`, `event_stream_surfaces_a_mid_stream_status_fault` (the fake gateway now optionally emits a mid-stream `Status::unavailable`), and `connect_with_unreadable_ca_file_reports_invalid_endpoint`.
 
 ### Client.Rust-010
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `clients/rust/src/client.rs:255-268`, `clients/rust/src/galaxy.rs:204-216` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The client applies only a per-call deadline via `Request::set_timeout` and has no retry, reconnect, or transient-vs-permanent classification. A transient `Unavailable` (e.g. a gateway restart) maps to the catch-all `Error::Status` and is indistinguishable from a permanent failure. This is an acceptable v1 stance but is undocumented.
 
 **Recommendation:** Either add a documented `Error::Unavailable` variant classifying `Code::Unavailable`/`Code::ResourceExhausted`, or explicitly document in the README that the client performs no retries and that transient failures arrive as `Error::Status`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): added the `Error::Unavailable` variant; `From<tonic::Status>` maps `Code::Unavailable` and `Code::ResourceExhausted` to it, so callers can classify transient failures without unwrapping the raw status.
 
 ### Client.Rust-011
 
@@ -183,10 +183,25 @@
 | Severity | Low |
 | Category | mxaccessgw conventions |
 | Location | `clients/rust/src/session.rs:469` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `command_request` hard-codes `client_correlation_id` as `format!("rust-client-{}", kind.as_str_name())`. Every invocation of the same command kind on a session uses an identical correlation id, so the id cannot correlate a specific request/reply pair in gateway logs or among concurrent in-flight calls. MXAccess parity diagnostics rely on correlation ids being unique per call.
 
 **Recommendation:** Append a per-call unique suffix (monotonic counter or UUID) to the correlation id, or expose a way for the caller to supply one.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): correlation ids are built by `next_correlation_id`, which appends a process-wide atomic sequence number; `Session::close` uses it too.
+
+### Client.Rust-012
+
+| Field | Value |
+|---|---|
+| Severity | High |
+| Category | mxaccessgw conventions |
+| Location | `clients/rust/src/galaxy.rs:282` |
+| Status | Resolved |
+
+**Description:** Found while verifying the fix for Client.Rust-001/002: `cargo clippy --workspace --all-targets -- -D warnings` reported a third violation the original review missed. The `get_last_deploy_time` test fake calls `.clone()` on a `MutexGuard<Option<prost_types::Timestamp>>`, and `Option<Timestamp>` is `Copy` (`clippy::clone_on_copy`). Under `-D warnings` this is a compile error, so clippy still did not pass after Client.Rust-001/002 alone.
+
+**Recommendation:** Dereference instead of cloning: `*self.state.last_deploy.lock().unwrap()`.
+
+**Resolution:** Resolved in `0d8a28d` (2026-05-18): replaced `.clone()` with a deref. `cargo clippy --workspace --all-targets -- -D warnings` now passes cleanly.

code-reviews/README.md

@@ -14,7 +14,7 @@ Each module's `findings.md` is the source of truth; this file is generated from
 | [Client.Go](Client.Go/findings.md) | Claude Code | 2026-05-18 | `3cc53a8` | Reviewed | 10 | 10 |
 | [Client.Java](Client.Java/findings.md) | Claude Code | 2026-05-18 | `3cc53a8` | Reviewed | 12 | 12 |
 | [Client.Python](Client.Python/findings.md) | Claude Code | 2026-05-18 | `3cc53a8` | Reviewed | 12 | 12 |
-| [Client.Rust](Client.Rust/findings.md) | Claude Code | 2026-05-18 | `3cc53a8` | Reviewed | 11 | 11 |
+| [Client.Rust](Client.Rust/findings.md) | Claude Code | 2026-05-18 | `3cc53a8` | Reviewed | 0 | 12 |
 | [Contracts](Contracts/findings.md) | Claude Code | 2026-05-18 | `6c64030` | Reviewed | 8 | 8 |
 | [IntegrationTests](IntegrationTests/findings.md) | Claude Code | 2026-05-18 | `6c64030` | Reviewed | 10 | 10 |
 | [Server](Server/findings.md) | Claude Code | 2026-05-18 | `6c64030` | Reviewed | 12 | 14 |
@@ -29,9 +29,6 @@ Findings with status `Open` or `In Progress`, ordered by severity.
 | ID | Severity | Category | Location | Description |
 |---|---|---|---|---|
 | Client.Go-001 | High | Correctness & logic bugs | `clients/go/mxgateway/errors.go:88-93`, `clients/go/mxgateway/errors.go:117-128` | `MxAccessError.Unwrap` returns `e.Command` directly. `EnsureMxAccessSuccess` constructs `&MxAccessError{Reply: reply}` with `Command` left nil (the HRESULT / failing-`MxStatusProxy` path). When `Command` is a nil `*CommandError`, `Unwrap()… |
-| Client.Rust-001 | High | mxaccessgw conventions | `clients/rust/src/options.rs:98,143` | `with_max_grpc_message_bytes` and `max_grpc_message_bytes` have no `///` doc comments. The crate sets `#![warn(missing_docs)]` and CLAUDE.md mandates that `cargo clippy --workspace --all-targets -- -D warnings` pass. Under `-D warnings` th… |
-| Client.Rust-002 | High | mxaccessgw conventions | `clients/rust/src/session.rs:522` | The `BulkReplyKind` enum's variants (`AddItemBulk`, `AdviseItemBulk`, `RemoveItemBulk`, `UnAdviseItemBulk`, `SubscribeBulk`, `UnsubscribeBulk`) all share the `Bulk` suffix, tripping `clippy::enum_variant_names`. Under `-D warnings` this is… |
-| Client.Rust-003 | High | Correctness & logic bugs | `clients/rust/crates/mxgw-cli/src/main.rs:1051` | The unit test `version_json_output_has_protocol_versions` asserts `value["gatewayProtocolVersion"] == 2`, but `GATEWAY_PROTOCOL_VERSION` is `3` (version.rs:10), matching the authoritative server constant `GatewayContractInfo.GatewayProtoco… |
 | IntegrationTests-001 | High | Design-document adherence | `src/MxGateway.IntegrationTests/Galaxy/LiveGalaxyRepositoryFactAttribute.cs:7`, `src/MxGateway.IntegrationTests/Galaxy/GalaxyRepositoryLiveTests.cs` | The Galaxy Repository live test suite and its gating env var `MXGATEWAY_RUN_LIVE_GALAXY_TESTS` (plus connection-string override `MXGATEWAY_LIVE_GALAXY_CONN`) are completely absent from `docs/GatewayTesting.md`. CLAUDE.md mandates updating… |
 | IntegrationTests-002 | High | Design-document adherence | `src/MxGateway.IntegrationTests/DashboardLdapLiveTests.cs:13`, `src/MxGateway.Server/Configuration/LdapOptions.cs:27` | `DashboardLdapLiveTests` builds the authenticator with `new GatewayOptions()`, so it relies on `LdapOptions.RequiredGroup` defaulting to `GwAdmin` and asserts the `admin` user is a member of a `GwAdmin` LDAP group. `glauth.md` does not lis… |
 | Tests-001 | High | Testing coverage | `src/MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs:483-489` | `FakeSessionManager.TryGetSession` unconditionally returns `true` and synthesizes a session for any id. As a result, `Invoke_WhenSessionMissing_ThrowsNotFound` (line 52) only passes because `InvokeException` is pre-seeded — it does not ver… |
@@ -54,8 +51,6 @@ Findings with status `Open` or `In Progress`, ordered by severity.
 | Client.Python-003 | Medium | Error handling & resilience | `clients/python/src/mxgateway/client.py:125-137,155-173` | `stream_events_raw` and `query_active_alarms` call the stub directly with a `timeout` kwarg when `stream_timeout` is set, with no `TypeError` fallback. `galaxy.py:watch_deploy_events` and `_unary` *do* have a fallback that strips `timeout`… |
 | Client.Python-005 | Medium | Performance & resource management | `clients/python/src/mxgateway/galaxy.py:117-140` | `discover_hierarchy` pages through the entire Galaxy object hierarchy and accumulates every `GalaxyObject` (each carrying its full attribute list) into a single in-memory `list` before returning. For a large Galaxy this is a very large all… |
 | Client.Python-009 | Medium | Testing coverage | `clients/python/tests/` | Several non-trivial public paths are untested: `Session.write2`/`add_item2` request construction; the bulk-size limit `_ensure_bulk_size`/`MAX_BULK_ITEMS` guard; the `None`-argument `TypeError` guards in bulk methods; the TLS `ca_file` rea… |
-| Client.Rust-005 | Medium | Correctness & logic bugs | `clients/rust/src/session.rs:489-520` | `register_server_handle`, `add_item_handle`, and `add_item2_handle` fall through to `reply.return_value … .unwrap_or_default()`, returning `0` when the reply carries neither the expected typed payload nor an `Int32` `return_value`. Because… |
-| Client.Rust-006 | Medium | Error handling & resilience | `clients/rust/src/session.rs:531-555` | `bulk_results` returns `Vec::new()` for any `(payload, kind)` combination that does not match the expected arm — including an OK reply carrying the wrong or no payload. A caller of `subscribe_bulk`/`add_item_bulk` then sees an empty result… |
 | Contracts-002 | Medium | Error handling & resilience | `src/MxGateway.Contracts/Protos/mxaccess_gateway.proto:384-385`, `:95` | `MxCommandKind` includes `MX_COMMAND_KIND_ACKNOWLEDGE_ALARM_BY_NAME = 29` and `MxCommand.payload` carries `AcknowledgeAlarmByNameCommand acknowledge_alarm_by_name_command = 38`, but `MxCommandReply.payload` has only `acknowledge_alarm = 34… |
 | IntegrationTests-003 | Medium | Correctness & logic bugs | `src/MxGateway.IntegrationTests/WorkerLiveMxAccessSmokeTests.cs:89-97` | The test asserts only on the first `MxEvent` recorded by `RecordingServerStreamWriter`. A live MXAccess provider can deliver an initial state/quality event whose family or handles differ from the expected `OnDataChange` (e.g. a registratio… |
 | IntegrationTests-004 | Medium | Error handling & resilience | `src/MxGateway.IntegrationTests/WorkerLiveMxAccessSmokeTests.cs:108-111` | In the `finally` block, after `CloseSessionAsync`, the test does `await streamTask.WaitAsync(StreamShutdownTimeout)`. If closing the session does not promptly complete the stream (or `StreamEvents` itself faults), this throws `TimeoutExcep… |
@@ -107,12 +102,6 @@ Findings with status `Open` or `In Progress`, ordered by severity.
 | Client.Python-010 | Low | Code organization & conventions | `clients/python/src/mxgateway/session.py:404`, `clients/python/src/mxgateway_cli/commands.py:422-425` | `session.py` ends with a module-level late import `from .client import GatewayClient # noqa: E402` purely to satisfy a string type hint, and `commands.py:_session` does a function-local import. Both work around a circular dependency that `… |
 | Client.Python-011 | Low | Error handling & resilience | `clients/python/src/mxgateway/errors.py:122-148` | `ensure_mxaccess_success` raises `MxAccessError` if any `mx_status.success == 0`. This treats `success == 0` as the failure sentinel, but `0` is also the proto3 scalar default for an unset `MxStatusProxy`. If the gateway ever returns a rep… |
 | Client.Python-012 | Low | mxaccessgw conventions | `clients/python/src/mxgateway/client.py:84-108`, `clients/python/src/mxgateway/session.py:57-77` | `Session.invoke_raw` does not run `ensure_mxaccess_success` while `Session.invoke` does, so a caller using `invoke_raw` for parity tests gets a reply where an MXAccess HRESULT failure is silently embedded with no exception. This is by desi… |
-| Client.Rust-004 | Low | Documentation & comments | `clients/rust/src/version.rs:7` | `CLIENT_VERSION` is `"0.1.0-dev"` and its doc comment claims "Mirrors `Cargo.toml`", but `Cargo.toml` declares `version = "0.1.0"` (no `-dev` suffix). The comment is misleading and the value is not actually kept in sync with the manifest. |
-| Client.Rust-007 | Low | Design-document adherence | `clients/rust/RustClientDesign.md:14-55` | `RustClientDesign.md` is stale relative to the implemented code. It documents a nested `crates/mxgateway-client/` layout (the real crate root is `clients/rust/` with a flat `src/`), and lists `tracing` among "Expected dependencies", but `t… |
-| Client.Rust-008 | Low | Performance & resource management | `clients/rust/src/value.rs:161-261` | `MxValueProjection::from_proto` and `MxArrayProjection::from_proto` deep-clone every element out of the wire message while `MxValue`/`MxArrayValue` also retain the original `raw` message. Every `MxValue` therefore holds two copies of its p… |
-| Client.Rust-009 | Low | Testing coverage | `clients/rust/tests/client_behavior.rs`, `clients/rust/src/galaxy.rs` | Several critical paths are untested: TLS channel setup (`with_plaintext(false)` / CA-file loading), mid-stream `tonic::Status` fault propagation through `EventStream`/`DeployEventStream` (tests only send `Ok` items), and the bulk-size cap… |
-| Client.Rust-010 | Low | Error handling & resilience | `clients/rust/src/client.rs:255-268`, `clients/rust/src/galaxy.rs:204-216` | The client applies only a per-call deadline via `Request::set_timeout` and has no retry, reconnect, or transient-vs-permanent classification. A transient `Unavailable` (e.g. a gateway restart) maps to the catch-all `Error::Status` and is i… |
-| Client.Rust-011 | Low | mxaccessgw conventions | `clients/rust/src/session.rs:469` | `command_request` hard-codes `client_correlation_id` as `format!("rust-client-{}", kind.as_str_name())`. Every invocation of the same command kind on a session uses an identical correlation id, so the id cannot correlate a specific request… |
 | Contracts-001 | Low | Design-document adherence | `docs/Grpc.md:13` (and `:3`, `:32`, `:39`) | `mxaccess_gateway.proto` now declares six RPCs on `MxAccessGateway` (`OpenSession`, `CloseSession`, `Invoke`, `StreamEvents`, `AcknowledgeAlarm`, `QueryActiveAlarms`). `docs/Grpc.md` still describes "the four `MxAccessGateway` RPCs" in its… |
 | Contracts-003 | Low | Code organization & conventions | `src/MxGateway.Contracts/MxGateway.Contracts.csproj:10` | The `<Protobuf>` item for `mxaccess_worker.proto` omits `ProtoRoot="Protos"`, while the items for `mxaccess_gateway.proto` (line 9) and `galaxy_repository.proto` (line 11) both set it. `mxaccess_worker.proto` does `import "mxaccess_gateway… |
 | Contracts-004 | Low | Documentation & comments | `src/MxGateway.Contracts/GatewayContractInfo.cs:3-6` | The XML summary says the class exposes version metadata "before generated protobuf contracts are introduced." Generated protobuf contracts have long been introduced and are consumed across the solution. The comment is stale; the class now… |
@@ -161,4 +150,16 @@ Findings with status `Resolved`, `Won't Fix`, or `Deferred`.
 | ID | Severity | Status | Category | Location |
 |---|---|---|---|---|
 | Server-001 | Critical | Resolved | Security | `src/MxGateway.Server/GatewayApplication.cs:147-149`, `src/MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs:55-58`, `src/MxGateway.Server/Dashboard/Components/Routes.razor:1-15` |
+| Client.Rust-001 | High | Resolved | mxaccessgw conventions | `clients/rust/src/options.rs:98,143` |
+| Client.Rust-002 | High | Resolved | mxaccessgw conventions | `clients/rust/src/session.rs:522` |
+| Client.Rust-003 | High | Resolved | Correctness & logic bugs | `clients/rust/crates/mxgw-cli/src/main.rs:1051` |
+| Client.Rust-012 | High | Resolved | mxaccessgw conventions | `clients/rust/src/galaxy.rs:282` |
 | Server-003 | High | Resolved | Security | `src/MxGateway.Server/Dashboard/DashboardAuthorizationHandler.cs:39,54-59`, `src/MxGateway.Server/Dashboard/DashboardAuthenticator.cs:236-258` |
+| Client.Rust-005 | Medium | Resolved | Correctness & logic bugs | `clients/rust/src/session.rs:489-520` |
+| Client.Rust-006 | Medium | Resolved | Error handling & resilience | `clients/rust/src/session.rs:531-555` |
+| Client.Rust-004 | Low | Resolved | Documentation & comments | `clients/rust/src/version.rs:7` |
+| Client.Rust-007 | Low | Resolved | Design-document adherence | `clients/rust/RustClientDesign.md:14-55` |
+| Client.Rust-008 | Low | Resolved | Performance & resource management | `clients/rust/src/value.rs:161-261` |
+| Client.Rust-009 | Low | Resolved | Testing coverage | `clients/rust/tests/client_behavior.rs`, `clients/rust/src/galaxy.rs` |
+| Client.Rust-010 | Low | Resolved | Error handling & resilience | `clients/rust/src/client.rs:255-268`, `clients/rust/src/galaxy.rs:204-216` |
+| Client.Rust-011 | Low | Resolved | mxaccessgw conventions | `clients/rust/src/session.rs:469` |