Joseph Doherty
9871d4772d
MxAccessValueCache.Set deep-copied the Value (recursive for an MxArray), the SourceTimestamp, and the Statuses RepeatedField (container plus every MxStatusProxy) on every OnDataChange. The aliasing audit found all three removable: the sink enqueues the event first — which stamps WorkerSequence/WorkerTimestamp inside the queue lock — and only then runs the postPublish hook that reaches Set, so the event is write-once by then and the queue's ownership invariant forbids later mutation. The producer never reuses instances (fresh MxEvent per mapper call, fresh MxValue per convert), and the alias already existed on the read side: MxAccessSession.SucceededRead puts the cache's own Value/SourceTimestamp/status references on every BulkReadResult, which the worker only serializes onto the IPC pipe. Set and CachedValue now carry the ownership contract: the cache holds borrowed references into an enqueued, write-once MxEvent; consumers may read and serialize, never mutate. Mutation would corrupt the still-queued event AND invalidate QueuedEvent.Size — the enqueue-time memoized serialized size the byte-budgeted Drain charges — so a grown message could overshoot the negotiated frame max and fault the session with MessageTooLarge. MxAccessEventQueue's class remark, which claimed the cache keeps an independent snapshot, is corrected to point at the borrow. MxAccessWriteCompletionCache.Record keeps its parallel statuses.Clone() deliberately, with a cross-reference explaining why: it takes a bare RepeatedField whose provenance its signature cannot constrain, and it is on the command-rate write path, not the streaming hot path. Tests: Set_StoresIndependentSnapshot_UnaffectedByLaterEventMutation codified the invariant being reversed, so it is replaced by Set_BorrowsTheEventsOwnInstances_ByOwnershipContract (Assert.Same on Value, SourceTimestamp, and the status row). Adds the missing cached-read-path test to MxAccessCommandExecutorTests — nothing in the worker exercised was_cached == true end to end — asserting the cache hit, reference identity out to the BulkReadResult, and that no COM call is made for the read. Not built or tested here: these are net48/x86 worker files that cannot compile on the macOS tree. Verification is deferred to the windev gate.