mxaccessgw/archreview/2026-07-12/remediation/90-candidate-findings-next-cycle.md

Candidate Findings for the Next Review Cycle (surfaced during 2026-07-12 remediation)

These were discovered while remediating the 2026-07-12 backlog but were out of scope for it — each is either pre-existing, by-design residual, or a new observation. They are recorded here (not fixed) so the next review cycle can triage them. None blocks the 2026-07-12 cycle, which is complete.

ID (proposed)	Area	Severity (est.)	Summary
NEXT-01	Testing / macOS	Low	Fake-worker/e2e gateway tests fail on macOS under the default TMPDIR because the CoreFxPipe_mxaccess-gateway-{pid}-{sessionId} path exceeds the 104-char Unix-domain-socket sun_path limit under /var/folders/…/T/. Workaround today is TMPDIR=/tmp. Fix options: shorten the pipe name, or document the TMPDIR=/tmp requirement in docs/GatewayTesting.md. Surfaced independently by multiple remediation agents.
NEXT-02	Clients (.NET, Java)	Low	The .NET and Java CLIs render the raw ReplayGap sentinel MxEvent on stream-events instead of a typed gap row — Java text mode prints 0 MX_EVENT_FAMILY_UNSPECIFIED. Same defect class as CLI-36 (Go) / CLI-35 (Python), which were fixed this cycle; the .NET/Java halves were out of scope. The cross-language smoke matrix now records this divergence honestly.
NEXT-03	Gateway alarms	Low	GatewayAlarmMonitor.ApplyReconcile feed-repair broadcasts (the new acked-delta from GWC-26 and the pre-existing Raise/Clear repair) are at-least-once, not exactly-once: a periodic reconcile can synthesize a transition whose matching live transition is still buffered in the alarm lease, so both broadcast as indistinguishable duplicates on the alarm feed (StreamAlarms + dashboard hub). Pre-existing (the Raise/Clear repair always had it); GWC-26 documented the at-least-once contract rather than closing the race. Closing it needs reconcile/live serialization or a monotonic dedup marker.
NEXT-04	Worker frame writer	Low	WRK-22/WRK-25 cancellation path: a frame Claimed by a concurrent lock-holder just before its caller's cancellation races in is never awaited by that caller; if the write then faults, TrySetException lands on a Task nobody observes (unobserved-task-exception). By-design residual, non-crash (no UnobservedTaskException handler registered), pre-existing to single-frame WRK-22 and amplified per-batch by WRK-25. Hygiene fix: attach a fault-observing continuation to abandoned/tombstoned frame completions.
NEXT-05	Worker frame writer	Info	A batch whose remaining frames are tombstoned by cancellation leaves dead PendingFrame entries in _eventFrames/_controlFrames until a future DequeueNext pops and skips them. Same pre-existing behavior as single-frame WRK-22, amplified per-batch; in practice heartbeats purge them promptly, so not a real leak.

Operator actions still pending (from this cycle's runbooks)

These are live-infrastructure actions the operator must execute — the repo-side work is complete and merged:

• SEC-36 — rotate the dev LDAP service-account credential per docs/runbooks/SEC-36-ldap-credential-rotation.md (generate new secret in scadaproj/infra/glauth, pre-stage the NSSM env var on deployed hosts, rotate GLAuth on 10.100.0.35, verify dashboard login). The committed literal is gone from the working tree but remains recoverable from git history until rotation completes — rotation is the load-bearing half.
• TST-30 — register a second Gitea act_runner on 10.100.0.35 per docs/runbooks/TST-30-second-ci-runner.md to relieve the single-shared-runner bottleneck.
• TST-25 follow-ups — old TST-05 (scheduled live-MXAccess smoke) is now covered by the nightly-windev job; old TST-24 (client wire tests in CI) is unblocked by the working Windows tier.