fix(inbound-api): resolve InboundAPI-002,004,006,008 — disconnect vs timeout, body size limit, active-node gate; surface InboundAPI-007

src/ScadaLink.InboundAPI/InboundScriptExecutor.cs

@@ -142,11 +142,17 @@ public class InboundScriptExecutor
         TimeSpan timeout,
         CancellationToken cancellationToken = default)
     {
+        // InboundAPI-004: keep the timeout source and the request-abort source
+        // separable. A single linked CTS makes a genuine client disconnect
+        // indistinguishable from a method timeout, so a normal disconnect would be
+        // logged and reported as "Script execution timed out". Use a dedicated
+        // timeout CTS, linked with the request token, so the two can be told apart.
+        using var timeoutCts = new CancellationTokenSource(timeout);
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(
+            cancellationToken, timeoutCts.Token);
+
         try
         {
-            using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-            cts.CancelAfter(timeout);
-
             var context = new InboundScriptContext(parameters, route, cts.Token);
 
             if (!_scriptHandlers.TryGetValue(method.Name, out var handler))
@@ -170,8 +176,18 @@ public class InboundScriptExecutor
         }
         catch (OperationCanceledException)
         {
-            _logger.LogWarning("Script execution timed out for method {Method}", method.Name);
-            return new InboundScriptResult(false, null, "Script execution timed out");
+            // InboundAPI-004: distinguish a genuine method timeout from a client
+            // abort. Only the timeout CTS firing is a real timeout; if the caller's
+            // request token fired, the client disconnected — do not pollute the
+            // timeout log (reserved for genuine script-execution timeouts).
+            if (timeoutCts.IsCancellationRequested && !cancellationToken.IsCancellationRequested)
+            {
+                _logger.LogWarning("Script execution timed out for method {Method}", method.Name);
+                return new InboundScriptResult(false, null, "Script execution timed out");
+            }
+
+            _logger.LogDebug("Inbound API request for method {Method} cancelled by client", method.Name);
+            return new InboundScriptResult(false, null, "Request cancelled by client");
         }
         catch (Exception ex)
         {