fix(review): remediate re-review findings — DCL-029/InboundAPI-031/SiteRuntime-032/StoreAndForward-028 + Low doc/test

Fixes the 8 findings from the 2026-06-24 re-review (commit c42bb485), with a
regression test per Medium finding:

- DataConnectionLayer-029 (Med): HandleAlarmSubscribeCompleted now mirrors the
  tag-path re-check — if a feed is already stored for the source, release the
  redundant just-created subscription instead of overwriting + leaking the first
  one (the double-subscribe window DCL-023 reopened). +regression test.
- InboundAPI-031 (Med): remove WaitForAttribute's local 5s grace backstop (tighter
  than the CommunicationService Ask's timeout+IntegrationTimeout round-trip budget,
  so a slow-but-valid timed-out 'false' got cancelled into a 500). Link only the
  client-abort + explicit caller tokens; the lower layer owns the backstop. +test.
- SiteRuntime-032 (Med): derive the deployed count from an authoritative set of
  deployed config names (HashSet) instead of a map-presence-gated int, so deleting
  a DISABLED instance decrements correctly (SiteRuntime-029's gate leaked it).
  +deploy->disable->delete regression test.
- StoreAndForward-028 (Med): reset _bufferedCount in StopAsync alongside the
  register-guard so a same-instance Stop->Start re-seeds from a clean base (no ~2N
  gauge double-count). +restart regression test.
- AuditLog-017 (Low): test the OnIngestAsync scope-resolution guard (actor survives,
  replies empty, counts the failure) — no longer unpinned.
- CentralUI-037 / ScriptAnalysis-009 / SiteRuntime-033 (Low): doc-comment + spec
  fixes (Database-throws in the inbound sandbox; baseReferences param wording;
  native-alarm cap return-to-normal + per-condition NativeAlarmDropped eviction).

Targeted suites green: SiteRuntime 5, StoreAndForward 6, InboundAPI 31,
DataConnectionLayer 10, AuditLog 5, ScriptAnalysis 40, CentralUI ScriptAnalysis 52.

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Actors/DeploymentManagerRedeployTests.cs

@@ -240,6 +240,47 @@ public class DeploymentManagerRedeployTests : TestKit, IDisposable
         Assert.Equal(0, health.LastDeployedCount);
     }
 
+    [Fact]
+    public async Task SR032_DeleteDisabledInstance_DecrementsDeployedCount()
+    {
+        // Regression test for SiteRuntime-032. SiteRuntime-029 gated the deployed-count
+        // decrement on the instance being present in _instanceActors OR mid-redeploy in
+        // _terminatingActorsByName. A DISABLED instance is in NEITHER map (disable removes
+        // it from _instanceActors and never adds it to the terminating shadow) yet still has
+        // a deployed-config row counted as deployed — so deleting a disabled instance
+        // skipped the decrement and leaked the deployed/disabled tally on the health
+        // dashboard. After the fix the count is derived from the authoritative set of
+        // deployed config names, so a delete decrements for a disabled instance too.
+        var health = new CountCapturingHealthCollector();
+        var actor = CreateDeploymentManager(health);
+        await Task.Delay(500);
+
+        // Deploy → deployed count 1.
+        actor.Tell(new DeployInstanceCommand(
+            "dep-1", "DisablePump", "h1", MakeConfigJson("DisablePump"), "admin", DateTimeOffset.UtcNow));
+        var deploy = ExpectMsg<DeploymentStatusResponse>(TimeSpan.FromSeconds(5));
+        Assert.Equal(DeploymentStatus.Success, deploy.Status);
+        await Task.Delay(300);
+        Assert.Equal(1, health.LastDeployedCount);
+
+        // Disable → the instance is still deployed (count stays 1), just not enabled.
+        actor.Tell(new DisableInstanceCommand("cmd-1", "DisablePump", DateTimeOffset.UtcNow));
+        var disable = ExpectMsg<InstanceLifecycleResponse>(TimeSpan.FromSeconds(5));
+        Assert.True(disable.Success);
+        Assert.Equal(1, health.LastDeployedCount);
+
+        // Delete the DISABLED instance → the deployed count must return to 0.
+        // (The SiteRuntime-029 regression left it stuck at 1.)
+        actor.Tell(new DeleteInstanceCommand("del-1", "DisablePump", DateTimeOffset.UtcNow));
+        var delete = ExpectMsg<InstanceLifecycleResponse>(TimeSpan.FromSeconds(5));
+        Assert.True(delete.Success);
+        Assert.Equal(0, health.LastDeployedCount);
+
+        // No deployed-config row remains.
+        var configs = await _storage.GetAllDeployedConfigsAsync();
+        Assert.DoesNotContain(configs, c => c.InstanceUniqueName == "DisablePump");
+    }
+
     [Fact]
     public async Task Redeploy_ExistingInstance_DoesNotOverCountDeployedInstances()
     {